Usetopia
Privacy Policy
This policy explains what data Usetopia handles, why, who else receives it and what you can do about it. It covers the Usetopia apps (iPhone, iPad, Mac, Apple TV, Android phones and TVs, Windows and Linux), the account dashboard at account.usetopia.com, the website usetopia.com and Usetopia's add-on service at get.usetopia.com.
In short: Usetopia is a video player. The apps show no ads and contain no analytics or advertising trackers, the website uses only cookieless visit counting, and we do not sell or share your data for advertising. Your synced library and settings are end-to-end encrypted, so we cannot read them. Your Usenet, indexer and media-server accounts and personal API keys stay on your device unless you choose to sync them, end-to-end encrypted. Trakt and Simkl sign-ins stay on your device; Trakt's sign-in passes through our add-on service, which does not keep it.
1. Who we are
Usetopia is developed and operated by MRKZYTSZ ("we", "us"). We are the data controller for the account service, the add-on service and Premium. Contact: support@usetopia.com.
2. Data we process
Your account
- Email address and the one-time codes we email to verify it, to reset your password or to confirm a new address. Codes are stored only as hashes and expire after 15 minutes.
- Sign-in data: your password does not leave your device, except once for an account created before 10 October 2026 (below). The device derives an authentication key from it; we store a hash of that key, your encryption key sealed with your password (and, if you create one, sealed with your recovery key), and the settings needed to derive the key.
- Accounts created before 10 October 2026 had a password hash and synced data that was not end-to-end encrypted. Their one-time encryption update, on a device that is still signed in, sends the password to the account service once, which checks it and replaces the old hash with the new key data; the device then moves the synced data into the encrypted copy and we delete the unencrypted copy.
- Sessions and devices: hashes of session tokens, a random device identifier, the kind of device (for example "Android TV" or "Web browser") and sign-in times, so that you can see and sign out your devices. App sessions last 30 days, browser sessions 12 hours.
Synced data (end-to-end encrypted)
When sync is on, your profiles, library, viewing progress, preferences and add-on choices are encrypted on your device before upload. So are, only for each category you turn on, your Usenet accounts (NNTP provider and Easynews), indexer accounts, media-library connections (Libraryarr), subtitle settings and subtitle-service keys and sign-ins (Subtitlarr), and personal metadata API keys (Catalogarr's TMDB, MDBList and PublicMetaDB keys). We store only ciphertext (for an account created before 10 October 2026, once its update has run), its size and technical counters; we cannot read or use the content. You choose which categories sync, and you can pause sync at any time.
Usetopia Premium
For each account we create a random billing ID. RevenueCat, the App Store or Google Play records your purchases under that ID; they never receive your email address or account ID from us. We store the billing ID and the state of your subscription (active or not, end date, which store, product, whether it renews, the management link) to unlock Premium on all your devices. While Premium is required, the app sends a short-lived signed pass with add-on requests; it contains only an expiry time and a hash of the billing ID. Payment details are handled by the store, never by us.
Premium's free trial
Where the app offers Usetopia's own free trial, a new account may try Premium free once, and each device may start one trial. To check the device, the app on iPhone, iPad, Mac and Apple TV sends a one-time Apple DeviceCheck token, which our server passes to Apple and does not keep. For each device, Apple stores two bits for our developer team, with the month they last changed; we read them and set one to mark that the device has started a trial. We receive no device identifier, and the mark is not linked to your account. The Android app from Google Play sends a Google Play Integrity verdict, which confirms a genuine device and the app as installed from Google Play, and a one-way hash of the Android ID, which is the same for Usetopia on that device until it is reset; the Android ID itself never leaves the device, and we store the hash with the date, without your account. We store the trial's start and end with your account. We never read MAC addresses, IMEI or serial numbers. If your device came from someone else and the app says it has already used the trial, contact us.
Add-on requests
When you use an add-on, the app sends what the add-on needs to get.usetopia.com: searches, the titles and IMDb IDs you open, season and episode numbers, languages and, for Advisarr, the descriptions you type and, if you allow it, the names, years and IMDb IDs of titles in your library. These requests carry no account ID or email. Our servers cache answers by title, not by person, for up to 30 days.
Technical data
Like any internet service, our servers see your IP address and basic request data. We use IP addresses only briefly, to limit request rates and prevent abuse. Our Cloudflare Workers have logging and tracing turned off. The apps send no crash reports or usage analytics of their own (for Google Cast, see section 4). Our websites set no cookies. usetopia.com uses Cloudflare Web Analytics, which counts visits without cookies or fingerprinting and records the page, the referring page, the browser and device type and the country; the account dashboard's security policy blocks it. The main page of usetopia.com loads its interface library from unpkg.com, which sees your IP address.
Data that stays on your device
Usenet provider and indexer accounts, Easynews, media-library connections (WebDAV, SFTP, FTP, SMB, NFS, Plex, Emby, Jellyfin), personal API keys, Trakt and Simkl sign-ins and Advisarr choices are kept in your device's secure storage and are sent only to the service they belong to, directly from your device, with two exceptions: the connection and key categories you choose to sync are also uploaded end-to-end encrypted (see Synced data), and Trakt's sign-in requests pass through get.usetopia.com, which adds Usetopia's Trakt app secret and returns your tokens without storing or logging them. Your other Trakt requests and all Simkl requests go directly from your device.
3. Why we use it (legal bases)
| Purpose | Legal basis |
|---|---|
| Creating and securing your account, sign-in, sync, Premium, account deletion | Performing our contract with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) |
| Rate limits, abuse and fraud prevention (including one free trial per device), security; counting website visits | Our legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Advisarr's AI features, optional sync categories | Your consent, which you can withdraw in the app at any time (GDPR Art. 6(1)(a); KVKK Art. 5(1)) |
| Purchase records the stores keep | Legal obligations (tax and accounting) |
4. Who receives data
- Cloudflare hosts our websites, account service, dashboard, add-on service and email delivery (verification and reset codes), and provides the website's visit counting (Web Analytics).
- RevenueCat manages subscriptions; Apple and Google process payments under their own privacy policies. For the free trial, Apple (DeviceCheck) and Google (Play Integrity) check the device.
- Data sources behind our add-ons receive the title-level requests above from our servers, not your IP address: the Wikimedia Foundation (Wikidata and English Wikipedia) and TVmaze (Defaultarr), OMDb, RatingPosterDB, MDBList and TVmaze (Metadatarr, Catalogarr), Wikidata through QLever (University of Freiburg) or the Wikimedia Foundation and IntroDB (cast pages, film series, skip times), Wyzie Subs and AltyaziDB (Subtitlarr), Trakt (similar titles) and OpenRouter with the AI model provider it routes to (Advisarr, only after you allow it). Advisarr's default model is Google's Gemini, so Google receives these requests through OpenRouter; we ask OpenRouter to use only providers that neither store nor train on them.
- Services you connect yourself receive requests directly from your device under their own terms: your Usenet provider and indexers, Easynews, your media servers, Trakt and Simkl (including what you are watching, if scrobbling is on; Trakt's sign-in requests pass through get.usetopia.com, as above), subtitle sources you turn on (OpenSubtitles, SubDL, SubSource, TheSubtitleDB, SubtitleCat, TurkceAltyazi.org, and AltyaziDB when you add your own key; the apps for iPhone, iPad, Mac and Apple TV do not use SubtitleCat or TurkceAltyazi.org), your own AI service, and TMDB, MDBList or PublicMetaDB with your own keys.
- Servers that host artwork linked from catalogs, search results and title pages see your IP address when the app loads those images. Defaultarr's series posters and backgrounds come from TVmaze (static.tvmaze.com), and the app loads them directly. Titles saved before November 2026 may still link images.metahub.space and m.media-amazon.com, which the apps for iPhone, iPad, Mac and Apple TV do not load. Cast and AirPlay talk to devices on your local network.
- Google Cast: when you cast from a phone or tablet, the Chromecast plays the video with Google's standard media receiver: it gets the title and a temporary address on your local network, and reads the video from your device. Google's Cast software in the app (on Android, part of Google Play services) may send Google a device identifier and diagnostic and interaction data about the Cast session, under Google's privacy policy; on iPhone and iPad the app turns off the Cast SDK's analytics logging. Your provider credentials and the video's original address are never sent to Google Cast.
Some of these providers are outside your country, including in the United States. Where the law requires it, transfers rely on the providers' standard contractual clauses or other safeguards, or on your explicit consent.
5. How long we keep it
- Account, encrypted sync data and Premium state, including the free trial's dates: until you delete your account.
- A device's free-trial mark, which is not linked to your account: we delete the Android ID hash three years after the trial started. Apple keeps the DeviceCheck bits until we change them (or Apple deletes them), and Google keeps Play's device recall under its own rules; we ignore marks older than three years. Until then the device cannot start another trial with a new account.
- Expired sessions are removed daily; used codes within a day and expired codes within two days.
- When you delete your account, we delete it with its cloud data and Premium state at once and ask RevenueCat to delete its record of your billing ID. Stores keep purchase records as their law requires.
- Cached add-on answers (titles, not people): up to 30 days.
6. Your rights
You can see, change and delete your data in the app (Settings → Account & profiles) and at account.usetopia.com, view your synced library in the dashboard, pause sync and withdraw consent for Advisarr. You may also ask us for access, correction, deletion, restriction, portability or object to processing, and complain to a data protection authority (in Türkiye the Personal Data Protection Authority, KVKK; in the EU your local authority). Write to support@usetopia.com; we answer within 30 days. Because your synced data is end-to-end encrypted, we cannot read it to you and cannot recover it if you lose both your password and recovery key.
7. Security
All connections use TLS. Synced data is encrypted on your device; passwords are turned into keys with Argon2id on the device and are not sent to us, apart from the one-time update of an account created before 10 October 2026 (section 2). Credentials on the device are kept in the operating system's secure storage.
8. Children
Accounts are for adults. Children use Usetopia only through child profiles set up by the account holder, who chooses what they can open; child profiles cannot buy Premium or use Trackarr or Advisarr. If you believe a child has created an account, contact us and we will delete it.
9. Changes
We will post changes here and update the date above. Where the law requires it, we will also tell you in the app or by email before changes apply.
10. Contact
MRKZYTSZ · support@usetopia.com