Privacy Policy

# Last updated: 2026-05-15

The short version

MediaPorter does not collect personal data. No account, no sign-in, no usage events, no filenames, no device identifiers, no crash auto-upload. The only thing the app ever sends home is an optional anonymous weekly heartbeat — you see the toggle on first launch and you can flip it off any time in Settings → Privacy.

What the app talks to

• Your iPhone, iPad, or iPod touch, over a USB cable or local Wi-Fi link. The app uses the same Apple Mobile Device tunnel that iTunes / Finder used. Communication is between your Mac and your device only.
• The Movie Database (TMDb), over HTTPS, to look up titles, posters, season/episode information for the media you choose to port. TMDb requests carry the query text and nothing that identifies you. We do not send your IP, device ID, or any stable identifier alongside these requests.
• OpenSubtitles, over HTTPS, only if you've added an API key in Settings and asked the app to fetch subtitles. Requests carry the query (title, season, episode) and your OpenSubtitles credentials — nothing else.
• bugs.porter.md (our self-hosted Bugsink instance), only in two cases: (a) if you've opted in to the weekly anonymous heartbeat (see below), or (b) when you press Help → Send Diagnostic and confirm the report. We do not use a third-party analytics provider.

Optional anonymous heartbeat

On first launch MediaPorter shows a welcome sheet with a single privacy toggle: "Send an anonymous weekly heartbeat." When this is enabled, the app sends one small HTTPS request per week to bugs.porter.md. The payload is a flat set of tags — no filenames, no titles, no media metadata, no device UDID, no Mac serial, no username, no file path, no per-action timestamps.

The tags fall into three groups:

Environment — describes the install:

• App version + build number (e.g. mediaporter@0.8.1+89)
• macOS version string (e.g. Version 14.5 (Build 23F79))
• CPU architecture (arm64 or x86_64)
• Whether ffmpeg is bundled, found on $PATH, or missing
• System locale (e.g. en_US, ru_UA)

Settings snapshot — whether you have certain options on or off, so we can interpret the counters below correctly (e.g. tell "subtitle fetch failed" apart from "never set an OpenSubtitles key"):

• tmdb_key — set or none (never the key itself)
• os_key — set or none (never the credentials)
• hw_accel — on or off
• airplay_4k — on or off

Bucketed activity counters — coarse counts of common actions and failures accumulated over the week. Each counter is sent as a bucket label like 0, 1, 2-5, 6-20, 21-100, 101-500, or 500+ — never as a raw number, so an unusual count doesn't become a stable fingerprint across weeks:

• c_launches — how many times the app started
• c_files_added — files you dragged into the queue
• c_analyses_ok / c_analyses_fail — ffprobe successes / failures
• c_transcodes_ok / c_transcodes_fail / c_transcodes_copy_only — transcode outcomes
• c_syncs_ok / c_syncs_fail / c_syncs_aborted — sync outcomes
• c_tmdb_no_match / c_tmdb_low_confidence — when TMDb auto-match needed a manual pick
• c_tmdb_user_picked / c_tmdb_picker_dismissed — what you did with the picker
• c_opensubs_fetched / c_opensubs_no_match — subtitle lookup outcomes
• c_send_diag_opened — how often Help → Send Diagnostic was opened

The counters are a proxy for app health. They never include filenames, show or movie titles, file sizes, durations, codec details, device names, or anything else that could describe the content you're working with. Counter values are reset on every successful weekly send; if you opt out, MediaPorter discards any locally accumulated counters and sends nothing thereafter.

The request lands on a self-hosted Bugsink server we run; we do not share it with any third party. As with any HTTPS request the receiving server briefly observes the source IP address to deliver the response. We do not store IP addresses alongside the payload and never link a heartbeat to a person.

To turn it off: uncheck the toggle on the first-launch welcome sheet, or open Settings → Privacy and flip "Send anonymous weekly heartbeat" off at any time. When the toggle is off, the app sends zero background requests and any in-flight counters are discarded.

On-demand diagnostic reports

Separately, Help → Send Diagnostic lets you ship a one-off bug report — with an optional screenshot and the tail of the app's log — to the same Bugsink server. This is always explicit: you press the menu item, see what's about to be sent, and confirm. We never auto-upload crashes or logs.

What stays on your Mac

• Your media library and any files you drop onto MediaPorter.
• Cached posters, probe results, and metadata used to render the app's UI.
• App preferences (window size, last-used settings, recent device).
• API keys you paste into Settings (TMDb, OpenSubtitles) — stored in macOS UserDefaults.

None of the above ever leaves your machine.

Distribution

MediaPorter is distributed as a signed and notarized DMG from porter.md, not via the App Store. There are no App Store privacy labels for this build. If we ever ship to the App Store, the labels will reflect exactly what is described above.

Children

MediaPorter is not directed at children under 13 and does not knowingly collect any data from anyone, including children.

Changes

We will update this page if the app's behavior ever changes. The "Last updated" date at the top of the page reflects the most recent revision.

Contact

Questions: hi@porter.md.