What Loppy keeps, and why.

The app on its own

On its own (local mode), the Loppy app talks to your media server directly. Nothing about your library or what you watch is sent to Loppy. If you buy Loppy Plus or Household in the app, Google Play or Amazon handles the payment: Loppy never sees your card.

Your loppy.tv account

• Your email address, a name if you give one, and your time zone.
• Your password, kept only as a one-way hash, which can’t be turned back into it.
• With two-step sign-in, your authenticator app’s secret (encrypted) and your recovery codes (as hashes), and any browsers you’ve asked to be remembered.
• When you last signed in. Sign-in attempts, with the network address they came from, are kept for a day, to stop guessing.

With your TVs linked (Household)

• Each TV’s name, model, app version and when it last checked in.
• An index of your media server’s library, which your TVs send so the channels can be made here: titles, years, genres, lengths, ratings, collection and playlist names, and your server’s own ids for them. Never the films or episodes themselves, your server’s address, file paths or passwords.
• The channels made from it, their schedules, and any changes you make to them.
• Favourites, hidden channels and where you stopped watching, so every TV agrees.
• Programmes your TVs couldn’t play, so you can see what needs fixing.
• If you connect Plex here, its sign-in for your own TVs, encrypted.

Purchases

When you buy Plus or Household on a TV, the TV sends the store’s receipt, and loppy.tv checks it with Google or Amazon. Loppy keeps the purchase’s token (encrypted), what was bought, and its state and dates as the store reports them, so your plan follows your subscription. A record of plan changes and store events is kept without your account for counting, with nothing in it that identifies you.

Email

Loppy sends the emails your account needs: confirming your address, resetting your password, servers shared with you, and changes to two-step sign-in. They go through Sendvia, and Loppy keeps a list of what was sent. No newsletters, no marketing.

How it’s looked after

• Everything travels over HTTPS.
• Your library index, schedules, favourites and viewing positions, and problem reports are encrypted in the database with a key of your account’s own, and that key is locked with a site key kept outside the database. A copy of the database, or a backup, shows none of it.
• Passwords, TV sign-ins and recovery codes are kept as one-way hashes; store tokens and share codes are encrypted.
• No advertising, no trackers, no analytics scripts.

Who else sees it

• Accounts you share a server with see its name, your name (or a masked email), and the channels you share.
• Sendvia, to deliver email; Google and Amazon, to check purchases; Plex, if you connect it.
• No one else. Loppy doesn’t sell or share your data.

How long

• Your account’s data, for as long as you have the account.
• A library no TV has sent for six months is deleted, with the channels and schedules made from it.
• The history of changes to favourites and viewing positions is kept for 180 days, the current ones while you have the account; idle sign-ins end after 14 days.
• A note of what Loppy’s admins did to an account, with its email address, is kept for security.

Your choices

• Download your data: everything above, in one file, from your account page.
• Delete your account: from your account page. It all goes at once.
• Forget a server: on your Servers page, its library, channels and schedules go.
• Two-step sign-in: turn it on from your account page.