Davvy Privacy Policy

Davvy is operated by Polyphasic Developers ("we," "us," or "our"), based in the United Kingdom. This Privacy Policy explains how Davvy handles information when you use the Davvy app on iPhone, iPad, Apple TV and Mac.

For the product overview, visit the Davvy landing page.

Davvy connects directly to a WebDAV or Jellyfin server chosen by the user. Polyphasic Developers operates no Davvy media backend.

Summary

• Davvy has no app account, first-party analytics or first-party crash reporting, and does not ask for permission to track you.
• On iPhone and iPad, Davvy is free and supported by advertising served by Google AdMob. A one-time Davvy Pro purchase removes all advertising. The Apple TV and Mac apps show no advertising.
• Davvy does not present Apple's App Tracking Transparency prompt, so the advertising identifier (IDFA) is not available to the ads SDK. In the UK, EEA and Switzerland, Google's consent form is shown before any ad is requested.
• Davvy connects directly to the WebDAV or Jellyfin server you configure and may use TMDb, IntroDB services and SubDL for requested media features.
• Server profiles, credentials, viewing data and selected settings sync through the user's private iCloud storage. The scanned media index stays on the device.
• The iPhone and iPad builds include Google Cast. Its SDK declares unlinked Device ID, product interaction and diagnostic data for analytics and app functionality, without tracking.

What Polyphasic Developers Receives

Polyphasic Developers receives no information about the user's Davvy library, server credentials, viewing activity or use of the app. Davvy has no Polyphasic Developers account system or media backend.

Davvy contains no first-party analytics or crash-reporting service. The third-party services and SDKs below may receive information directly from the device for the features they provide.

Your WebDAV Server

Davvy sends WebDAV listing, authentication and media requests directly to the server addresses the user configures. Those requests can include the server username and password and the media paths needed to browse and play the library. Traffic does not pass through Polyphasic Developers.

Davvy permits a user-configured plain HTTP server. When HTTP is used, credentials and media are not encrypted in transit. Use HTTPS for any server reached across an untrusted network.

The server operator determines what the server logs and retains. If the server belongs to somebody else, their terms and privacy policy apply.

Your Jellyfin Server

When the user adds a Jellyfin server, Davvy sends the username and password entered to that server's sign-in endpoint once. The server returns an access token, which Davvy stores in the keychain on that device only. The token is not synced through iCloud, and each device signs in for itself. The server password is not stored.

Requests to the server identify the app as Davvy and include the device's name and a device identifier generated for that server, as Jellyfin expects of its clients, so the server can list and revoke each sign-in.

Davvy browses and streams the library from the server, and reports playback start, progress, stop and played or unplayed state back to it, so watch progress stays in step with the user's other Jellyfin apps. Signing out removes the token from the device and asks the server to revoke it.

The server operator determines what the server logs and retains. If the server belongs to somebody else, their terms and privacy policy apply.

TMDb Artwork and Metadata

Davvy sends an app or user-supplied API key, a cleaned title and an optional year to api.themoviedb.org when searching for metadata. Follow-up requests send TMDb identifiers for title details, external identifiers and season metadata. Artwork loads from image.tmdb.org.

These requests are sent directly to TMDb. TMDb receives ordinary network information such as the device's IP address and determines its own logging and retention. See the TMDb privacy policy.

This product uses the TMDB API but is not endorsed or certified by TMDB.

IntroDB Services

For optional skip-timing lookups, Davvy sends a TMDb identifier, optional season and episode numbers, duration when known, and a Davvy version user agent to api.theintrodb.org.

If the primary service has no result, the fallback at api.introdb.app receives an IMDb identifier, optional season and episode numbers, and the same user agent. The service operators receive ordinary network information and determine their own logging and retention.

SubDL Subtitle Search

SubDL is contacted only after the user supplies a SubDL API key and searches for subtitles. Davvy sends that key, the title, media type, optional year, season and episode numbers, and selected languages to api.subdl.com.

When the user selects a result, Davvy downloads it from dl.subdl.com. SubDL receives ordinary network information and determines its own logging and retention.

iCloud Sync and Device Storage

Davvy uses the user's private CloudKit database to mirror server profiles, including server addresses, folder rules, usernames and passwords. It also mirrors watch progress, watch-intent events, metadata corrections, Continue Watching decisions and hand-made skip marks.

Davvy uses iCloud key-value storage to sync user-entered TMDb and SubDL keys, skip preferences, and film and programme sorting preferences.

This information is stored under the user's Apple Account and is processed by Apple. Polyphasic Developers cannot access the user's private iCloud records. The scanned media index remains on each device.

Google Cast and Local Network Playback

The iPhone and iPad builds include the Google Cast SDK. It discovers and communicates with nearby receivers over the local network and Bluetooth. Davvy may give a selected receiver a local HLS stream URL and the media title so the receiver can play the chosen item.

Google Cast's bundled privacy manifest declares Device ID, Product Interaction and Other Diagnostic Data. It describes these as unlinked to the user, not used for tracking, and used for analytics and app functionality.

This processing is performed by Google's SDK, not by a Polyphasic Developers analytics service. See Google's privacy policy.

Apple Services and StoreKit

Davvy is distributed through the App Store. Apple handles downloads and App Store account activity under Apple's privacy policy.

On iPhone and iPad, Davvy offers Davvy Pro, a one-time, non-consumable purchase through Apple's In-App Purchase system that removes all advertising. Apple processes the transaction; Polyphasic Developers does not receive payment-card details. The app asks StoreKit for product details and current entitlements when it launches, so a purchase is recognised on the user's other devices.

CloudKit uses Apple's silent push mechanism to notify Davvy about private iCloud changes. Davvy has no custom push-notification service.

Advertising and Device Data Collected by Google AdMob

On iPhone and iPad, Davvy displays advertising supplied by Google AdMob, a service provided by Google LLC and, for users in the UK, EEA and Switzerland, Google Ireland Limited. The Apple TV and Mac apps contain no advertising SDK and show no ads. Advertising is never shown to a user with Davvy Pro, and the ads SDK is not started for them.

To select, deliver, measure and report on ads, the Google Mobile Ads SDK and Google's advertising partners may collect and process information from the device, including:

• Advertising and device identifiers made available to the SDK. Apple's Identifier for Advertisers (IDFA) is not among them, because Davvy does not request tracking permission, as explained below
• Device information such as device model, operating system version, language, and country or coarse location derived from the IP address
• IP address and network information
• Ad interaction data such as ad impressions, clicks and view time
• App information such as the app identifier and app version
• Diagnostic and performance data relating to ad delivery, including crash and error data generated by the ads SDK

This information is collected by Google directly through its SDK. Polyphasic Developers does not receive the underlying identifiers or profiles, only aggregated, non-identifying reporting from Google such as total impressions, revenue and country-level breakdowns. Davvy never shares the user's library, server details, credentials or viewing activity with advertisers.

Advertising, Consent and Tracking Permission

Tracking permission

Davvy does not present Apple's App Tracking Transparency (ATT) prompt and does not ask for permission to track you across apps and websites. On current versions of iOS and iPadOS, the IDFA is released to an app only once that permission has been granted, so it is not available to the Google Mobile Ads SDK in Davvy. Davvy requests non-personalised ads.

You can review and restrict app tracking generally at any time in Settings › Privacy & Security › Tracking.

Advertising consent

If you are in the UK, EEA or Switzerland, Davvy presents a consent form supplied by Google's User Messaging Platform. You can consent, manage individual purposes or decline. The Google Mobile Ads SDK is not started and no ad is requested until that choice has been made, so no advertising data is collected from the device beforehand.

You can change your choice at any time in Davvy's Settings › Ad Privacy Options. That option appears whenever Google indicates a consent choice applies to you. Outside the UK, EEA and Switzerland no consent form is shown.

What this means for the ads you see

Because Davvy never requests tracking permission, Google cannot link your ad activity in Davvy to a cross-app advertising profile built from the IDFA. Subject to the consent choice you make, Google does still process the other data described above, including IP address and device and ad interaction information, for ad delivery, frequency capping, aggregated reporting, and fraud and abuse prevention, and may use that data in accordance with its own policies.

Google's handling of the data it collects is governed by its own terms. See the Google Privacy Policy, how Google uses information from sites or apps that use its services and AdMob and user data.

Google Cast's analytics processing is described separately above.

How Data Is Shared

Polyphasic Developers does not sell personal information. Information leaves the device only for the user's WebDAV or Jellyfin server, the user's private iCloud storage, Apple services, Google AdMob and Google's advertising partners on iPhone and iPad, and the optional or app-supporting third-party services described in this policy.

Each server or third-party provider determines how it processes the requests it receives.

Data Retention

Data stored locally remains until it is deleted through normal use or the app is removed. Data in the user's private iCloud storage remains according to the user's actions and Apple's retention rules.

WebDAV and Jellyfin server operators, Apple, TMDb, IntroDB service operators, SubDL and Google set their own retention periods for data they receive. Polyphasic Developers does not hold a copy of that data.

Your Rights and Choices

Users can remove local Davvy data by deleting it in the app where available or deleting the app. They can manage iCloud data and permissions through their Apple Account and device settings, and can stop optional SubDL use by removing its API key. On iPhone and iPad they can change their advertising consent in Settings › Ad Privacy Options where it applies, or remove advertising entirely with Davvy Pro.

For users in the UK, EEA and Switzerland, the collection of advertising data relies on consent, gathered through Google's User Messaging Platform before any ad is requested and changeable or withdrawable at any time as described above.

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of personal data, and to complain to a supervisory authority. In the UK, that authority is the Information Commissioner's Office. Contact us if you need help identifying the appropriate provider.

Children

Davvy is not directed to children under 13. Polyphasic Developers does not knowingly collect personal information from children through Davvy.

Security

Connections to Apple, TMDb, IntroDB services, SubDL and Google use encrypted transport. Connections to a user-configured WebDAV server use the transport selected by the user and may be unencrypted when the address begins with http://.

No method of electronic storage or transmission is completely secure. Users should prefer HTTPS for WebDAV servers reached outside a trusted local network and protect their Apple Account and server credentials.

International Transfers

Polyphasic Developers does not operate a Davvy backend or transfer Davvy user data. Apple, TMDb, IntroDB service operators, SubDL and Google operate their own infrastructure and determine any international transfers arising from requests sent to them. Their privacy policies describe their safeguards.

Changes to This Policy

We may update this Privacy Policy when Davvy changes how it handles information. If we make a material change, we will update the effective date and provide additional notice where appropriate.

Contact Us

For questions about this Privacy Policy, contact [email protected].

Polyphasic Developers, Lincoln, United Kingdom.