Privacy Policy

1. Who is responsible for your data?

Theama is operated by Manos Fragakis, based in Greece, who is the data controller for the personal data processed to operate Theama.

For privacy questions, access requests, or account deletion, email [email protected]. Please use this private contact instead of posting personal information in public repository issues. Never send your password or TorBox API key.

2. Data we handle

Account and profile information

If you register, we process your username, account identifier, authentication information, and email address if you provide one. A real email address is optional; without one, a username-based account identifier is generated. Email-based recovery requires a working email address. Passwords are submitted to Supabase's authentication service; they are not stored as plaintext in Theama's profile or settings tables.

Lists, library links, and viewing progress

For signed-in users, we save favourites and watchlists, list names and visibility choices, followed-user relationships, and media information such as titles, IDs, poster links, and source/addon URLs. Library and playback records can include torrent hashes, file identifiers, episode information, playback position and duration, last-watched timestamps, and completion counts. These records support your library, resume playback, and account features.

Guest favourites are stored on your device and are imported into your account when you sign in. Your playback queue and some display preferences are stored on your device.

TorBox credentials and addon settings

If you connect TorBox, we process the API key you enter, TorBox account/library responses, file and torrent information, and the requests you make to manage your library or obtain playback and download links. The key is saved in browser storage. It is also saved to your Theama account only when you enable Link API Key to Theama Account.

Installed addon URLs, settings, and manifest information are stored on your device. Addon URLs are saved to your account when you enable Save Addons to Theama Account. URLs can contain credentials or user-specific configuration, so treat them as sensitive. Ordinary account preferences are synced when you are signed in, even if these two optional sync settings are off.

Requests, analytics, and support

Hosting and connected services process technical request information such as IP addresses, request URLs, timestamps, browser/device information, response status, and security information. Cloudflare analytics provides traffic and performance measurements. Depending on the analytics feature, these can include page views, referring sites, approximate country, browser/device categories, and loading performance. Analytics is separate from hosting and security logs; using analytics does not mean all requests are anonymous or unlogged.

If you contact us, we receive your email address, message, and information you choose to include.

3. Why we use data and the legal bases

• Providing requested features: account authentication, saved lists, profile features, library management, optional syncing, and playback use data necessary to provide the service you request (GDPR Article 6(1)(b)). Some features cannot work without the relevant information, such as a TorBox key for TorBox library access.
• Operating and improving the service: troubleshooting, responding to ordinary support requests, preventing abuse, securing accounts, and understanding traffic and performance serve our legitimate interests in maintaining a usable and secure service (Article 6(1)(f)), subject to your rights. Where applicable law requires consent for an analytics or storage feature, consent must be obtained before that feature is used.
• Legal obligations: we process information where necessary to comply with applicable law, including handling data-protection requests (Article 6(1)(c)).

We do not use personal data for targeted advertising or sell it. We do not make solely automated decisions that produce legal or similarly significant effects about you. Media matching and recommendations are ordinary app functions.

4. Who receives information?

• Supabase: provides authentication and the database for account records, profiles, saved content, preferences, and optional credentials/addon syncing. It processes this application data on our behalf. See its data processing terms.
• Cloudflare and the configured API proxy: provide hosting, delivery, analytics, security, and request forwarding. TorBox API requests pass through the configured proxy, including credentials needed to authenticate them. This happens even when saving the key to your account is disabled. Some link requests place the key inside the request URL, so the proxy and hosting infrastructure process that URL. See Cloudflare's privacy policy.
• TorBox and playback/download hosts: receive the account credentials and file/torrent requests needed for your chosen actions. Streaming or downloading contacts the returned content host, which receives connection and request information. TorBox is a separately operated service with its own terms and privacy practices.
• Metadata, images, and addons: TMDB receives searches, media identifiers, and requests for posters or other metadata. Anime matching may contact api.ani.zip and use mapping data fetched from GitHub. Your installed addon providers receive relevant manifest, catalog, metadata, search, or stream requests and configuration embedded in their URLs. Direct requests and remote images expose ordinary connection information, including your IP address, to their hosts. This also applies to remotely hosted branding images.
• Other users: your username and profile identifier are used for profile and follow features. Lists marked public and the media entries in them can be viewed through public profiles. Lists marked private are not shown by the public-profile feature. A public link can be forwarded or copied by others.
• Email and external services you choose: Cloudflare routes messages sent to our support and privacy contact to Gmail, which handles the mailbox. Opening an external player, using device sharing, or following a donation link sends the relevant media link/file or other information to the service you select. Donations are processed by Buy Me a Coffee and its payment providers; they may give the maintainer donor details, amounts, and messages. Theama does not collect payment-card details through its app.

Authorised service administrators can access account data where needed to operate the service, investigate problems, or handle requests. We may also disclose information where required by law or necessary to establish, exercise, or defend legal claims. Third-party services may act as independent controllers for their own services; this policy does not replace their policies.

5. Browser storage, cookies, and local files

Theama uses browser local storage, session storage, and the service worker's app-file cache to support sign-in, preferences, addon information, queues, guest favourites, and installation/offline app loading. These are not advertising storage.

Trust this device is enabled by default. Turning it off switches managed settings, the sign-in session, addon cache, and queue to session storage. Session storage normally lasts for that tab's session, subject to browser session-restoration behaviour. Guest favourites and hidden-progress display choices can still use persistent local storage; this setting does not make all data temporary or remove cloud records.

Logging out clears Theama's local and session storage in that browser. Browser site-data controls can clear app caches too. Clearing storage, uninstalling the PWA, or logging out does not delete your account or records held by connected services. Infrastructure providers may use necessary security cookies under their own service settings.

Files selected for local playback are read by the browser player; selecting a file does not upload its contents to Theama's account database. If you choose to share a file or open it in another app, it is passed to the destination you select. Network playback still involves the content provider.

6. How long information is kept

• Account data: saved account records remain while the account exists, unless removed through the relevant feature or a deletion request. The current app does not automatically expire inactive accounts or viewing progress. Retention is assessed against the purposes above and applicable legal obligations.
• Optional cloud copies: saving settings with TorBox key syncing or addon syncing disabled clears the corresponding values in the active account-settings record. It does not revoke credentials with the provider or immediately erase historical logs or any retained backups. You can disconnect TorBox in Settings and revoke its key with TorBox.
• Device data: persists according to the storage type described above, until cleared, overwritten, or removed by the browser. Clearing device data does not clear synced records.
• Support, security, analytics, and backups: retained according to the need to resolve a request, operate and secure the service, applicable legal requirements, and provider retention settings. Deleted live data may remain in provider logs or any backups until their retention periods expire. Provider schedules depend on the hosting plan and configuration; contact us for the applicable details. A single immediate-erasure deadline is not promised for these copies.

To request account deletion, email the contact above. There is currently no self-service account-deletion button. We will explain any information that must be retained and why. Deleting Theama records does not delete your TorBox account, hosted files, addon accounts, or copies others made of previously public information.

7. Where data is processed

Theama is operated from Greece, but its providers use international infrastructure and subprocessors. Data may be processed outside Greece and the European Economic Area; this policy does not promise EU-only storage. For transfers requiring safeguards, the providers' applicable data-processing terms include mechanisms such as EU Standard Contractual Clauses, where applicable. See the Supabase DPA and Cloudflare DPA. Contact us for information about the location and safeguards applicable to your data.

8. Your choices and rights

You can change profile details and supported preferences, manage lists and their visibility, remove library associations, unfollow users, disconnect TorBox, and turn off optional syncing. These controls affect different records; removing a list entry is not a request to erase all viewing history or your account.

Subject to applicable law, you may request access to and a copy of your personal data, correction, erasure, restriction, or portability. You may object to processing based on legitimate interests and withdraw consent where processing relies on it, without affecting the lawfulness of earlier processing. These rights have conditions and exceptions.

Email [email protected] to exercise your rights. We may request proportionate information to verify that you control the account; we do not need your password or TorBox key. We respond without undue delay and normally within one month. If a permitted extension is needed, we will explain it within that month.

You may complain to the Hellenic Data Protection Authority or another competent supervisory authority, including where you live or work in the EEA.

9. Security

Theama uses HTTPS on its official site and relies on its providers for authentication and hosting protections. No service or browser storage is risk-free. Anyone with access to your browser profile or account may gain access to stored settings or credentials; use trusted devices and protect connected-service keys.

10. Changes to this policy

We will update this page when our practices change and revise the date above. Material changes will be communicated through an appropriate notice in the service or another available channel. This policy explains data handling; it does not transfer ownership of your data or replace the project's software license.