Privacy & Data
Plinthio runs on your own server. Odd Omens doesn't host it, can't see it, and receives nothing from it. There's no account with us, no analytics, no telemetry and no crash reporting.
What Plinthio Stores, and Where
On your server, in the data folder (/config in Docker):
- The database (
plinthio.sqlite): accounts (passwords are stored as bcrypt hashes), roles and settings, reading and watching progress, bookmarks, highlights and notes, ratings, lists, requests, the library catalog, reading and watching activity, sign-in history (including the IP address and browser of each attempt), and the server log. - API keys as SHA-256 hashes, plus an MD5 hash for KOReader. The key itself is only shown once.
- Two-factor secrets, encrypted with a key derived from the server's sign-in secret.
- Covers, profile pictures, caches and backups, and the sign-in secret (
jwt.secret) and HTTPS certificates.
Sign-in history and the server log are kept until removed. Admins can clear the log in Admin → Logs.
Your media files are only read. Plinthio never renames, moves or writes into your media folders.
In your browser: your sign-in token, your account details and your theme are kept in the browser's local storage. Offline downloads are kept in the browser's storage on that device, along with progress made offline until it syncs. Signing in as a different account on the same browser clears what the previous account left there.
What Leaves Your Server
Plinthio only connects out for metadata and the update check:
| Destination | When | What's sent |
|---|---|---|
TMDB (api.themoviedb.org, image.tmdb.org) | Only with a TMDB key. When someone searches or matches movies, shows or anime; when a scan finds a video without artwork; when a title page first opens (cast, crew and facts, cached for 30 days); to refresh world ratings and collections (at most weekly per title); and once after startup for films not yet looked up | The title (and year) being looked up, and your TMDB key |
MangaDex (api.mangadex.org, uploads.mangadex.org) | When someone searches or matches manga metadata, or searches when adding to a list | The search text |
Google Books (www.googleapis.com) and Open Library (openlibrary.org, covers.openlibrary.org, archive.org) | When someone searches or matches book or audiobook metadata, or searches when adding to a list | The search text |
GitHub (api.github.com) | The update check: every 12 hours, and when an admin presses Check now | A plain request for the latest Plinthio release, with Plinthio's version in the request's user agent. Turn it off with UPDATE_CHECK=false |
Cover images chosen from a provider are downloaded once and stored on your server.
From your browser, a few things load directly from outside services:
- Cast photos, backdrops and logos on movie and show pages, and cover previews in metadata and list searches, load from the providers' image servers (such as
image.tmdb.org). - In Chrome and other Chromium browsers, opening a video loads Google's Cast library from
www.gstatic.com, so the Chromecast button can work. - Report a problem (admins) opens a GitHub issue form in a new tab, with the Plinthio version and browser filled in. Nothing is sent unless you submit it.
Optional add-ons connect to their own services only if you turn them on: the Tailscale add-on connects to Tailscale (and Funnel traffic passes through Tailscale's relays, encrypted), and the public-address add-on asks Let's Encrypt for a certificate. See Away From Home.
Permissions
The web app doesn't ask for any device permissions. Installing it to your home screen lets it show audiobook controls on the lock screen and keep downloads for offline use.
Who Can See What
- Each person's progress, bookmarks, highlights and ratings are their own. The community rating shows only an average.
- Admins can see everyone's reading and watching activity and sign-in history in Admin → Activity, and recent outside sign-ins in Admin → Network.
- Content limits, Kids Mode and hidden titles are enforced by the server on every request, including the reading apps.
Exporting and Deleting Your Data
- Export: admins can download a full copy of the database from Admin → Backups. It holds everything listed above except covers, avatars and caches, which live in
/config. There's no per-person export in the app. The API gives each person access to their own progress, bookmarks, highlights and ratings. - Delete an account: an admin deletes it in Admin → Users → Edit. This removes the account with its progress, bookmarks, ratings, lists, activity and API keys. Its entries in the sign-in history stay. Admins can't delete their own account.
- Delete everything: stop Plinthio and delete its data folder (
./config). Your media files aren't touched. Also delete any copies in a second backup place. - On a device: remove downloads from the Downloads page, or sign out and clear the site's data in your browser.