Navarre Privacy Policy
The short version
Navarre is built so that your media never touches our servers. Your movies, shows, and viewing history stay on your own media server - Navarre's own server, or the Jellyfin, Emby, or Plex server you run - and stream directly from it to your own devices. We operate a small "control plane" that handles four things: signing you in, recording your one-time purchase, brokering the handshake that pairs your devices, and, for Navarre's own server, looking up artwork and details for the titles in your library (see Artwork and details). We never see what you watch.
If you turn on remote access: Navarre publishes your media server on the internet at a public HTTPS web address, using your own Tailscale account. The connection to it is encrypted, and we do not advertise the address anywhere - but the address is not a secret either (addresses like it appear in the public certificate logs that cover every HTTPS site), so anyone who has it reaches your server's sign-in page. The passwords on your server's accounts are what control who gets in, which is why Navarre refuses to turn remote access on while any account on your server could be signed into with no password.
Information we collect
- Your email address. Used to sign you in (we email a one-time code - we do not use passwords) and to send receipts and essential service notices.
- Purchase and entitlement records. When you buy the one-time unlock, our payment processor (Stripe, or Google Play) confirms a valid purchase and gives us a reference id and your entitlement status. We do not receive or store your full payment card number.
- Home-server registration. A label you choose for your server, its local network address, and - only if you turn on remote access - the public hostname your own Tailscale account publishes it at.
- A scoped access credential. So a paired device can reach your server from away, we store a limited access token for your media server and a scoped-user credential, encrypted at rest. It is scoped to only the libraries you choose to share.
- Device information. A label and platform for each device you pair (for example, "Pixel phone" or "Windows PC"), plus session tokens that keep you signed in.
- Limited technical data. Your IP address is processed transiently to protect the service from abuse (rate limiting), and then discarded: no field in our database holds your IP address. The one place it can appear is an error report from our control plane (see Crash and error reports, below). We do not build an advertising or tracking profile.
- Email-list signups (separate from your account). If you enter your email address on our home page to get release news, we store that address, the date you entered it, the two-letter country code your connection reported, and the website you arrived from. Nothing else, and it is not linked to a Navarre account. You can remove it yourself, without an account, at navarre.tv/delete - or email support@navarre.tv. Deleting a Navarre account does not clear this list, and leaving this list does not affect an account.
- Campaign tags. When you arrive from a link we published somewhere (a forum post, a directory listing), that link carries our own campaign name in its web address. We count arrivals per campaign - the campaign name and the date, nothing about you - and your browser remembers the campaign name for up to 30 days so that a purchase can be credited to the link that introduced you. No cookie, no advertising network, and nothing that identifies you.
- Crash and error reports. If a Navarre app crashes, we receive a technical report (the error, stack trace, app version, device model, and operating system version) through our crash-reporting provider so we can find and fix the bug. If our control plane hits an error while answering a request, it sends a report the same way: it is tagged with your account's internal number (never your email address), and it can include the web address of the request - for an artwork lookup, that address names the title - and the request's network headers, which carry your IP address. These reports are not used for advertising or profiling, and they never include your media or your watch history.
Artwork and details (Navarre's own server)
When Navarre's own server is connected to your Navarre account, it asks our control plane to describe the titles in your library that your files do not already describe. Each request carries a title, its year, and whether it is a film or a show, and it is made under your account, because only a signed-in server may ask. Our control plane looks the title up at The Movie Database (TMDB), using Navarre's own TMDB account, and answers with the details and the web addresses of the artwork. What it keeps from a lookup is the title, the year, and what it matched, with no account attached. TMDB receives the title search from us, never your email address or your account. Your server then downloads the artwork itself, straight from where it is published (TMDB's image service, and for some titles the image service of the store they came from), so those image services see your home's IP address, as any website you visit does. Lookups happen when your server adds a title, not when anyone watches it, and a server that is never connected to your account makes none of these requests.
Your photos. If Navarre's own server holds your photos, everything it works out about them is worked out on that server, in your home; nothing about your photos is sent to us.
This product uses TMDB and the TMDB APIs but is not endorsed, certified, or otherwise approved by TMDB.
Information we do NOT collect
- Your media files, watch history, or search queries. Streaming is direct from your server to your device and does not pass through Navarre. What you watch never leaves your own equipment on our account - the record of it is written to your own server and is never sent to us. The one part of your library we see is the title and year of something Navarre's own server asks us to describe (see Artwork and details). The other exception is a service you connect yourself; see Services your apps talk to at your request.
- Your media server's administrator password, or your full payment card details.
Service providers we share with
We share the limited data above only with providers that help us run the service, and only as needed:
- Stripe - payments made on our website or in the Windows app.
- Google Play Billing - purchases made in the Android apps.
- Microsoft Azure (United States) - hosts our control plane. Neon - our database.
- Azure Communication Services - delivers your one-time sign-in code by email.
- Sentry (United States) - receives crash reports from the apps and error reports from our control plane, so we can diagnose and fix failures.
- The Movie Database (TMDB) - receives the title searches our control plane makes for Navarre's own server (see Artwork and details); we send it no email address, account, or payment details.
- Tailscale - the encrypted transport that publishes your server for remote access runs on your own Tailscale account; Navarre does not operate it and does not see your streaming traffic.
- Cloudflare - serves navarre.tv and the small release-pointer file the Windows app fetches when it starts, to see whether an update exists. Like any web request, those requests show Cloudflare the requesting IP address and browser or app identifier; Navarre does not record either. Our website analytics are Cloudflare's cookie-free kind, which count visits without tracking anyone between sites.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
Services your apps talk to at your request
These are not providers Navarre shares your data with - they are services your own app connects to because you told it to, and Navarre never starts any of them on your behalf. They are listed here so you know exactly what a connection sends.
- Trakt. If you connect a Trakt account (Settings, then a short code you approve on trakt.tv), the app marks each thing you finish as watched on your Trakt profile, along with how far through you got. That means your viewing goes to Trakt, a company we do not control, under Trakt's own privacy policy. Navarre never sends your files, never lists your library, and never changes anything on your own server, and the connection stops the moment you disconnect it. Nothing is sent to Trakt unless you connect an account.
- Plex. If you choose to use a Plex server you already run, signing in uses Plex's own link-a-device flow: the app asks plex.tv for a short code, you approve it at plex.tv, and plex.tv tells the app which servers your account can reach. That exchange is between you and Plex, under Plex's own privacy policy. Navarre's control plane is not part of it and never receives your Plex account details.
- Emby. If you choose to use an Emby server you already run, the app signs in directly to that server, on your own network, with the username and password you give it. Navarre does not use Emby's cloud sign-in, so nothing about you is sent to Emby the company by these apps.
- Your own media server. Whichever kind you run, your apps talk to it directly and everything they exchange - your library, your progress, your files - stays between your devices and your server.
How long we keep it
We keep your account data while your account is active. Sign-in sessions expire after 90 days. When you delete your account, we delete your account and its associated records (see below). A few small records outlast a deletion: if remote access was on, a record of your server's remote-access connection (its connection identifier and public address, with your account's internal number) is kept for up to 30 days so the connection can be switched off cleanly; a refund our payment provider reports for a purchase we have no record of is kept as the provider's reference alone, with no account attached, so that purchase can never switch the unlock on afterwards; and your payment provider keeps its own records of your purchase under its own policies (see What we keep). Email-list signups are deleted automatically two years after signup, or as soon as you remove yourself at navarre.tv/delete. Campaign counts are deleted after 400 days, and the campaign name your browser remembers expires after 30 days.
Your rights and choices
- Delete your account and data from the app's Settings, or on the web at navarre.tv/delete. Deletion removes your account, entitlement, stored credentials, and paired-device records. One condition, and only one: while a purchase is still standing on the account, deletion is refused, because your entitlement is the only record that you bought the unlock and deleting it would leave you paid up with nothing to show for it. Refund the purchase first - on our website that is one press at navarre.tv/refund/request, and the refund policy covers the Google Play route - and the deletion then goes through. If you never bought the unlock, nothing stands in the way. Either way you can email support@navarre.tv and we will handle both halves for you.
- Access or correct your information by emailing support@navarre.tv.
- Because remote access and streaming run on hardware and networks you own, much of your data already stays under your direct control.
If you are a California resident, you have the right to know, delete, and correct your personal information, and not to be discriminated against for exercising those rights; the controls above satisfy these requests.
Children
Navarre is not directed to children under 13, and we do not knowingly collect their personal information.
Changes to this policy
We may update this policy. We will post the revised effective date here and, for material changes, provide notice.
Contact
Navarre Enterprises LLC · 8987 E Tanque Verde Rd, Ste 309-1017, Tucson, AZ 85749-9399 · support@navarre.tv
Navarre is an independent product and is not affiliated with, endorsed by, or sponsored by Plex, Emby, the Jellyfin project, The Movie Database (TMDB), Tailscale, Google, Amazon, or any other company named on this site. Plex, Emby, Jellyfin, TMDB, Android TV, Google TV, Google Play, YouTube, Amazon, Windows, and Docker are trademarks of their respective owners, used only to describe compatibility. Tailscale is a trademark of Tailscale Inc. This product uses TMDB and the TMDB APIs but is not endorsed, certified, or otherwise approved by TMDB.