Privacy Policy
Signalbox is a media player. It provides no content. It has no analytics, no advertising and no tracking, and it does not sell or share personal data. You can use the app fully without an account. If you do create one, our server keeps only the minimum needed to run it, and the data you sync is end-to-end encrypted so we cannot read it.
Without an account
Nothing leaves your device except the requests the player makes to the addresses you add (see "Network connections").
Everything you enter or import is stored locally:
- Playlist and source details (names, URLs with credentials removed, settings) and imported channel, movie, series and EPG data, in a local database inside the app's own storage (on macOS, the app sandbox container).
- Favourites, folders, watch history, resume positions, profiles, preferences and parental-control settings.
- Secrets: Xtream passwords, any username/password/token in playlist URLs, PIN hashes and the sync key are kept in the operating system's secure storage: the macOS/iOS Keychain, Windows Credential Manager or the Android Keystore. They are never written to the database, and they are masked in the UI, in logs and in backups.
- Diagnostics log: a small log of warnings, errors and app events (start, background/foreground, playback errors) in the app's own storage, at most two files of 1 MiB that overwrite the oldest entries. Passwords, tokens, stream credentials and e-mail addresses are removed before anything is written; server host names may remain. The log is never sent anywhere automatically. It leaves your device only if you export it yourself (Settings → About → Diagnostics) and choose where to save or send the file.
On Android, this data is excluded from Android's automatic backup (Google Drive) and from device-to-device transfer; it stays on the device. To move it, use the app's own backup in Settings (secrets stay masked) or the optional sync.
You can delete all of this at any time by removing your sources in the app or by uninstalling it. On macOS, also delete ~/Library/Containers/app.signalbox.signalbox.
With the optional account
What our server stores (hosted on Railway, PostgreSQL):
- a random account ID;
- the ID of the sign-in method you used (Sign in with Apple, Google or e-mail code);
- your e-mail address, or the private relay address Apple gives us;
- the names and types of your devices (e.g. "Living room TV", Android TV), up to 5;
- if you turn on sync: encrypted sync records and your encrypted sync key;
- if you use Sign in with Apple: the refresh token Apple issues for your sign-in, encrypted, kept only so we can revoke your Apple sign-in when you unlink it or delete your account (Apple requires this);
- if you buy Pro in the Microsoft Store: the product, its expiry date and a one-way hash of the purchase ID (so one purchase unlocks one account). For yearly plans also the Microsoft Store ID key, encrypted, kept until it expires (at most 90 days) so the renewal can be confirmed without the app.
For abuse protection (rate limits), the server keeps short-lived counters keyed by a one-way hash of the IP address, e-mail address or account ID. They contain no readable address and are deleted within a day.
End-to-end encrypted sync (Pro). Before anything leaves your device it is encrypted with a Sync Key that only your devices hold (XChaCha20-Poly1305). The Sync Key itself is stored on our server only wrapped with your sync passphrase (Argon2id). We never receive the passphrase. We cannot read your synced data, and we cannot recover it if you forget the passphrase. The server sees only technical metadata it needs to deliver the records: which kind of data each record is (for example "favourites"), an opaque record ID, a timestamp, whether it was deleted, and its size.
What can be synced: sources (including their credentials, encrypted; you can switch credential sync off), favourites and folders, history and resume points, settings and profiles, EPG overrides and per-channel player preferences. Channel lists, the TV guide and other catalogue data are never synced.
E-mail. If you sign in with an e-mail code, the code is sent through our e-mail provider (Resend). We do not send newsletters or marketing.
Deleting your account. Settings → Account → Delete account, or on the web at api.signalbox.tv/account/delete, where you confirm with the same sign-in method (no app needed). Deleting your account immediately removes the account, sign-in links, device list, wrapped sync key, all sync records and Microsoft Store purchase records from our server, and revokes a stored Apple sign-in. Data on your devices stays until you remove it. Store purchases are not affected.
Purchases
- App Store, Mac App Store, Google Play, Amazon Appstore: the store processes the payment. The receipt is validated by our purchase back-end, RevenueCat. Without an account it uses a random anonymous ID. If you sign in, it uses your account ID so that Pro works on your other devices.
- Microsoft Store: the store processes the payment. Our server confirms the purchase with Microsoft and records the entitlement for your account (through RevenueCat).
- The macOS DMG and the Windows installer from GitHub do not sell anything. They read your Pro status from your account if you sign in.
No payment details ever reach us.
Network connections
Signalbox connects only to:
- the addresses you add: your playlist, Xtream, EPG, logo and stream URLs, to download and play the content you chose. Those services receive your IP address and the player's requests, as with any media player. Their own privacy policies apply.
- our server, only if you use an account or sync;
- the store and RevenueCat, for purchases and restores;
- Sign in with Apple / Google, only when you choose them;
- devices on your local network, when you add a source from your phone to your TV with the QR code. This transfer goes directly between your devices and not through our server;
- signalbox.tv, for update checks, only in the macOS DMG and the Windows installer downloaded from us (store versions are updated by their store). The app downloads the update feed; the request carries the app name and version and the operating system type in its user agent, plus your IP address as with any web request. No account or device ID is sent, and automatic checks can be turned off in Settings → About → Updates.
Requests to our server are not logged beyond the short-lived operational logs of our hosting provider (Railway). We do not keep IP addresses with your account.
Content
Signalbox does not provide or recommend any content, channels or playlists. You are responsible for the sources you add.
Children
Signalbox is not directed at children.
Changes and contact
If this policy changes, we will update this page and its date. Questions: open an issue at the project's GitHub repository, or write to the support address in the store listing.
Contact: support@signalbox.tv. To delete your account, see Account deletion.