Your media stays yours.

Information we handle

• Player account and devices: Odyssey automatically creates a player account and management code so your setup can be restored on another supported device. We retain an account identifier, authentication and security records, profile configuration, management-code records, and connected-device identifiers. An email address is not required for a player account.
• Programme notifications: If you enable out-of-app reminders, Odyssey stores an encrypted Apple push token bound to the admitted profile, device, and exact reminder set. It is used only to deliver your requested programme reminders, never for advertising or tracking, and is removed when you unregister, disconnect the device, change relevant profile or source access, delete the profile or account, or Apple rejects the token.
• Source configuration: provider names, addresses, usernames, access credentials, source availability, and profile access choices that you choose to save. Source secrets stored by Odyssey are encrypted at rest and are returned only to an authenticated device or account session.
• Viewing and library state: title and episode identifiers, limited title metadata, favourites, watchlist, watched or unwatched state, playback and resume positions, ratings, content feedback, source choices, and scheduled television actions. This state is separated by profile and used to reproduce the same viewing setup on devices connected with the same management code.
• Search and preferences: recent search terms, hidden categories, playback, audio, subtitle, guide and parental-control preferences, and other profile settings needed to restore the player experience. Odyssey stores a salted verifier for a configured PIN, not the readable PIN. A PIN may also be kept in the Apple TV Keychain after successful setup or verification so an authorised viewer can unlock while offline.
• Recommendation preferences: Odyssey uses ratings, watched activity, selections and feedback to create movie and series recommendations for that profile. If you connect Trakt, Odyssey stores encrypted Trakt authorization tokens and synchronises watched titles, ratings and supported playback progress until you disconnect it. Trakt ZIP, Letterboxd CSV, or generic history files you choose to import are processed into profile state; the uploaded archive itself is not retained. You can disconnect Trakt, reset recommendation learning, and control outside-library discovery in web management.
• Purchase status: verified App Store entitlement status. Apple processes payment details; Odyssey does not receive your full payment-card information.
• Optional diagnostics: only after you opt in, the app may send an installation identifier, app version, Apple TV model, tvOS version, timestamps, feature and error events, network host, and redacted technical messages. Provider passwords, tokens, full playlist URLs, and stream credentials are filtered from diagnostic submissions.

How information is used

We use information to operate the player account, restore and synchronise profiles and sources, maintain library and viewing state, personalise recommendations, verify access, protect profiles, process scheduled actions, diagnose failures when you consent, prevent abuse, secure the service, and respond to support requests. We do not sell personal information or use customer playlists for advertising.

Your choices

Every installation receives a player account and management code, but an email address is optional. You choose whether to enter that code on another device or sign in to web management. Remote diagnostics are optional and remain off until selected during setup. You can withdraw diagnostic consent at any time in Odyssey Settings; doing so stops future uploads and removes queued diagnostic events from the device. Account and data controls are available through web management using your management code.

Sharing and processors

Information may be processed by hosting, security, email, and infrastructure providers acting for Odyssey, or disclosed when legally required. Apple independently processes App Store purchases under Apple's privacy terms. Third-party media providers you connect operate under their own terms and privacy policies.

Storage, security, and retention

Odyssey uses access controls, encryption for saved source secrets, salted PIN verification, transport security on Odyssey services, profile separation, and data minimisation. A management code is a sensitive account credential and should be protected like a password; it can be rotated through web management if exposed. Account and synchronised player state are retained while the account is active. Dormant, unused automatically created accounts may be removed after the inactivity period stated in the service at that time. Optional diagnostic records are retained only as reasonably necessary to investigate reliability and security. Deletion removes the account and associated synchronised state, subject to limited records that must be retained by law or for fraud prevention and protected backup rotation.

Children

Child profiles are household viewing controls managed by an adult. Odyssey is not directed to children and does not knowingly invite children to create accounts. Profile restrictions, hidden categories, and lock status synchronise so a protected profile does not silently become less restricted on another device. Odyssey retains only a salted PIN verifier on its servers; a protected profile fails closed when a new device cannot verify the PIN. Recommendation preferences for a child profile are filtered and controlled by the account holder through web management.

International access and changes

Service providers may process information in countries other than your own, with appropriate safeguards where required. Material policy changes will be posted here with a revised effective date.