MovieClaw Cloud
Privacy Policy
Last updated: October 8, 2026 (draft)
MovieClaw Cloud (this website; “we” or “us”) provides accounts, instance claiming, and the push relay for the official MovieClaw app to self-hosted MovieClaw servers (“instances”). This policy explains what we collect, why we collect it, how long we keep it, and how you can delete it. The MovieClaw software runs on your own hardware. Your library, watch history, and member information stay on your machine. We can't access them, and they're outside the scope of this policy.
Our principles
- Only instance admins sign in to this website. Family members and the MovieClaw app never sign in, and never connect to our servers.
- Push notifications are end-to-end encrypted. Content is encrypted on your instance, and only devices signed in to that instance can decrypt it. We and the push relay only ever see ciphertext.
- We don't store which person owns which phone, and we don't store device tokens. We never send notifications to you or your family on our own, and we never send bulk messages.
- We don't know, and don't collect, what your instance downloads or what you watch.
What we collect
Your account
- Sign-in methods: When you sign in with Google or GitHub, we receive your account's unique ID, your email address and whether it's verified, your name, and your profile picture. When you sign in with an email code, we receive the email address you enter. From Google, we only request the openid, email, and profile scopes.
- Sessions: Each browser you sign in with gets its own session. We record when it was created and last used, its IP address, and its browser identifier (User-Agent), so we can list your signed-in devices under Account and let you sign out any you don't recognize. Session tokens are stored only as hashes.
- Email codes: We store only a hash of each code. Codes expire after 10 minutes and stop working after 5 wrong attempts.
- Product update emails: Recorded only if you subscribe. We keep which sign-in method's email you chose, the kinds of news you want (major news, release roundups), the language of the page you subscribed from, which page that was, and when you subscribed or made changes. We only send to verified email addresses on your account. Unsubscribing, unlinking that sign-in method, or deleting your account removes this record right away.
Your instances
- When you claim an instance: its name, version, and requested permissions, plus the IP address the request came from and a location estimated from it. The location appears on the approval screen so you can make sure the connection really came from you.
- Once connected, each instance checks in every hour with its version and some usage stats. See What your server sends us below.
The push relay
- The push relay forwards the ciphertext your instance sends to the Apple Push Notification service (APNs). It doesn't store device tokens or notification content.
- To enforce limits, the relay keeps daily totals for each instance: counts by push type and priority, the number of distinct devices (an approximate count; neither device tokens nor their hashes are stored), the hourly peak, and failures and their causes. The relay writes these to our database every few seconds, and we keep them for 90 days, to show your instance's push activity on this website and to set limits. These counts are needed to run the service, so the instance's usage stats setting doesn't apply to them.
- Relay logs only record the instance ID, the push trace ID, a prefix of the device token's hash, and the result. They're kept for 30 days for troubleshooting and handling abuse reports.
What your server sends us
Once you connect a MovieClaw server to MovieClaw Cloud, it talks to us. Here's everything it sends, why we need it, and whether you can turn it off.
| What | When | Why we need it | Can you turn it off? |
|---|---|---|---|
| Server name, version, and requested permissions; the IP address the request came from (used to estimate a rough location) | Once, when connecting | Shown on the approval screen so you can make sure the connection really came from you | No. It's needed to connect |
| MovieClaw version, runtime version, operating system, and CPU architecture | Every hour | To make sure your version is still supported before issuing push credentials, remind you to update when it's too old, and troubleshoot push problems | No. It's needed to stay connected |
| How many devices can receive push notifications, grouped by platform and app version (e.g. “iOS · 0.3.0 · 2 devices”) | Every hour | To show how many devices each server can reach on this website, and to know how many people are still on an older app version | Yes. Turn off usage stats under Settings → MovieClaw Cloud on your server |
| Whether the official push service is reachable, and when the last push went through | Every hour | When notifications stop arriving, to tell whether the problem is on our side or your server can't reach the internet | Yes, same setting |
| How many notifications were sent each day (by type and priority), roughly how many different devices they went to, and how many failed and why | Counted by the push relay as notifications go out | To enforce daily limits and show your usage on this website | No. It's needed to run the push service. Kept for 90 days |
For the hourly check-ins, we only keep the most recent one.
What we never receive
- What you download or watch: titles, sites, download clients, subscriptions, what's in your libraries or how big they are, and events like a download starting or a title being added.
- Who's in your household: how many members there are, or who got which notification.
- Who your devices are: device names, models, and phone IP addresses. Device tokens only pass through the push relay at the moment a notification is sent, and are never stored.
- What your notifications say: they're encrypted on your server, only devices signed in to that server can read them, and we and the push relay only ever see ciphertext.
How we use this information
To let you sign in and manage your instances, send the product update emails you subscribed to, issue push credentials to instances, enforce push limits, show instance status on this website, troubleshoot problems, and handle abuse reports. We never sell any information, use it for advertising, or build profiles.
Third-party services
| Service | Purpose | Information it receives |
|---|---|---|
| Google, GitHub | Sign-in | The account info you authorize |
| Amazon SES | Sending sign-in code emails and the product update emails you subscribed to (Singapore region) | Your email address and the code or email content |
| Cloudflare Turnstile | Bot check before a code is sent | Browser environment, IP address |
| Alibaba Cloud | The server that runs this website, the API, the push relay, and the database (Singapore) | All the information described in this policy |
| Cloudflare | Network acceleration and protection for this website and the API; storage for encrypted database backups (R2) | IP addresses and requests when you visit; backups are encrypted before upload, so Cloudflare can't read them |
| Apple Push Notification service | Delivering notifications to devices | Device tokens, ciphertext |
Where we store data and for how long
- Our server and database are located in Singapore (Alibaba Cloud). Traffic to this website and the API goes through Cloudflare's network.
- Sessions expire and are deleted after 30 days of inactivity or 90 days total. Email codes, sign-in requests, and pairing codes are valid for 10 minutes and are cleared out daily once they expire. Push counts are kept for 90 days. Account and instance information is kept until you delete it.
- The database is backed up every hour. Encrypted backups are kept for 14 days on our server and 35 days in Cloudflare R2, then deleted automatically. So after you delete your account, your information is gone from our backups within 35 days.
Cookies and local storage
Our sign-in cookies are __Host-session (your session, up to 90 days), __Host-oauth_state (a one-time check during Google or GitHub sign-in, 10 minutes), __Host-pending (holds a Google or GitHub account that isn't linked yet while you choose whether to create a new account or link it to an existing one, 10 minutes), and movieclaw_last_login (remembers which sign-in method this browser used last, so the sign-in page can mark it “Last used,” 1 year). If you switch languages on this website, or open a version in a language other than your browser's, mc_lang remembers that language (1 year) so the sign-in pages and dashboard use it too.
After you request an email code, your browser's local storage (localStorage) keeps the email address and time of the most recent request, so it can show the countdown before you can resend. It stays in your browser and is never sent to us.
This website doesn't use any analytics, advertising, or third-party tracking cookies or scripts.
Your rights
- Under Account, you can view, link, and unlink sign-in methods, see and sign out your signed-in devices, and change or cancel your product update emails.
- Under Instances, you can view each instance's latest report and disconnect instances.
- Under Account, you can delete your account. All your instances are disconnected, all sessions end, all sign-in methods are deleted, and your personal information is erased. Push counts for disconnected instances expire on their own within 90 days.
Contact us
If you have questions about this policy or need help with your data, email us at [email protected].
Changes to this policy
If we make significant changes to this policy, we'll announce them on this website and update the date at the top of this page.