Tillarr

Privacy Policy

This is a draft for review. It is not in effect yet and will be finalised before Tillarr launches.

Tillarr Privacy Policy (DRAFT)

Last updated: [DATE]

Tillarr ("Tillarr", "we", "us") makes the Tillarr app for iPhone, iPad and Mac. The app helps you manage self-hosted services you run, such as Sonarr, Radarr, Seerr, qBittorrent, Jellyfin and Proxmox VE.

Data controller: [LEGAL ENTITY NAME], [REGISTERED ADDRESS], [COUNTRY]. Contact: privacy@tillarr.com.

The short version

  • Tillarr connects directly from your device to your own servers. We don't run servers that sit between you and your services.
  • Your server addresses, API keys and passwords stay on your devices, in Apple's Keychain. If you turn on sync, they also go to your own iCloud. We never receive them.
  • We use no advertising and no third-party analytics.
  • If you use push notifications (Tillarr Pro), a small relay we operate forwards notifications from your services to your devices. The relay is described below.
  • Purchases go through Apple, and we use RevenueCat to manage them under an anonymous ID.

What stays on your device

These are stored only on your device (and in your iCloud if you turn on sync):

  • the services you add: names, addresses, ports and paths
  • your credentials: API keys, passwords, tokens and custom header values
  • trusted certificate fingerprints
  • cached information from your services, such as library lists, posters, queue and calendar data
  • a local log of recent network requests, which you can view in Settings → Network activity
  • your preferences

When iCloud sync is on, your settings are stored with Apple's iCloud key-value storage, and your credentials are stored in iCloud Keychain, which Apple encrypts end-to-end. Apple's privacy policy applies to iCloud. We can't access your iCloud data.

Information we process

1. Purchases (Tillarr Pro)

Apple processes your payment. We never see your payment details. To know whether you have Tillarr Pro, the app uses RevenueCat, Inc. RevenueCat receives:

  • a random, anonymous app user ID
  • your App Store transaction and receipt information
  • basic device information (such as OS version and country/storefront)

We don't send RevenueCat your name or email. RevenueCat acts as our processor: see https://www.revenuecat.com/privacy.

Purpose: to provide and verify your purchase. Legal basis: performance of a contract.

2. Push notifications (optional, Tillarr Pro)

If you turn on notifications, the app sets up a webhook in your service (for example Sonarr) that points to our relay, which runs on Cloudflare, Inc.'s network.

What the relay stores:

  • a random device ID
  • your device's Apple push token
  • a public encryption key generated on your device
  • random IDs for each connected service ("inboxes")
  • the service type (for example "Sonarr")
  • when your Pro status was last checked, and simple delivery counts used for rate limiting (kept 7 days)

When your service sends an event, the relay:

  1. receives the event over an encrypted connection
  2. reduces it to a short summary (for example a title and episode number)
  3. encrypts that summary with your device's public key, so only your device can read it
  4. sends it to your device through Apple Push Notification service

The original event exists only in memory for the moment it takes to do this. We don't store it, log it or use it for anything else. We cannot read the notifications after they're encrypted.

Deletion: you can remove all relay data at any time with Settings → Notifications → Reset notifications (or by turning notifications off). Relay data is deleted automatically 30 days after Tillarr Pro ends.

Legal basis: performance of a contract (providing the feature you turned on).

3. Support

If you email support@tillarr.com, we receive your email address and your message. If you choose to attach a diagnostics file, we also receive what you see in it before sending:

  • app and OS version
  • service types and versions
  • recent errors
  • redacted network log lines with server addresses removed

We use this only to help you, and delete support emails [24 months] after the conversation ends.

Legal basis: legitimate interest in supporting our users, or your consent for attachments.

4. Crash reports and App Store analytics

If you choose to share analytics with app developers in your device settings, Apple gives us aggregated usage statistics and crash reports. These don't identify you. We don't add any analytics or crash-reporting software of our own.

What we don't do

  • We don't sell or share your personal information for advertising.
  • We don't track you across apps or websites.
  • We don't access your media, your servers or your credentials.
  • We don't ask for your Apple ID password. Only Apple's own sign-in sheets ever ask for it.

Your services and other parties

Tillarr connects to services you run, using addresses you choose. If you connect through third-party networks (such as Tailscale, Cloudflare Tunnel or a reverse proxy you configure), their terms and privacy policies apply to that traffic. What your own services do with data is up to you and their software.

Children

Tillarr is not directed to children under 13 (or the minimum age in your country), and we don't knowingly collect their information.

International transfers

RevenueCat and Cloudflare may process data in the United States and other countries. Where required, transfers rely on Standard Contractual Clauses or equivalent safeguards. [CONFIRM WITH COUNSEL, INCLUDING KVKK REQUIREMENTS]

Retention

Data Retention
Relay device and inbox records Until you reset or disable notifications, or 30 days after Pro ends
Relay delivery counters 7 days
Support emails [24 months] after the conversation ends
RevenueCat purchase records As long as needed to provide purchases and meet legal obligations (see RevenueCat's policy)

Your rights

Depending on where you live (for example under the GDPR, the UK GDPR, KVKK or CCPA/CPRA), you may have the right to:

  • access, correct or delete your personal information
  • object to or restrict processing
  • port your data
  • withdraw consent
  • complain to a data protection authority

Because Tillarr stores almost everything on your device, you can delete most data yourself by deleting the app and, if you use sync, removing Tillarr's data from iCloud (Settings → [your name] → iCloud → Manage Storage).

To exercise any right, email privacy@tillarr.com. We'll answer within 30 days.

Security

Credentials are kept in Apple's Keychain. The app supports TLS with certificate pinning for self-signed certificates. Optional App Lock requires Face ID, Touch ID or your device passcode. Report security issues to security@tillarr.com.

Changes

If we change this policy, we'll update the "Last updated" date. For material changes, we'll also tell you in the app before they take effect.

Contact

[LEGAL ENTITY NAME] · [ADDRESS] · privacy@tillarr.com