Effective October 27, 2026

VHub Privacy Policy

This policy covers the VHub app for iPhone and iPad ("the app"). VHub is a media player. It plays playlists, files, streams, media servers, network shares and TV tuners that you add yourself. VHub does not provide, host or sell any content.

Data stored on your device

VHub stores the following inside its own storage area on your device:

• the sources you add, such as playlist addresses, TV guide addresses, server addresses, usernames and passwords. For Jellyfin, Emby and Plex, VHub saves an access token, not your password. Jellyfin and Emby give the token to VHub. For Plex, it comes from plex.tv, or it is the token you enter;
• for a playlist file you open, the web address it was downloaded from, if the file records one. VHub reads this address from the file's download information (the “Where from” detail that iOS or the app that saved the file may add), not from the playlist text, and saves it with the playlist. It can include sign-in details. If the file records no web address, VHub saves the file's location on your device instead. VHub never connects to this address;
• the channel, movie and series lists, with their descriptions and artwork links, and the TV guide data loaded from your sources;
• your favorites, watch history and playback positions;
• your profiles and settings;
• a parental-control PIN and the answer to your recovery question, stored only as salted hashes;
• a cache of images and other server responses, up to 256 MB, so screens load faster. The cache can include the addresses of those requests. For Xtream Codes accounts, these addresses contain your username and password. For Jellyfin, Emby and Plex, image addresses contain your access token;
• any cookies set by the servers you add, and temporary files used while importing playlists and TV guides, including copies of playlist files you open.

None of this is sent to us. Passwords and access tokens are kept in the app's own database with the standard iOS file protection: the file stays encrypted until you first unlock your device after it restarts. VHub adds no encryption of its own and does not use the Keychain. Stream and image links saved by the app, for example in favorites and watch history, can also contain your sign-in details.

Everything listed above is included in your device backups (iCloud Backup or a computer backup), according to your own backup settings, which Apple manages. The only exceptions are the cache and the temporary files. Because sign-in details are part of this data, we recommend encrypted backups. iOS may clear the cache when your device is low on storage. We have no access to your backups.

Deleting your data

• You can delete any source, any favorite or watch-history entry, and any profile except the first one, inside the app.
• Deleting a source removes its channels, TV guide data and saved sign-in details from VHub. Favorites and watch-history entries from that source are kept. Their stream and image links can include your sign-in details. Remove them in the Favorite tab and in Settings › Watch History if you no longer want them.
• Deleting a source does not sign VHub out of the server. For Jellyfin, Emby and Plex, the access token VHub received stays valid. To revoke it, remove VHub from the device list on your server, or from the authorized devices in your Plex account.
• Cached images stay until iOS clears the cache. Cookies stay until they expire or you delete the app.
• Turning off Require a PIN keeps your PIN and recovery answer, as salted hashes, so you can turn it back on with the same PIN. There is no option to remove a PIN. Deleting a profile removes its PIN and recovery answer. The first profile cannot be deleted, so its PIN stays until you delete the app.
• Deleting the app removes all of its data from your device. Copies in earlier backups stay until those backups are replaced or deleted.

Network connections

VHub makes network connections only for the following:

1. Sources you add. These are your playlist and TV guide addresses, Xtream Codes accounts, Jellyfin, Emby and Plex servers, WebDAV and SMB shares, HDHomeRun tuners, and the stream, image and TV guide links they return. Images include channel logos, posters and backdrops, which can be on other servers. If a playlist names its own TV guide address, VHub downloads the guide from that address too. Those servers are run by you, by your provider or by whoever hosts the links in your sources. Their own privacy policies apply, and each of them can see your IP address.
   VHub builds stream and image links that contain your sign-in details. For Xtream Codes accounts and WebDAV shares, these links contain your username and password. For Jellyfin, Emby and Plex, they contain your access token. For WebDAV videos, and for any stream link that contains a username and password, VHub also sends them in a header with each video request, and that header can also reach another address the server redirects to. VHub allows http:// connections. If you type a server address without http:// or https://, VHub uses http://. Over http://, your sign-in details travel unencrypted, so use https:// whenever your provider supports it.
2. Plex sign-in, only if you choose it. If you enter a Plex username, VHub sends your Plex username and password to plex.tv to obtain a token. The token is then used with your Plex server. If you leave the username empty and enter a token, VHub talks only to your own Plex server.
3. What media servers see. Media servers, and plex.tv during Plex sign-in, receive the name VHub, the platform iOS, a fixed client version (1.0) and an identifier. VHub calculates that identifier from your media server's address; for Plex sign-in, from your Plex server's address. Requests also carry the standard iOS headers, with the app name, build number, and the iOS networking and system versions. Video requests identify as a VLC-compatible player. VHub does not send any device or advertising identifier.
4. An internet connectivity check. To check that your device can reach the internet, VHub sends a request with no content to https://www.google.com/generate_204. If your device has no network connection, or the request does not get the expected empty reply (for example on a Wi-Fi sign-in page), VHub shows a "You're offline" screen. The check runs when VHub starts, when your network connection changes, when you tap Try again, and when you return to VHub while offline. The request carries only the standard headers that iOS adds: the app name and build number, the iOS networking and system versions, and your preferred languages. As with any internet request, the receiving server can see your IP address.
5. Pages you open from the app. In Settings, the Privacy Policy (this page, hosted on Cloudflare Pages at vhub-app.pages.dev) and the Terms of use (Apple's Standard License Agreement, on apple.com) open in an in-app Safari view. On the add-source forms, the license terms link opens Apple's Standard License Agreement in the same way. Rate VHub opens the App Store app on VHub's review page. Share opens the iOS share sheet with a link to VHub's App Store page. Get in Touch opens your mail app with only our address filled in; if no mail app can open it, VHub copies our address so you can paste it. VHub does not send email itself. These sites can see your IP address and are governed by their own policies.
6. AirPlay, only if you use it. When you use AirPlay, iOS may pass the stream address to the AirPlay device you choose. That device may be made by another company. The address can include your sign-in details for the source, and the device may then connect to your server directly.
7. Apple services provided by iOS, such as the App Store rating prompt. They are governed by Apple's privacy policy. Picture in Picture works entirely on your device.

Local network

iOS asks for Local Network access the first time VHub connects to something on your home network: when you scan for HDHomeRun tuners, or when a playlist, TV guide, stream, network share or media server you add is on your home network. VHub does not send anything from your local network to us. Sources on your local network that you add are saved in VHub and included in your device backups. If you use Plex sign-in, plex.tv receives the identifier that VHub calculates from your Plex server's address. To play some network files and tuners, VHub runs a small server that only your own device can reach (127.0.0.1); it is never exposed to your network. You can turn this permission off at any time in the Settings app › Privacy & Security › Local Network.

Contacting us

If you email us, for example from Settings › Get in Touch, we receive your email address and what you write. The app adds nothing to your message: no device details, identifiers or app data. We use your email only to reply to you, and we delete it when you ask.

Diagnostics from Apple

VHub contains no crash-reporting or analytics code. If you have turned on Share With App Developers in the Settings app › Privacy & Security › Analytics & Improvements, Apple may share crash reports and usage statistics with us. Apple does not identify you in them, and they are covered by Apple's privacy policy.

Third parties

VHub contains no third-party analytics, advertising or tracking code. We do not sell or share any data with anyone.

Children

VHub does not collect personal information from anyone, including children. Profiles and parental controls with a PIN are available in the app.

Your rights

The app does not send your data to us, so we hold nothing from the app to access, correct, export or delete. If you have emailed us, ask us and we will delete your messages. You can delete most of what VHub stores from inside the app: see "Deleting your data" above. To remove everything, including the cache and cookies, delete the app.

Changes to this policy

If this policy changes, we will update this page and the effective date above.

Contact

This policy is published by the developer of VHub, shown as the seller on VHub's App Store page. Questions about this policy: sheungtak@duysoft.org