Privacy Policy

Effective date: [Effective Date]

1. Introduction

This Privacy Policy explains how [Legal Entity Name] ("Dubby", "we", "us", or "our") collects, uses, and shares personal information when you create a Dubby account, purchase a subscription or license, or use our optional cloud features. Dubby is a self-hosted media server — an alternative to services like Plex and Jellyfin. You run the Dubby software on your own server; we sell a subscription/license and provide optional cloud features that you may choose to enable.

2. Data we collect

We collect only the data needed to run your account, license, billing, and any optional cloud features you turn on:

• Account data — your email address, display name, password (stored only as an argon2 hash, never in plain text), timezone, and notification preferences.
• Billing data — billing is handled by Stripe. We do not store your card numbers; Stripe stores your payment information. We store a Stripe customer identifier and your subscription status and tier.
• License & activation data — license keys and the server instances activated against your account, including instance identifiers and activation counts. Your subscription is per-account with a per-tier limit on the number of servers.
• AI feature data — when you use Dubby's AI features, we send the relevant text to our AI providers (Anthropic and OpenAI): media metadata (such as titles, years, and catalog details), your natural-language search queries, and — for AI playback troubleshooting — technical diagnostics that can include file paths. Your media files themselves are never sent.
• Optional cloud features (planned — not yet available) — the following are not live today; we will update this policy before we launch them:
  • Roam remote access — connection and signaling metadata used to route remote access to your server. Streams connect directly to your server where possible; where a direct connection isn't possible, the encrypted stream may pass through a Dubby-operated relay, which is designed not to store or inspect its contents.
  • Cloud backup — off-site backup of your non-media data (settings, metadata, and watch history). Your media files are never included.

Movie and TV metadata displayed in Dubby is sourced from TMDB. As noted above, we never access the content of your media files.

3. How we use your data

• To create and manage your account and authenticate you.
• To process subscriptions, licenses, and payments (via Stripe).
• To activate and manage your server instances within your tier's limits.
• To provide the AI features you use and, when available, optional cloud features you enable (such as Roam and cloud backup).
• To send transactional email (account, billing, and security messages) via Resend.
• To send product-update or marketing email — only if you opt in, with one-click unsubscribe in every such message.
• To provide support and to secure, maintain, and improve the service.
• To comply with legal obligations.

4. Legal bases (GDPR)

Where the GDPR applies, we rely on the following legal bases:

• Performance of a contract — to provide your account, subscription, license, and enabled cloud features.
• Legitimate interests — to secure, maintain, and improve the service, and to prevent abuse.
• Consent — for optional marketing email and for optional cloud features you choose to enable. You may withdraw consent at any time.
• Legal obligation — where we must retain or disclose data to comply with the law.

5. Sub-processors & third parties

We share the minimum data necessary with the following sub-processors to operate the service:

• Stripe — billing and payment processing.
• Resend — transactional and opt-in email delivery.
• Anthropic and OpenAI — AI features (media metadata such as titles, your search queries, and playback diagnostics — never your media files).
• TMDB — movie and TV metadata.
• Cloud hosting provider(s) — [Cloud Hosting Provider(s)] for hosting our accounts, licensing, and optional cloud services.

We do not sell your personal information. We do not share it with advertising networks.

6. Cookies

Our account portal uses essential session cookies only (via better-auth) to keep you signed in. We do not use advertising cookies or cross-site tracking.

7. Data retention

We retain account, license, and billing data for as long as your account is active and as needed to provide the service and meet legal, tax, and accounting obligations. When you delete your account (see below), we permanently erase your account data, subject to any records we are legally required to keep.

8. Your rights & how to exercise them

Depending on where you live, you may have rights to access, correct, export, and delete your personal information, and to object to or restrict certain processing. These include rights under the GDPR (for individuals in the EU/EEA/UK) and the CCPA/CPRA (for California residents), including the right not to be discriminated against for exercising your rights.

Self-service account deletion. You can permanently delete your account at any time from your account settings. Deleting your account cancels your Stripe subscription and erases your account data. To exercise any other right, or if you need help, contact us at [Contact Email].

9. International transfers

We and our sub-processors may process your personal information in countries other than the one in which you live, including the United States. Where required, we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses) for these transfers.

10. Children

Dubby is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact us at [Contact Email] and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date above and, where appropriate, notify you. Continued use of the service after an update means you accept the revised policy.

12. Contact

Questions about this policy or your data? Contact [Legal Entity Name] at [Contact Email] or by mail at [Mailing Address]. This service is governed by [Governing Law / Jurisdiction].