How Recliner keeps your library private
Recliner has two secrets. Your account sign-in proves who you are. Your library passphrase is the only key to your playlists, favorites and history, and it never leaves your devices.
What happens to your passphrase
You type it on a TV, or in this browser on the playlists page. Right there, it is stretched into a key with Argon2id, deliberately slow and memory-hungry, so guessing it takes real time per guess. That key is never stored and never sent. It unlocks a random library key, and it is that library key which seals everything.
What we store
Each playlist, favorite and history entry is sealed separately with XChaCha20-Poly1305 before it leaves the device, padded to a fixed-size bucket so its length says little, and filed under an id derived from your key, not from its name, your email or your provider. We also store your library key, locked under your passphrase. We cannot unlock it.
A paired TV also leaves one sealed library index, so this site can search your playlist: the names, groups and years of its channels, films and shows, and nothing else (no address, login or stream). It is gzipped, sealed under a key of its own derived from your library key, and padded to a whole MiB, so its size to the nearest MiB is the one thing we see. Settings › Privacy on the TV turns it off and deletes our copy.
What we can see
Your email address, or only your username if you made the account without one; for each TV, the name you gave it, what kind of TV it is and when it last synced; how many sealed items your account holds and roughly how big they are; when your TVs sync; and the network addresses they connect from. We cannot see which provider, username or password you use, which channels you have, or what you watched.
Watching
Your TV plays streams straight from your provider. They do not pass through us, so there is nothing of what you watch for us to see.
Adding a TV
The code on a new TV's screen carries a one-time key after the # in its link, and a browser
never sends that part to any server. Your phone seals the library key to it, and only that TV can open
the result.
If you forget the passphrase
Your library is gone. There is no reset and no recovery, by design: a reset would mean we hold a copy of the key, and then we could read your library.
The one thing you still have to trust
All of this holds against us and against anyone who takes our server. It does not hold against a changed app. A web page is code this server delivers each time, so a server that had been tampered with could swap the page for one that keeps your passphrase. That is why the pages that ask for it show the SHA-256 of the exact code they ran. That code is served unminified and builds the same way every time, so anyone can read it, keep its fingerprint, and see if it ever changes. Your TV app does not change without an update.
Anything on this page that is not true is a bug. Tell us. The promises in plain words are on Privacy.