Privacy policy

Lynvo operates the website and the link-saving, Extraction, synchronization, and Remote Play features described in this policy. For privacy questions, requests, or complaints, message us privately on Telegram.

This policy does not govern the privacy practices of Source websites, Plugin Servers, Custom Plugin Servers, players, or other third-party services that you choose to use with Lynvo. Those services have their own policies. The Cookie policy describes Lynvo's cookies and browser storage.

Lynvo collects data you provide, data created by your use of Lynvo, and data needed to protect and operate the service. This data includes:

Data you provide or configure:

• Account data: your Google account identifier, email address, profile name, profile picture URL, account creation date, and last-active date
• Settings: player preferences, saved-link retention choice, Plugin Domains, and enabled Custom Plugin Servers
• Credentials you add:Plugin Credentials and Plugin Server API keys

Data created by using Lynvo:

• Saved-link data: URLs, titles, Source details, extracted file and folder metadata, opened markers, and record timestamps
• Optional artwork lookups: when enabled, parsed media titles, years, and episode details are sent to TMDB; returned image paths are kept in memory for the current page and are not added to account records
• Session data: session identifiers, device names, login and activity times, device pairing codes, and short-lived Remote Play commands

Security and diagnostic data:

• Request details, error information, rate-limit records, and Cloudflare security signals

Lynvo uses Google OAuth and OpenID Connect only for account creation and login. It requests the openid, email, and profile authentication scopes. Google returns a verified subject identifier, email address, and optional profile name and picture fields. Lynvo never sees your Google password and does not request access to Gmail, Drive, YouTube, or other Google services. Lynvo doesn't ordinarily store the video files referenced by your links.

Lynvo uses cookies required for login, request security, and your theme choice. Your browser may also store the following items:

• Theme and player preferences
• A local cache of synchronized saved-link records
• Remote Play session and paired-device details

These items support the current browser session, preserve local preferences, or allow Lynvo to resume a feature. The Cookie policy lists the current cookie and browser-storage names. Lynvo doesn't use advertising cookies in the current service. If that changes, Lynvo will update this policy and any required consent controls before the new use begins.

Lynvo uses your data to:

• Authenticate your account and keep sessions active
• Save, organize, extract, and synchronize your links
• Fetch optional title metadata and artwork from TMDB
• Open a playable link in the player you select
• Pair devices and deliver Remote Play commands
• Run Plugins and Custom Plugin Servers you configure
• Enforce storage, rate, and abuse-prevention limits
• Diagnose failures and protect Lynvo from unauthorized use

Where data-protection law requires a lawful basis, Lynvo processes core account data to perform its agreement with you. Lynvo processes security and reliability data for its legitimate interests in operating and protecting Lynvo. Lynvo also processes data when required to comply with law.

Lynvo doesn't sell your personal data. The following providers and recipients may process data when needed for a feature you use:

• Cloudflare: website hosting and delivery through Workers, the D1 database that stores accounts, settings, and saved links, request security, rate limiting, and real-time connections. Cloudflare may process IP addresses, traffic-routing data, system-configuration information, request data, and security signals to deliver and protect those services.
• Google: account sign-in. Lynvo requests only the openid, email, and profile authentication scopes. Google processes the sign-in request and returns the Google account identity fields described in this policy. See Google's Privacy Policy, the Google API Services User Data Policy, and the Google APIs Terms of Service.
• TMDB: when metadata is enabled, Lynvo's Worker sends a title and optional year to the TMDB API for search, then requests details by TMDB title ID. The browser loads TMDB artwork from image.tmdb.org. Lynvo does not send your Google identity or Lynvo session cookie to TMDB. TMDB's API terms of use and Privacy Policy govern TMDB's services.
• Source websites and the Lynvo Plugin Server:the URL and request data needed to inspect or resolve a link
• Custom Plugin Servers you configure:the saved URL, Plugin Server API key, and Extraction request needed to run that Plugin Server
• Just (Video) Player, VLC for Android, MPV, or MX Player:the playable URL and playback intent needed to open the video

The other service's terms and privacy policy govern its processing of the data it receives. Lynvo may also disclose data when law requires it or when necessary to protect the rights, safety, and security of Lynvo or another person. Lynvo does not control how a third party uses data after receiving it.

Provider roles can depend on the processing purpose. Cloudflare acts as a processor when it handles customer content and customer logs to provide services to Lynvo. Cloudflare also acts as a controller when it creates and uses network-level data for its own purposes. See Cloudflare's Privacy Policy.

Lynvo never receives or stores your Google password. Sessions use an opaque HttpOnly cookie, and Lynvo encrypts Plugin Credentials with Advanced Encryption Standard 256-bit Galois/Counter Mode (AES-256-GCM). Lynvo stores Plugin Server API keys with your Plugin Server configuration and sends them to that Plugin Server only when Lynvo makes an authorized request.

Lynvo uses access controls, request validation, rate limiting, and session controls to reduce risk. No online service can guarantee complete security. Review your active sessions in Settings and revoke any you don't recognize.

Saved links use a 30-day retention window by default. You can change the window to 7, 15, or 30 days in Settings. Lynvo checks daily for saved links older than the selected window and deletes them. An account can contain up to 1,000 saved links within 3 MB of account-record storage; each saved link can use up to 256 KB.

When TMDB artwork is enabled, Lynvo resolves artwork on demand for the current page. Returned image paths are held in browser memory for that page and are not stored in account records.

• Processed Remote Play commands expire after five minutes; a cleanup job runs every five minutes
• Device-pairing codes expire after 10 minutes; a cleanup job runs every 10 minutes
• Lynvo permanently deletes an account and its associated data after 90 days (3 months) without recorded account activity
• Lynvo checks for inactive accounts once each day, so deletion may occur shortly after the 90-day threshold

You may not receive a warning before automatic deletion. Log in and use Lynvo before 90 days pass to keep the account active.

Sign-in uses Google OAuth only. Access to your Lynvo account depends on access to the Google account used to create it, so protect that account and manage its security settings with Google. Lynvo cannot restore access when you cannot sign in to that Google account.

You can delete saved links, clear your saved links, revoke other sessions, or permanently delete your account in Settings. Account deletion removes the account, links, Plugin configuration, stored Plugin credentials, Plugin Server configuration, pairing records, and sessions. Deleted data and automatically deleted inactive accounts can't be restored through Lynvo.

Depending on where you live, you may request access to, correction of, deletion of, restriction of, or a copy of your personal data. You may also object to certain processing or complain to your local data-protection authority.

Use the controls in Settings when they cover your request. For another privacy request, message us privately on Telegram. Lynvo may ask for information that verifies you control the account before acting on a request.

Lynvo and its service providers may process data in countries other than the country where you live. Those countries may have different data-protection laws. Cloudflare states that it primarily stores information in the United States and European Economic Area and may transfer or access information globally with appropriate safeguards. Google also processes account identity data when you sign in, under the safeguards described in its privacy policy. TMDB may process API and image requests under its own terms and privacy policy.

Lynvo isn't directed to children under 13. Don't use Lynvo if you're younger than the minimum age required to consent to online services where you live. If you believe a child provided personal data in violation of this section, message us privately on Telegram.

Lynvo may update this policy when the service or its data practices change. Lynvo publishes the updated version and date on this page. Lynvo will provide any additional notice required by law.

The Terms of use explain the agreement for using Lynvo. The Usage policy explains prohibited and restricted uses. The Open-source licenses page lists Lynvo's software licenses and TMDB attribution.