Privacy (app)
Translation. If there are differences, the German version applies. Deutsch
Last updated: September 28, 2026
Controller
buroLAB · Daniel Buro (Einzelunternehmen)
Habelstr. 1
65719 Hofheim am Taunus
Deutschland
Email: burolab.office@gmail.com
In short
Nightdeck doesn't collect data about you. There is no account, no advertising, no usage analytics and no crash reporting. Everything you enter and everything Nightdeck remembers stays on this device. We receive none of it – apart from what's needed for the free trial and a purchase (see below).
What is stored on the device
Your playlists (address, username, password), settings, favorites, history and progress, reminders and a cache of the catalog. This is necessary for the features you use (§ 25(2) no. 2 TDDDG). You can delete this data in Settings under “Playlists” and “Data & cache”, or by removing the app.
Connections Nightdeck makes for you
Your provider: To load channels, movies, the TV guide and streams, Nightdeck connects to the server in your playlist. The provider receives your IP address, device information and your login details and sees what you access. Your provider is responsible for this.
Images and channel logos are loaded from the addresses your provider specifies, for example image.tmdb.org or imgur.com. The TV guide (XMLTV) is loaded from the address in your playlist or the one you entered. These servers receive your IP address and device information.
The built-in demo loads freely licensed movies and test streams from download.blender.org, test-streams.mux.dev, demo.unified-streaming.com, akamaized.net and devstreaming-cdn.apple.com. If you open a trailer, it comes from YouTube (Google).
The legal basis is Art. 6(1)(b) GDPR: these connections are needed for the features you use.
The maker of your device and the app store you installed Nightdeck from process data under their own responsibility and privacy policies.
Free trial
So that the free trial doesn't start over when the app is reinstalled, Nightdeck asks on first launch whether it may use your TV's device ID for this. Only if you agree does Nightdeck create a checksum (SHA-256) of it and send it to our server. The ID itself never leaves the device and can't be derived from the checksum. We store the checksum and the time the trial started for at most three years.
The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time in Settings under “License”. Without consent the trial works just the same, only without this check.
Purchase and activation
The seller is Gumroad, Inc. (USA) as merchant of record. You enter your details directly at Gumroad when buying; Gumroad's privacy policy applies. We receive the purchase details from Gumroad (for example email address, country, product and license key) to manage licenses and answer questions (Art. 6(1)(b) GDPR). We keep accounting records for as long as tax law requires, usually eight years (Art. 6(1)(c) GDPR).
To unlock, Nightdeck sends your license key to Gumroad to verify it, and checks again about once a day (for example whether a subscription is still active). Gumroad is based in the USA; the transfer is necessary to verify your license (Art. 49(1)(b) GDPR).
If you buy via QR code on your phone, our pairing server brings the key from your phone to your TV. It only knows a random code, a random ID of this installation and, for at most 15 minutes, the key; none of it is stored.
Our server
Pairing and the trial check run on a server of netcup GmbH in Germany, with whom we have a data processing agreement. For technical reasons the server receives your device's IP address; we don't keep access logs.
Your rights
You have the right to access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). Since we store hardly any data about you, there is usually little for us to disclose. Feel free to write to us anyway: burolab.office@gmail.com.
Right to object: where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).
You can also lodge a complaint with a data protection authority (Art. 77 GDPR), for example the Hessian Commissioner for Data Protection and Freedom of Information.
Changes
Before adding other features that transfer data, we will update this policy.