Your music, your network, your data.

01 Who we are

Serento is published by Dusty Enterprise SRL, registered in Bucharest, Romania. For the purposes of EU data protection law (GDPR), Dusty Enterprise SRL is the data controller for any information Serento processes about you. You can reach us at contact@serento.app for any privacy question or request - see Section 11 for your statutory rights.

02 What Serento is - and what it isn't

Serento is a UPnP / OpenHome control application. It runs on your iPhone, iPad or Mac, finds your music servers and renderers on your local network, asks them for the catalogue, and tells the renderer what to play. The audio bytes flow directly from your server (or the radio station you tuned to) to the renderer - they never pass through Serento or any infrastructure we operate.

• No accounts. There is no sign-up screen, no email address, no password, no "login with Apple / Google". Our entitlement service keeps exactly one row per Apple ID: a one-way key, when the trial started, when we last heard from that key, plus internal bookkeeping fields. That row carries no name, no email address, no purchase record and nothing about what you play. It is an anti-abuse anchor, not a user account.
• No centralised catalogue. We don't have a copy of your library. We don't index your music. We don't recommend tracks. Browse and Search read from your own UPnP servers in real time.
• No third-party tracking SDKs. We don't ship analytics SDKs (no Firebase, no Google Analytics, no Mixpanel, no Amplitude, no PostHog). We don't ship attribution SDKs (no AppsFlyer, no Branch, no Adjust). We don't ship ad SDKs or social-network SDKs. We do, however, collect our own first-party telemetry, stored under the key described in Section 02a below.
• No tracking of you. Our telemetry backend never logs your IP address, your library contents (no track / album / artist names, no file paths), your play history, or your search queries. Apart from the record of your first two hours described in Section 02a, it receives counts and percentages only, stored under your account key. We do not track you across other companies' apps or websites, and we never sell or share this data.

02a Pseudonymous telemetry (what we DO collect)

To understand which devices and OS versions are in use, which renderers people pair with, and - above all - how complete people's music metadata is across the field (so we can decide whether to build better metadata tools), the app sends us a small report. It contains no name, email or Apple ID, and the key is one-way, so it does not reveal who you are or the contents of your library. It is a condition of using Serento, disclosed here and in the Terms; there is no per-user opt-out. Specifically:

• Your account key. A one-way hash of your iCloud account identifier, computed on your device. It is not your Apple ID, not your name, not your email, and we cannot reverse it. It is the same key your free trial and subscription are stored under, so we can see that one person's reports belong together. It is stable: reinstalling does not change it, and it is the same on every device you are signed in to.
• A device identifier. A random identifier this app generated for itself and keeps in the keychain, so your iPad's reports can be told apart from your Mac's. It is not a hardware id and not an Apple identifier.
• Coarse device facts + app usage. Platform (iPhone / iPad / Mac), device model identifier, OS name + version, app version + build, total / available memory, your 2-letter region (from your device locale - never from your IP, which we never store), and how long the app was used (session durations, in seconds).
• The renderer you are playing to. Only the player you are currently connected to, and exactly six things about it: a one-way hash of its UDN, so we can recognise the same unit across reports without ever holding the UDN itself; its name; its model; and whether it supports DLNA, OpenHome and software volume control. The name is the one the device announces about itself, so if you have renamed it, the name you chose is what we receive. When you play to your own device instead of a network player, that is reported the same way, as "This iPhone", "This iPad" or "This Mac" together with your device model.
• Library composition - counts only. How many tracks / albums / artists your servers hold, how many files are DSD vs PCM, the breakdown by format (FLAC, ALAC, DSD, MP3, …) and resolution, and - the part we care about most - what percentage of your tracks have each tag field (title, artist, album, genre, year, …) filled in. Counts and percentages, never the names or contents of your music.
• Your first two hours. For two hours after you accept the Terms of Service on a device, the app also records how you find your way around it: which screens you open and when, where on the screen you tap or click (a position within the window, and the window's size, never what was under your finger and never anything you type), when the app comes to the front or goes to the background, and whether the first steps work: choosing a server or an output, a library sync starting, finishing, failing or being cancelled, playback starting or failing, and a purchase being started and how it ended (completed, cancelled, awaiting approval or failed). It never includes the names of your music, servers or players. Before you accept, nothing is recorded. Recording stops after those two hours and does not start again unless you reinstall the app or reset its data; after them, the app notes at most one thing, that you came back. Once everything has reached us, the app deletes its copy. It tells us where new users get stuck.

We cannot reconstruct your library from this, and the key is one-way, so it does not tell us who you are: no name, no email, no Apple ID. We never sell it. We delete raw reports, including the record of your first two hours, after 13 months.

02b Serento for Apple TV

This section is the privacy policy of the Serento app on Apple TV, which the app also shows under Settings → Privacy Policy. Sections 10, 11, 15 and 16 (children, your rights, changes, contact) apply to both apps; the other sections cover Serento for iPhone, iPad and Mac.

What the Apple TV app is

Serento on Apple TV is a remote control and a screen for the music that plays on a renderer in your home. It shows what is playing and sends your presses (play, pause, next, previous, seek, moving the music to another output and the like) to Serento on the iPhone, iPad or Mac that plays the music on the same network or, when there is none, straight to the renderer. It holds no music library, plays no audio itself, and has no account, no sign-in and no purchase.

What we do not collect

• Nothing reaches us. The Apple TV app does not connect to serento.app or to any other server we operate, so we receive nothing from it: no account key, no device identifier, no telemetry, no usage data, no IP address.
• No account and no iCloud. There is nothing to sign up or sign in to, and the app does not read or write your iCloud data.
• No third-party SDKs. No analytics, advertising, attribution or social-network code.
• No listening history. What plays is shown, never recorded.
• No location, contacts, microphone, camera or photos. The app asks for none of them.

What happens on your home network

• Discovery. The app looks for renderers on your local network with UPnP (SSDP), and for Serento on your other devices with Bonjour.
• Serento on your other devices. The app connects to Serento on an iPhone, iPad or Mac on the same network, over an encrypted connection. It receives what that device plays (title, artist, album, cover, position, format and the names of its outputs) and sends your presses back. Any device with Serento on the same network can take part, whichever Apple ID it uses. Some presses ask that device to act in its own app, for example to add a track to your favorites or to show lyrics; what that device then does is covered by the rest of this policy.
• Renderers. When no Serento device plays the music, the app asks the renderer itself what it plays and sends your presses to it.
• Covers. A cover comes from the Serento device that plays the music. Without one, the app loads it from the address the renderer gives for it, usually your music server; for an internet radio station, that address can belong to the broadcaster, which then sees your Apple TV's IP address.
• A random identifier. The app creates a random identifier and keeps it in the Apple TV's keychain, so that your Serento devices can tell this Apple TV apart from other devices. It is not linked to you or to your Apple ID.

What stays on the Apple TV

• The language you chose for the app and the output you chose last, in the app's local settings.
• The random identifier described above.
• Covers already shown, kept in memory only and never written to storage.
• A diagnostic log of connections and playback events, in the app's cache, which the system may clear. The Apple TV app has no way to send it and never does.

Deleting the app removes its settings and its log. The random identifier can stay in the Apple TV's keychain; it is not linked to you.

Crash reports

If the app crashes, the report is handled by Apple's built-in system; we ship no third-party crash SDK. If you allow your Apple TV to share analytics with app developers, we receive an anonymised crash report through App Store Connect, with no personal data. Otherwise we receive nothing.

Third parties

• Apple Inc.: App Store distribution and crash reports. apple.com/legal/privacy
• Your renderer, your music server and internet radio broadcasters: the app talks to them directly, as described above, and their own terms apply.

No other third party is involved.

02c Visiting serento.app

This section is about this website only, not about the apps. When you open a page of serento.app, the site counts the visit itself, on our own server, with no third-party analytics, no advertising and no profile of you. For each page shown it records:

• The page. Its address without anything after a "?", and its language.
• Where you came from. The site and page whose link brought you here, again without anything after a "?" (most sites send only their name), and a campaign label the link itself carries (utm_source or ref).
• Your country, roughly. Worked out from your browser's time zone, never from your IP address.
• A language you pick. When you choose one in the site's language menu, which one.

How visitors are counted without knowing who you are. To tell one visitor from another within a day, your IP address and your browser's identification (its user agent) are combined with a random key that changes every day, into a one-way code. Neither the IP address nor the user agent is stored, and each day's key is deleted once the day is over, so the codes cannot be linked from one day to the next and cannot be traced back to you. No cookie is used for this. Apart from a technical cookie that protects the contact form against forged submissions, the only cookies the site sets hold two choices you make: your language and your theme. Visits from software that says it is a bot, from automated browsers, and our own visits are not counted.

How long. These records are kept for 13 months at most, then deleted automatically.

Why, and your choice. We count visits in our legitimate interest in knowing how the site is used and what brings people to it (Art. 6(1)(f) GDPR). You can object at any time (Art. 21); the simplest way is to keep JavaScript off or use a content blocker, and then nothing is sent. Because these records cannot be linked to you, we cannot pick out yours on request (Art. 11); they are deleted after 13 months at the latest in any case.

03 What stays on your device

The following is created and stored locally on your iPhone, iPad or Mac. None of it leaves the device unless explicitly noted in Section 02a (telemetry), Section 04 (iCloud sync), Section 05 (your local network) or Section 06 (diagnostic logs you choose to send):

• Library cache. When you connect a UPnP server (MinimServer, Plex, Twonky, Asset, JRiver, etc.) we fetch album / artist / track names, durations, codecs, sample rates, file paths, and artwork. Those are written to a SwiftData store that lives in the app's sandbox. They are read only by Serento on the device, only when the app is running.
• App preferences. Theme, default queue method, gapless playback flag, silent-network delay, alphabetical-index-bar toggle, volume-control toggle, album-version-grouping configuration, last-selected renderer / server / library / tab. Stored in UserDefaults.
• Discovery cache. The UPnP servers and renderers Serento has seen on your local network - IP addresses, friendly names, UDNs, supported services. Used to surface them in the picker without re-running a full SSDP sweep on every launch. Cleared if you delete the app.
• Recent searches. The last few queries you typed in the Search tab, shown in its "Recent" section. They also sync to your other devices (Section 04). The Clear button in Search removes them on every device.
• Plex authentication tokens. If you sign in with a Plex account, the Plex API returns an access token. Serento stores it in the Keychain (protected by your device passcode / Face ID / Touch ID). Tokens are read only by Serento; they are never sent to Dusty Enterprise SRL.
• Diagnostic log file. A rolling log of UPnP discovery, playback transitions, renderer responses, and error conditions. Stored in the app's sandbox. Never transmitted unless YOU tap "Send Logs to Developer" in Settings (see Section 06).
• Keychain values that survive deleting the app. A small number of values live in the Keychain and are deliberately not removed when you delete Serento: the device identifier described in Section 02a, which keeps each device's settings separate and is also the identifier sent with the telemetry so your devices can be told apart, and a timestamp used to bound offline access so that reinstalling the app cannot restart the free trial.

04 What syncs across your own devices via Apple iCloud

Serento uses Apple's CloudKit to keep the following data in sync across the Apple devices signed into the same Apple ID. The data lives in YOUR private iCloud container - Apple's documentation guarantees that even Apple staff cannot read it; Dusty Enterprise SRL has no server-side access to it either (we write and read it only from the device, never from a backend). What syncs:

• Favorites. Tracks, albums, artists, and radio stations you've favourited.
• Playlists. Names and track lists for the playlists you create in Serento.
• Tags & bookmarks. Tags you create and the items you've tagged; bookmarks you save.
• Listen Later list. Items you add to Listen Later.
• Custom radio stations. Stations you add (name + stream URL + codec hint).
• Album & track ratings. The 1–5 stars you assign.
• Track notes. The free-text notes you write on individual tracks.
• Pinned decades. The decades you pin to the top of a genre.
• Listening history. Each track or radio station you played and when: what it was, its format, how long you listened and the output it played on. History and your listening statistics are built from it. Settings → Statistics → Delete Statistics removes it on every device.
• Recent searches. The searches listed under Recent in Search.
• My Mixes. The mixes Serento makes for you, with the name of the device that made them.
• Album versions. The version of an album you choose as the main one, and the albums you group as versions of one album.
• Album corrections. What Identify Album found for an album and the corrections you apply to it: the MusicBrainz release, title, artist, year, genre, cover address and track titles, with the album's folder on your server so that the correction finds the album again after a sync.
• Radio settings. Your changes to the built-in stations (name, stream address, logo, genre), the stations you hide, and whether Serento Radio is on.
• Renderer settings. For each renderer you play to, under its network identifier (UDN): the volume limit you set, the DSD rate it refused, how a radio station has to be sent to it, and which entries in its playlist your devices added (entry numbers, a one-way hash of each file's path, and which of your devices added them).
• Deletion records. When you remove a favorite, a playlist, a tag or a note, a small record of the removal syncs too, so it disappears from your other devices.
• Per-device app settings. Each device keeps its own settings row, so an iPhone and a Mac can be configured differently. Stored in your private container under the device identifier described in Section 02a.

05 Network traffic Serento generates

Every connection Serento makes from your device. Nothing else.

• Your local network - UPnP discovery. SSDP multicast probes (UDP 1900) to find UPnP servers and renderers. Plex's GDM (UDP unicast) to find Plex Media Servers. Bonjour mDNS for Plex on networks that publish it. All confined to your LAN.
• Your local network - control. HTTP / SOAP requests to your UPnP servers (ContentDirectory) and renderers (AVTransport, OpenHome Playlist / Product / Volume / Info, RenderingControl). Used to browse the library and drive playback.
• Your local network - audio stream. When you press Play, Serento tells the renderer the stream URL of the chosen track. The renderer fetches the audio from your server directly. Bytes do not pass through Serento or any infrastructure we operate.
• Your local network - other Serento devices. Serento finds the other devices running Serento on your network with Bonjour and connects to them directly, over an encrypted connection, so that each of them can show and control what plays. The device that plays shares its queue (for each track the title, artist, album, duration, its address on your music server and the server's identifier), the current track and position, play and pause, shuffle and repeat, the radio station and the songs it played recently, the lyrics, whether the track is in your favorites, what Serento Radio is doing, small cover images, the audio format, the output it plays on and the names you gave your outputs, and a random identifier of the device. Any device running Serento on the same network can join, whichever Apple ID it uses, including Serento for Apple TV. None of this goes through the internet or reaches us.
• Your local network - your own devices. Your devices signed in to the same Apple ID also send each other changes to much of the data in Section 04 (favorites, playlists, listening history, recent searches, tags, ratings, notes and more) directly, over a separate encrypted connection whose key is kept in your iCloud Keychain, so that a change appears on your other devices before iCloud delivers it. A device on another Apple ID cannot join it. The same connection carries a signal that asks your other devices to check your subscription again.
• Apple iCloud / CloudKit. Sync traffic for the data listed in Section 04. Goes to Apple's servers under your Apple ID - Apple's privacy policy governs this leg of the trip.
• Apple App Store / StoreKit. For purchases, restore-purchases, and the signed receipt Apple issues. Purchases are verified on the device against Apple's signature and are never sent to us. Handled by Apple's StoreKit framework; Apple's privacy policy applies. Each purchase also carries an app account token: a UUID derived from the same one-way account key, so that when Apple tells us months later that a subscription renewed or a refund was granted, we can match that notice to the right account. Apple receives and stores that value. It is still one-way and it is still not your Apple ID.
• Serento entitlement service. When the app starts, it asks our own server whether your free trial is still running. It sends an account key and your app version, and nothing else. The account key is a one-way hash of your iCloud account identifier - the same value the telemetry already uses - and it cannot be turned back into an Apple ID. The server keeps the date your trial started, and the date it last heard from your key, so that reinstalling the app cannot restart the trial. It is never told what you have bought, and we never receive your name, your email address, your Apple ID or any payment detail.
• plex.tv (Plex users only). If you sign in with Plex, Serento talks to plex.tv to authenticate and look up your accessible Plex servers. Plex Inc.'s privacy policy applies to that leg. If you don't use Plex, no plex.tv traffic happens.
• Internet radio streams. When you play a station, your device fetches the audio directly from the broadcaster's URL. We have no visibility into what you play. The broadcaster sees your IP.
• serento.app. Three things. The telemetry described in Section 02a, which carries your account key and your device identifier. Metadata lookups: to fill in an album's year, credits, lyrics, classical works or an artist's biography, the app asks our own copy of the public music databases, sending only the artist, album, track or composer name it needs an answer for. Those lookups carry no account key, no device identifier and no account of any kind - unlike the trial check described above, which does carry your account key. The lookups that send a name travel in the request body rather than in the address, so they are not written into any server or proxy log along the way; the ones that send only a public release identifier use the address, because that identifier is not yours. We neither store them nor build any profile from them. And one hosted image, the Plex logo shown beside a Plex server in the picker. No IP address is stored on our side.
• Resend (only when you tap "Send Logs"). When you explicitly tap "Send Logs to Developer" in Settings, the diagnostic log file is delivered to contact@serento.app via Resend's transactional email API. See Section 06.
• Wikipedia. For artist and album biographies, the app queries the Wikipedia of your app language, falling back to the English one. It sends the artist or album name it is looking up. The Wikimedia Foundation sees your IP and applies its own privacy policy.
• Wikidata. Used to turn an identifier into the right Wikipedia article title before the request above. Sends only that identifier, never a name you typed. Also operated by the Wikimedia Foundation.
• Last.fm. For an artist's popular tracks. Sends the artist name. Last.fm (CBS Interactive) sees your IP and applies its own privacy policy.
• Deezer. For artist photos and genre images, when you run the image downloads in Settings. Sends the artist or album name being searched, and fetches the picture from Deezer's image CDN. Deezer sees your IP and applies its own privacy policy.
• Cover Art Archive. For an album cover when you use Identify Album. Sends the release identifier the identification resolved to, never a name. Operated by MetaBrainz alongside MusicBrainz.

06 Diagnostic logs (you choose when)

The diagnostic log helps us reproduce playback issues, discovery failures, and renderer quirks that we can't see otherwise. It is OPT-IN by action: nothing leaves your device unless you tap the "Send Logs to Developer" button in Settings.

• What the log contains. Timestamps + structured records of: UPnP discovery results (server / renderer names, IPs, UDNs, supported services), playback events (track started, paused, advanced, errored), SOAP responses from your renderer (HTTP status codes, SOAP fault codes), volume changes, library sync progress, app version + build, OS name + version, device model, memory tier, locale.
• What the log does NOT contain. We deliberately exclude: your Apple ID, your email address, your real name, your location, your contacts, your audio content, your Plex token (redacted), your passwords, anything from other apps.
• Where it goes. The log is wrapped in an email and sent via the Resend transactional email service to contact@serento.app. Resend (resend.com) processes the email on our behalf as a data processor under EU GDPR Art. 28.
• How long we keep it. Logs are retained in our inbox for the duration of the support case (typically days, occasionally weeks if we're working on a difficult renderer bug), then deleted. We don't archive them long-term.
• Rate-limit. There's a short cooldown between sends so the same device can't accidentally flood our inbox.

07 Crash reports

If Serento crashes, the crash stack is handled entirely by Apple's built-in system. We don't ship any third-party crash SDK. If you have enabled Share with App Developers - under Settings → Privacy & Security → Analytics & Improvements on iOS and iPadOS, or System Settings → Privacy & Security → Analytics & Improvements on macOS - we receive an anonymised stack trace via App Store Connect, with no personal data attached. If you've turned that off, we receive nothing.

08 Third-party services we depend on

These are the only third parties involved in delivering Serento. Each has its own privacy policy that you should read if you care about what they do with their share of the data flow:

• Apple Inc. App Store distribution, iCloud / CloudKit sync, StoreKit billing, crash reporting. apple.com/legal/privacy
• Plex Inc. Only relevant if you have Plex servers and sign in with a Plex account. plex.tv/about/privacy-legal/privacy-policy
• Resend. Email delivery service for the diagnostic logs you choose to send. resend.com/legal/privacy-policy
• Your UPnP server vendor. Whatever you run on your network (MinimServer, Plex, Asset UPnP, Twonky, JRiver Media Center, Kodi UPnP, etc.) is governed by its own license and privacy terms. Serento doesn't see what they do.
• Internet radio broadcasters. When you play a station, you connect to its servers directly. The broadcaster sees your IP and is governed by its own terms.
• Wikimedia Foundation. Wikipedia and Wikidata, for biographies. foundation.wikimedia.org/wiki/Policy:Privacy_policy
• Last.fm. Popular tracks for an artist. last.fm/legal/privacy
• Deezer. Artist photos and genre images, only when you run the image downloads. deezer.com/legal/personal-datas
• MetaBrainz Foundation. The Cover Art Archive, for album covers via Identify Album. metabrainz.org/privacy

09 What we DO NOT have

For symmetry with the list above - and because the absences matter as much as the presences:

• No user profiles. Our entitlement service keeps exactly one row per Apple ID: a one-way key, when the trial started, when we last heard from that key, plus internal bookkeeping fields. That row carries no name, no email address, no purchase record and nothing about what you play. It is an anti-abuse anchor, not a user account. We keep pseudonymous records keyed to the one-way account key and the device identifier described in Section 02a. They show us that one person uses three devices; they do not show us who that person is: no name, no email, no Apple ID, no contact details.
• No IP address logs. We run no backend that logs your IP address. Apple sees your traffic when it touches iCloud / the App Store, but that's Apple's relationship with you, not ours.
• No listening history. What you play, when you play it, and how often - none of that reaches us. Your listening history exists only on your devices and in your private iCloud container (Section 04), and what is playing right now is shared only with the Serento devices on your local network (Section 05).
• No content access. We don't see album titles, artists, or any other metadata from your library. Your servers send that to your device directly.
• No location data. We don't ask for, request, or use your device location.
• No contacts, calendars, or microphone. Serento doesn't request access to any of these. For the full permission list, check Settings → Serento on iOS and iPadOS, or System Settings → Privacy & Security on macOS.
• No read access to your photos. On iPhone and iPad, Serento asks for add-only access to Photos, and only at the moment you save an image created by the Share feature. Add-only means Serento can write that one image and cannot read, browse or list anything already in your library. If you decline, only that save fails. On Mac no Photos permission is involved: the image goes through a normal save dialog to a folder you pick.

10 Children

Serento is not directed at children under 13 years of age, and we do not knowingly process personal data from minors under 13. If you believe a child has somehow provided personal data to us, contact contact@serento.app and we will delete it.

11 Your rights under the GDPR

Because Dusty Enterprise SRL is established in the European Union, the EU General Data Protection Regulation (Regulation 2016/679) applies to any personal data we process about you. Your statutory rights include:

• Right of access (Art. 15). Ask us what personal data we hold about you and obtain a copy.
• Right to rectification (Art. 16). Ask us to correct inaccurate personal data.
• Right to erasure (Art. 17). Ask us to delete your personal data. There are three places it can be: a diagnostic log you previously sent, the entitlement row keyed to your account, and the telemetry reports carrying that same one-way key. Deleting the entitlement row also removes the record that your trial has already run. The telemetry reports are stored under the same one-way account key, so we can find and delete yours. They are deleted automatically after 13 months in any case; if you send us that key, we can remove the reports carrying it sooner.
• Right to restriction (Art. 18). Ask us to limit processing of your data in specific cases.
• Right to data portability (Art. 20). Receive your data in a structured, machine-readable format.
• Right to object (Art. 21). Object to processing on legitimate-interest grounds.
• Right to lodge a complaint. Complain to your national supervisory authority - in Romania that's ANSPDCP (dataprotection.ro). You can also complain to the authority in your country of residence.

12 Data retention

Because we hold so little, retention is short:

• On-device data. Lives as long as the app is installed. Uninstalling the app wipes it (see Section 03).
• iCloud-synced data. Lives as long as your Apple ID has the data. Apple's standard iCloud retention rules apply. You can delete it by removing items in-app or by signing out of iCloud.
• Diagnostic logs you've sent. Retained in our inbox for the duration of the support case, then deleted (usually days, occasionally weeks).
• Entitlement row. The single row per Apple ID described in Section 02. This is the one thing we keep indefinitely rather than briefly, because deleting it would let the same account start a fresh trial. You can still ask us to erase it (see Section 11).
• Subscription / billing records. Payment itself is handled by Apple and we never see a card, a name or an address. Serento does send us a subscription snapshot from your device - which plan you are on, its status (active, in trial, in a billing grace or retry period, expired, or revoked), whether it is currently active, whether you are in the trial, whether it auto-renews, the App Store storefront country, whether the purchase came from the App Store or from a test environment, and the purchase, expiry and trial dates - tied to the same one-way account key and device identifier as the rest of the telemetry and kept for 13 months. This snapshot lives with the telemetry and never in the entitlement row: they carry no name, email or Apple ID; they are stored under the one-way account key, which we cannot reverse.

13 International transfers

Dusty Enterprise SRL operates from Romania (EU). The third parties listed in Section 08 process some data outside the EU (Apple uses global infrastructure; Plex is based in California; Resend operates from the United States; the Wikimedia Foundation, Last.fm and MetaBrainz operate from the United States; Deezer from France, inside the EU). Each of these vendors implements the Standard Contractual Clauses or equivalent mechanism for EU-to-third-country transfers, as required by the GDPR. If you'd like the specifics for any of them, contact us.

14 Security

Local data on your device is protected by the operating system's app sandbox and (for the Keychain items - your Plex token in particular) by your device passcode and biometric authentication. CloudKit data is encrypted in transit by Apple and stored in your private container. Diagnostic logs travel over HTTPS to Resend. Our entitlement service holds one row per account: a one-way account key, the date your trial started, the date we last heard from that key, plus internal bookkeeping fields. It holds no purchase record, no name, no email address and no payment detail, and the key cannot be reversed into an Apple ID.

15 Changes to this policy

When the legal copy changes materially we update the effective date at the top of this page and, when the change affects what data we collect or where it goes, surface a notice in-app. The latest revision is always the version you see in Settings → About Serento → Privacy Policy.

16 Contact

For any question, request, complaint, or rights exercise: contact@serento.app. We answer within 30 days as required by GDPR, usually much faster.