TVcloud privacy policy

TVcloud is an app for Android TV and Google TV published by CLAPPS (contact: ralf@clapps.be). It plays the films, videos and photos you keep in OneDrive, Dropbox and Google Drive on your TV. Last updated: October 20, 2026.

What TVcloud accesses

• OneDrive: read access to your files and to the files shared with you (Microsoft permission Files.Read), staying signed in (offline_access), and your name and account (openid, profile) to tell your accounts apart on the TV.
• Dropbox: read access to your files and their details (files.metadata.read, files.content.read), including the shared folders in your Dropbox, and your account's name (account_info.read), to tell your accounts apart on the TV.
• Google Drive, two ways that you choose. Folders you share with your household's TVcloud address: when you add Google Drive on a TV, TVcloud creates for your Google account a robot address of its own (a Google service account, "tvr-…@tvcloud-robots.iam.gserviceaccount.com"). TVcloud can read the folders you share with that address, as viewer, and only them, for as long as you share them. Files you send from your phone with Google's picker (Google scope drive.file), which Google describes as seeing, editing, creating and deleting those specific files; TVcloud only reads them. To give your household its robot, TVcloud also reads your Google account's identifier (openid), and your e-mail address (email) to show on the TV which Google account is signed in; our server does not store the e-mail address. If you use “Open with TVcloud” in Google Drive, Google also asks for the drive.install permission, which only lets TVcloud appear in Drive's “Open with” menu and gives no access to files. TVcloud cannot see the rest of your Drive.

TVcloud never uploads, changes, moves or deletes anything in your clouds.

Where your data goes

• TVcloud shows only the folders you add to its library, never a whole account. The names of the files in those folders and their details (size, date, duration when the cloud gives it) are read by the TV directly from your cloud and kept in an index in the app's storage on that TV, to show your rows and folders. TVcloud does not read the content of your files to build this index.
• Videos and photos go straight from your cloud to your TV while you watch them. Parts of them may be kept for a short time in a cache on the TV, which you can empty in the settings.
• Signing in with the QR code goes through our server (Google Firebase): the TV first opens a sign-in session there, which only that TV can read, for 10 minutes. For OneDrive and Dropbox, the one-time code you get on your phone reaches your TV through that session, and the TV exchanges it itself. For Google Drive, our server exchanges the code, because Google requires a secret that must not be in the app, and puts the tokens and the identifiers of the files you chose in that session. The TV reads its session once and deletes it; a session that no TV reads is deleted within half an hour. After that, our server keeps no copy of your tokens. When the access token expires, the TV asks our server for a new one. Our server never reads your files and keeps no list of them: it keeps only a fingerprint (a one-way hash) of each Google refresh token, so that it can be used by the TV it was given to and by no other.
• So that every TV of your home shows the same library, our server (Google Firebase) keeps, for each cloud account: the folders you added (their names, identifiers and place in the account) and, for a Google account, which robot address is its own. Each TV gets an anonymous identity on our server, with the list of cloud accounts signed in on it, recorded as the identifiers the clouds give, not as names or e-mail addresses. When a TV signs in to a cloud, it sends our server a fresh access token once, which our server only uses to ask the cloud whose account it is, and does not keep.
• For the folders shared with your robot, our server gives the TVs signed in to that Google account one-hour, read-only tokens of that robot; the videos then go straight from Google to the TV. To get one, the TV shows our server its current Google access token, which our server checks with Google and does not keep: without a valid Google sign-in on that TV, no robot token.
• The first video plays free once per cloud account. When it starts, our server keeps, under that account's identifier, a fingerprint (a one-way hash) of the video and the date, so that the free video is offered only once; it keeps neither the video's name nor its identifier.
• Our server keeps daily totals without any personal data: how many sign-ins and files chosen, and how many TVs added their first folder, opened their first video, saw the Premium offers, started a free trial or bought the lifetime unlock. A TV sends each of those steps once, with nothing that identifies the TV or you.
• TVcloud Premium is bought through Google Play, which handles the payment: we never see your payment details. To know whether Premium is active, the app uses RevenueCat (revenuecat.com), which receives the Google Play purchase receipts of the TV's Play account and an anonymous identifier made up by the app, never your files or your cloud accounts.
• Crash reports (Firebase Crashlytics, which also counts app sessions to measure stability) contain technical information about the TV and the error, never the names or content of your files. TVcloud contains no advertising and no analytics SDK. The other services the app talks to are Google Play (purchases and the in-app review card) and RevenueCat, described above.

How your data is protected

• Encryption in transit: every connection the app and our server make uses HTTPS (TLS). The app does not allow unencrypted connections.
• Encryption at rest: the tokens of your accounts are encrypted on the TV with AES-256-GCM, using a key kept in the Android Keystore of that TV, which cannot be copied off the device.
• Isolation on the TV: the index of your files and the cache are kept in TVcloud's private storage, which Android keeps out of reach of other apps. TVcloud turns off Android backups, so this data is not copied to backups or other devices.
• Least privilege: TVcloud only asks for read access. Each household has its own robot address: its tokens open only the folders that household shared with it, never another household's, and only for an hour. The robots live in a Google Cloud project of their own, where our server can create them and get their tokens, and nothing else.
• Sign-in hand-off: a sign-in session can be read only by the TV that opened it, with its own identity on our server, and only for 10 minutes. It is deleted as soon as that TV has read it, and in any case within half an hour. The code shown in the QR code is of no use to anyone else.
• Our server: the Google client secret is kept in Google Cloud Secret Manager. A refresh token sent by the TV to get a new access token is used for that request only and is never stored or written to logs; our server refuses it when it comes from another TV than the one it was given to. Tokens of your household's robot address are given only to the TVs signed in to your Google account, and only while your own Google sign-in on that TV is still valid. Access to the server and its Google Cloud project is limited to CLAPPS.
• Revocation: signing out of an account on a TV deletes its tokens from that TV, revokes them at Dropbox, and takes the account off that TV on our server; the other TVs of your home stay signed in. To cut every TV off at once, remove TVcloud from the apps that can access your account: in your Google Account (Security, Third-party apps with account access), which also stops the robot within the hour, in your Dropbox account (Settings, Connected apps) or in your Microsoft account (account.live.com/consent/Manage).

Limited use

TVcloud's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Your files and their names are used only to show and play them on your TV. They are not sold, not used for advertising, not used to train AI models, and not shared with anyone.

Deleting your data

• On a TV, taking a folder out of the library takes it out on every TV of your home and on our server. Signing out of an account erases its tokens and the index of its files from that TV and takes the account off that TV on our server. Uninstalling TVcloud erases everything it stored on the TV.
• To take a Google Drive folder away from TVcloud, stop sharing it with your robot address in Google Drive.
• Your household's TVcloud address for Google Drive is deleted after six months without use, that is when no TV of your household asked for a token of that address for six months; the folders shared with it are then no longer readable by TVcloud. If you come back, the TV gives you a new address to share your folders with.
• From any device, you can also remove TVcloud's access in your Google Account (Security, Third-party apps with account access), your Dropbox account (Settings, Connected apps) or your Microsoft account (account.live.com/consent/Manage).
• Crash reports are deleted by Firebase Crashlytics after 90 days.
• The Premium status belongs to the TV's Google Play account, not to your cloud accounts, so it stays after signing out. RevenueCat keeps the Google Play purchase receipts, with the anonymous identifier, as long as they are needed to check the purchase.
• To have us delete those receipts or anything else, write to ralf@clapps.be with "TVcloud data deletion" as the subject. We reply within one month.

Your rights

CLAPPS, in Belgium, is the controller of the data described here (contact: ralf@clapps.be). Under the EU General Data Protection Regulation you can ask to access, correct or delete your data, to restrict or object to its use, and to receive it in a portable form, by writing to ralf@clapps.be; we reply within one month. You can also complain to the Belgian Data Protection Authority (Autorité de protection des données, www.dataprotectionauthority.be) or to the authority of your country.

Children

TVcloud is not intended for children under 13 (under 16 in the European Union), and we do not knowingly collect data from them.