Privacy policy

x27cast, last updated 14 October 2026

x27cast is a player app for your own media server. The app ships no content, and what it shows comes from the x27cast server you sign in to. It has no advertising, no third-party analytics and no cross-company advertising tracking. It does not sell or share personal data with third parties.

What your x27cast server stores

The server is run by its administrator, who decides who has an account. It stores:

• Your account: user name, e-mail address if you log in with one, and your password as a salted scrypt hash. The password itself is never stored or logged.
• Sign-in: login codes and refresh tokens, stored only as SHA-256 hashes. Codes expire after 10 minutes.
• Demo accounts: an account that shows only free sample videos, made by the administrator or, on a server that opens its demo to everyone, when you choose Prøv demoen or sign in with Apple or Google without an account there. For it the server keeps a user name, its password hash if it has one, a SHA-256 hash of the random app installation ID or of the Apple/Google account ID it belongs to (never the e-mail address), and demo viewing progress. It can be deleted in the app.
• Waitlist: if you sign in with Apple or Google on a server that gives you its demo because you have no account there, the server also puts you on a waitlist, so its administrator can let you in. For that it keeps the same hash of your Apple/Google account ID, the e-mail address Apple or Google confirmed (an Apple relay address if you chose to hide yours, none if Apple did not share one), the name you gave, if any, when you first and last signed in and how often, and whether the request is pending, approved or declined. The e-mail address and name are used only for the waitlist. The entry is deleted with your demo account, and otherwise after 90 days without a sign-in. If you are let in, you get an ordinary account as described above.
• Viewing: how far you got in each film, your preferences (start tab, last channel, audio and subtitle languages) and recordings you schedule, if your server has a TV tuner.
• Remote control: while a device is playing, its name and playback state, kept in memory only so your other devices can control it.
• Usage and abuse protection: per account and day, how many streams ran at once, how many playbacks were started and how much video was served, kept with the other stream records (30 days), so the administrator can see how the server is used and stop overload. A demo account that keeps overloading the server is blocked, with the time and the reason, and the IP address it was used from cannot make a new demo account for a while; that address is kept in memory only.
• App stability: the apps report to your server how often key actions (such as signing in, starting live TV or a film, or casting) succeeded or failed, and how many crashes, hangs and unexpected exits occurred, together with the app, its version and build, the device type (iPhone, iPad, Apple TV or Apple Watch) and which of the app's built-in variants of a feature was in use. The server keeps only daily totals per app build, no personal data: never which account or device a report came from. To count how many people reported on a day, it uses a one-way code of the account number made with a key that is replaced every day; afterwards only the number of people remains. The totals are kept 90 days. The server can also tell the app which of two versions of a feature that are already in the app to use; it never sends the app any code.
• Team feedback: only the server's owners can send it, and only when they press send. A report holds the owner's own screenshot of the app (sensitive parts already masked by the app), what they drew on it, their comment as typed or dictated and, if they chose to, a version corrected on the device, together with the app version and build, the iOS version and the device model. Correction happens on the device; the server receives only the text, and only a cleaned copy of the screenshot (no embedded metadata). Reports are read by the team that builds the app. At most 500 are stored; they are not deleted automatically, and an owner can ask for their reports to be deleted. Other users and demo accounts cannot send feedback, and nothing is collected from them.
• Logs: operational events such as failed logins with the IP address they came from, used to block password guessing. Logs contain no passwords, codes, tokens or e-mail addresses and are rotated.

What the app sends to us

App installation and version adoption: the iPhone app sends its bundle identifier, app version, build, iOS version, distribution channel and a persistent random app-scoped device ID over HTTPS to cluster.x27.dk. We use these reports only to measure installation and version adoption. They contain no sign-in identity, name, e-mail address or advertising ID. After a successful report, the same version/build is not reported again for six hours; failures retry on activation, and a new version can report sooner. Active-install counts cover reports from the previous 30 days; this does not state when stored installation records are deleted.

What stays on your device

Your login token is kept in the device's Keychain. The Apple TV keeps a short list of recently played items and their artwork for the Top Shelf. The iPhone keeps the random app-scoped install ID in its Keychain so it can identify the same app installation across launches and reinstalls.

Third parties

If you log in with an e-mail code, the code is sent through the server's mail provider. If your server offers sign-in with Google and you use it, Google confirms who you are under its own privacy policy. If you cast to a Chromecast, the stream's address is handed to that Chromecast, which plays it with Google's standard media receiver. Crash reports and feedback you send through TestFlight are handled by Apple under Apple's privacy policy.

Your data

To see, correct or delete your data, or to close your account, write to support@x27.dk. Deleting an account removes it together with its viewing history, preferences and sessions.