Trust
Your movies. Your people. Your business.
Moovo is software you run yourself, so most of what it knows never reaches us. Here's how we handle the rest, and how we keep your server and your computer safe.
Private by design
Privacy isn't a setting you have to find. The full details are in the privacy policy and what other people on a server can see.
- You own your data
- The server runs on your own computer or NAS. Your library, watch history, chats, reactions and ratings live in its data folder, in a database you can back up, copy to a new machine or delete. We never receive any of it.
- Nobody sees you unless you connect
- Being on the same server doesn't connect you to anyone. People see only the people they've connected with, and you choose who sees your local time, when you're online, your downloads and your activity. The server's owner and admins can see what's watched on the server they run, and the app says so.
- Usage stats are opt-in
- A server can share a few anonymous numbers (as ranges, never names, titles, paths or addresses) so we know how many homes use it. It's off by default, only the owner can turn it on, and they can see exactly what would be sent first.
- No ads, no tracking
- The apps don't report what anyone watches. This website sets one cookie, to keep you signed in, and has no analytics or advertising trackers.
Security
A summary of how the server and the apps are protected. We don't publish the detailed findings, so nobody can use them against a server that hasn't updated.
- A security review of the server
- Before the first release, in September 2026, every route of the server was reviewed: sign-in, roles, file serving, uploads, integrations, email and updates, plus probing of a live server from the outside. It found no critical issues. Everything it found at high or medium severity in the server was fixed, with tests, before 1.0 shipped. The one other high finding was a home router's admin page open to the internet, not part of the server.
- Sign-in
- Passwords are hashed with bcrypt. Sessions use long random tokens that the server stores only as hashes. They expire after two months without use, and changing your password signs out every other device. Wrong passwords are rate limited per person and per address, so a stranger can't keep you locked out.
- Your files stay in their folders
- Movies, subtitles and artwork are looked up by id, never by a path someone typed, and links that point outside your media folders are ignored.
- Keys stay secret
- API keys for services like TMDB and the email password are never sent back to the apps, and they're kept out of error messages and logs.
- Crash reports are scrubbed first
- When the app crashes it sends a report so we can fix it, after removing server addresses, file paths, titles, names, emails, anything you typed and tokens, on your computer. You can turn it off in Settings, under Privacy. What's in a report
How updates are verified
The app updates itself, so the update path has to be the most trustworthy part of it.
- Signed and checked
- Every app release carries a SHA-256 checksum and an Ed25519 signature made with a release key that never lives on a server. The app checks both after downloading and refuses an update that isn't signed with that key. A compromised download host couldn't push a fake update.
- Never in the middle of a movie
- Updates download in the background and wait while something plays or you're in Watch Together. Even an urgent security fix waits for the credits before it restarts the app.
- Server updates with a safety net
- The owner updates the server from the app. It makes a backup of the database first, won't update during a Watch Together session, and never applies a release marked as breaking on its own.
- Every release is public
- Each version has its notes on What's new and Server releases, and every server version is published as its own Docker image tag, so you can stay on one or go back.
- About the Windows warning
- The Windows installer isn't Authenticode-signed yet, because the certificate costs more than a free app earns today, so Windows may ask once before it runs. Updates are still verified with the signature above. The Mac app will be signed and notarized by Apple.
Open standards
No lock-in. The pieces are ordinary ones you can inspect, back up and move.
- Your library, as it is
- Plain movie and TV files in your own folders. Nothing is converted or locked into a special format, and removing the server leaves them untouched.
- Standard pieces
- A Docker image, a SQLite database, HTTPS and JSON between the apps and your server, and subtitles as SRT, WebVTT or ASS files.
- Your own keys
- Posters and details come from services you choose, like TMDB, with your own API keys. Radarr and Sonarr connect if you use them.
- Works without us
- Your server doesn't need this website to run. If we disappeared tomorrow, movie night would still work.
Good questions
Can you see what I watch?
No. What's watched stays on your server. Moovo doesn't host, receive or index anyone's media or history. The people who can see activity on a server are its owner and admins, because they run it.
What does the server send you?
Nothing, unless the owner turns on anonymous usage stats. It does check this website for new server versions every few hours, which sends the version it's running.
How do I report a security problem?
Email hello@moovo.nulldaily.com with "Security" in the subject and as much detail as you can. Please give us a chance to fix it before sharing it publicly.