Square Eyes

Lash Developments

Privacy Policy

Last updated 8 October 2026

Square Eyes has no backend. There is no account to create with us, no server of ours for the app to contact, and no record anywhere of what you watch.

What we collect

Nothing. Lash Developments operates no servers that Square Eyes contacts and receives no information about you, your devices, or your viewing. There is no advertising, no advertising identifier, and no analytics of our own.

What is stored on your device

To sign you in and to make the app fast, the following is kept on the device, and only there:

• The address of each Jellyfin server you sign in to, your username, and the access token the server issues. Your password is sent only to your own server to obtain that token and is not stored.
• Which profile is selected, and your in-app preferences.
• A cached copy of your library's catalogue — titles, genres, cast and catalogue ids, and what has been watched — used to work out suggestions on the device. It is refreshed weekly from your own server.
• The last home screen shown, so the next launch can draw it straight away.
• Recommendation lists (catalogue ids only) and the public chart lists described below.
• Crash reports and a connection log, shown to you in Settings so problems can be diagnosed. They are never sent anywhere by the app.

Uninstalling Square Eyes removes all of it.

Who the app communicates with

• Your Jellyfin server, for your library, artwork, playback and watch state. Like every Jellyfin app, Square Eyes identifies itself to your server with a device name and a device identifier (on Android, the app-specific Android ID), so the server can list your signed-in devices, resume playback and offer remote control. It goes only to your server, never to us. If your server address is plain http, this traffic is not encrypted; use https to protect it.
• Your Seerr server, if you configure one, for browsing, requests, and “people who watched this also watched” lists for titles in your library. Seerr retrieves these from The Movie Database (TMDB) on your behalf.
• MDBList (mdblist.com), to download public chart lists such as “Trending this week”. The request contains nothing about you or your library.
• TMDB’s image service (image.tmdb.org), for streaming-service and studio logos. Again, nothing about you or your library is sent.
• Your local network: the app broadcasts a standard Jellyfin discovery message (UDP port 7359) to find your server without you typing its address. This never leaves your network.

Like any web request, contacting MDBList or TMDB reveals your device’s IP address to that service. Your Jellyfin and Seerr servers are operated by you, or by whoever gave you access to theirs, and how they handle information is governed by them, not by us.

On iPhone and iPad

The iPhone and iPad app works the same way, with a few differences. Access tokens and any Seerr session are kept in the Keychain, marked to stay on that device and never move to another through a backup. iOS asks once for permission to reach devices on your local network, which is used to talk to a Jellyfin server at home and to find Chromecasts. Films and episodes you download are stored only on the device, along with how far you got, which is sent to your own server when you are next online. The Google Cast section below applies to the iPhone app too; on iPhone, Google describes what its SDK collects as coarse location, a device identifier, performance data and, when the Cast controls are used, product interaction — for analytics and to make casting work, not linked to you and not used for tracking. That is what the App Store privacy label lists.

Google Cast

On Android phones, iPhone and iPad, Square Eyes includes Google’s Cast SDK so you can play to a Chromecast or Google TV. Google states that the SDK collects casting activity (device discovery and cast session events) and basic device and app information to improve casting, that this is encrypted in transit and not shared with third parties, and that it cannot be switched off by the app. Lash Developments receives none of it. See Google’s Cast SDK disclosure and the Google Privacy Policy.

Permissions

The app requests network access (and, on iPhone, local network access). The Google Cast library also declares permission to show a notification while casting. Square Eyes does not request contacts, location, camera, microphone, photos or file access.

Children

Square Eyes is not directed at children and collects no information from anyone. Any parental restrictions you see in the app are enforced by your Jellyfin server, using the limits set on each user account there.

Third parties

We do not share, sell or transfer information, because we do not hold any. There are no advertising libraries in the app; the only third-party library that collects data is the Google Cast SDK described above.

Changes to this policy

If a release changes anything on this page, the page is updated with a new date before that release ships, and the Google Play data safety listing and App Store privacy label are updated alongside it.

Contact

Questions about this policy, or about Square Eyes generally: squareeyes@lashdevs.com

This product uses the TMDB API but is not endorsed or certified by TMDB. Chart data from MDBList.