Privacy Policy

What the app does with your network

TV Remote talks directly to your TV over your local Wi-Fi network to discover it, pair with it, and send remote-control commands. Remote-control traffic never leaves your home network and never passes through our servers.

We operate a diagnostic-report server. It does not relay remote-control traffic or receive pairing credentials. Reports use random installation and TV references to connect related technical events, not a name or account. The information collected by current and older app versions is described below.

iOS will ask for the Local Network permission the first time you scan. To find your TV the app looks for AirPlay services on your network and briefly probes the TV control ports (8001, 3001, 3000, 8060) on your local subnet. It never builds or transmits an inventory of the other devices on your network.

What is stored on your device

The app stores a profile for each TV in its local database: the name and model the TV reports about itself, its IP address and port, its MAC address (used to send a wake-up packet so you can turn the TV on), and the TV's own device identifier. Pairing credentials - Samsung tokens and LG client keys - are stored separately in the iOS Keychain and are not synced to iCloud.

The app never uploads any of this. It stays on your iPhone and is removed when you delete the corresponding TV or uninstall the app (Keychain items may persist per standard iOS behavior until overwritten).

Diagnostics

When enabled, connection diagnostics help us investigate failures and understand subsequent recovery. Reports cover failed and successful connections, disconnections, retry actions, request errors, cancellation of incomplete attempts, technical device information, credential-storage results (not credentials), and the first command sent in a connection or following a reported command failure. A sent command is not a claim that the TV performed the action. This is diagnostic event reporting, not continuous screen, viewing-history or remote-command recording.

What a report contains. Your iPhone model, app and iOS versions; TV brand and protocol; commercial model code and firmware when the TV provides them; timestamps and elapsed times; connection stages; safe error codes and categories; whether a pairing-prompt signal was observed; whether a credential was present, issued or saved (never its value); and whether a retry came from you, app launch, returning to the app, automatic reconnection or finding a changed TV address. Newer reports also include bounded results of local-interface, TV-service and rediscovery checks, a technical registration-library/configuration profile, and the outcome of recovery actions. Address recovery records whether an address changed and which kind of identity check was used, not the address or identity value. Underlying operating-system errors are limited to recognized domains and numeric codes, not raw error descriptions. Unknown information is marked unavailable; previously obtained model information is labelled as such. Up to 24 structured stage entries accompany an event. Random installation, TV, attempt and event references let us connect an error to later outcomes. Command reporting uses broad categories such as key, text, app or pointer, not the typed text or command payload.

What is excluded. New structured reports do not include user-assigned TV or room names, exact IP addresses, MAC addresses, serial numbers, pairing credentials, raw TV responses or typed text. Model and firmware values are taken only from selected technical fields and checked for format. Older app versions send failure-only reports with up to 40 recent log lines of 200 characters; the server keeps the last 20. Those older lines may include button names or app names/identifiers. Before upload, known names and identifiers, MACs, IPv6 and long secret-like values are removed, and IPv4 is reduced to a subnet. Generic redaction cannot recognize every unexpected value, especially short secrets; connection code therefore avoids logging credentials or typed text in the first place.

Who receives it. A server we operate ourselves on Cloudflare, which stores the reports in a Cloudflare D1 database. No third-party analytics company is involved at any point. As with any request over the internet, Cloudflare's network necessarily sees the IP address your report is sent from. Our Worker uses that edge-provided IP address as a temporary per-IP abuse-control key, allowing up to 20 report requests per 60 seconds. The IP address is not added to the diagnostic report or stored in our D1 database.

How long it is kept. If delivery fails, up to 50 reports may be queued on your device for up to 30 days and retried on a later report or when you return to the app. Older queued reports are discarded when this limit is reached. Turning diagnostics off deletes queued reports; an internet request already in flight may still finish. Uploaded reports become eligible for deletion 30 days after arrival, and a daily job removes them, so they can remain for approximately 31 days. Turning diagnostics off does not delete reports already uploaded.

How it is tagged. Reports carry a random per-installation identifier and random TV, connection-attempt and event references. These are not your name, Apple ID, hardware ID, MAC or a hash of a network address. They allow pseudonymous correlation of reports from the same installation and locally recognized TV; we do not maintain an account or name mapping. Local TV references and last-known technical information are bounded to 100 entries and expire after 30 days without connection activity. A fresh installation can create new references, so we cannot guarantee that reports before and after reinstalling can be matched. They are used to diagnose app functionality, not advertising tracking.

Turning it on or off. When your iPhone's Region setting is set to the EEA or the UK, diagnostics start switched off - nothing is sent unless you turn them on yourself. With other Region settings they are on by default and you can turn them off at any time. The app uses this Region setting, not your physical location, to choose the initial default. Either way the switch is under Settings › Privacy & Diagnostics › Diagnostics, where the app also explains what a report contains. To be accurate rather than reassuring: with a Region setting outside the EEA/UK the app does not interrupt you with a first-launch notice about this, so a failure can be reported before you have read this page or opened that screen.

Microphone and dictation

The optional voice-input feature runs only while dictation is active, and only after you tap the mic button. Speech is turned into text by Apple's speech recognition, which decides on its own whether to do that on your device or on Apple's servers, under Apple's privacy policy. We never receive, store, or transmit your voice or the recognized text - it goes to the search field you send to your TV.

Ads in earlier versions

From version 2.3, TV Remote shows no ads. Earlier versions show ads in the free version - banners, occasional full-screen interstitials and native ad cards - served by Google AdMob. In those versions the AdMob SDK collects device information such as device identifiers (including the advertising identifier/IDFA only if you allow App Tracking Transparency) and ad-interaction data, under Google's privacy policy. In those versions Google Analytics for Firebase could also use the advertising identifier to measure Google Ads, only when usage analytics were on, your Google consent choices allowed it and iOS tracking permission was authorized. Where required (for example in the EEA/UK) a consent form is shown before any ad is requested, and you can change or withdraw that consent in Settings → Privacy & Diagnostics → Ad Privacy Choices (the row appears where those choices apply). Those versions never start the AdMob SDK for Pro users. Updating to version 2.3 or later removes the AdMob SDK and every ad.

Optional usage analytics

Usage analytics are off by default. If you enable them in Settings, Google Analytics for Firebase receives app-interaction events and an app-instance identifier to help us understand feature use. You can switch analytics off at any time; the app stops collection and resets its local Analytics data. Events skipped while collection is off are not replayed.

From version 2.3 we do not use Firebase to measure or personalize ads: its advertising consent stays denied for everyone, so it does not use the advertising identifier. We do not place IDFA, TV credentials, or TV names in our custom analytics events.

Install measurement (Meta)

When your iPhone's Region setting is outside the EEA and the UK, the app uses the Meta SDK to report to Meta that the app was installed and opened. We use this only to measure how well our own ads on Meta platforms, such as Facebook and Instagram, perform.

What Meta receives. Meta receives device information and app-open and session information, meaning when, and for how long, the app is used (this is the "Product Interaction" entry on the App Store privacy label). It receives the advertising identifier (IDFA) only if you allow tracking after this version of the app has asked you, and never while Pro is unlocked in the app. The app does not send which features you use, which TVs you control, their names or addresses, pairing credentials, or anything you type, and it sends no custom events. The Meta SDK may also fetch its own configuration from Meta and may send crash and diagnostic data about the SDK itself. We keep Meta's Automatic Advanced Matching and codeless event setup turned off, so nothing you type is read or sent. The app itself does not add your IP address to the data it sends; as with any internet connection, Meta sees the address the request comes from.

Where it does not run. When your iPhone's Region setting is in the EEA or the UK, the Meta SDK is not started when the app launches. This applies to the Region setting, not your physical location. Users with Pro unlocked in the app are measured too, without the advertising identifier. If tracking is allowed for the app but you were only ever asked by an earlier version (whose tracking prompt described in-app ads), the Meta SDK is not started.

Your choices. There is no separate switch in Settings. From version 2.3, the app shows the iOS tracking prompt once, normally at first launch, only where the Meta SDK runs (your iPhone's Region setting is outside the EEA and the UK) and only if Pro is not unlocked in the app. The advertising identifier is used only if you allow tracking after this version has asked you - in that prompt or later in iOS Settings › Privacy & Security › Tracking - and never while Pro is unlocked in the app. Choosing Ask App Not to Track prevents its use. You can change this choice at any time in iOS Settings; the app re-reads it when it returns to the foreground. If Pro is not unlocked after you reinstall the app or move to a new iPhone, tap Restore Purchases in Settings. Meta processes the data it receives under Meta's privacy policy.

Purchases

The Pro upgrade is a one-time purchase. Payment is processed entirely by Apple through the App Store - we never see your payment details.

To validate the purchase and restore it across reinstalls, the app uses RevenueCat, a purchase-infrastructure service. What RevenueCat receives: the App Store purchase receipt and a randomly generated anonymous identifier - no name, no email, no account, nothing that identifies you. This is the "Purchase History (not linked to your identity)" entry on the App Store privacy label. It is never used for advertising or tracking.

Children

TV Remote is a general-audience utility that is not directed to children, and we do not knowingly collect personal information from children.

Changes

If this policy ever changes (for example, if a future feature required any data), the new version will be posted at this address with a new effective date before the feature ships.

Contact

Questions? Email [email protected].