Privacy policy

Who we are

BluePIN is a service of hackesp LLC. For any privacy question, write to hello@bluepin.club.

How it works

BluePIN has two parts:

• The app (phone, tablet, TV, computer), which plays content from the services you set up: your playlist and, if you have one, your video library server.
• The bluepin.club portal, which only exists to get your playlists onto a device without typing them with a remote.

The app connects directly to the servers you set up. That traffic does not go through BluePIN and we cannot see it. Those servers are not ours and have their own policies.

If you use the demo, the app connects to bluepin.club/demo, which serves freely licensed short films and keeps the same technical logs described below.

What the portal stores

For each linked device, only:

• Its public key, used to encrypt what is sent to it.
• A hash of its secret device code; the code itself never leaves the device.
• The on-screen code shown while linking, which expires after 10 minutes.
• The device type (for example "Android TV") and the dates it was created, linked and last seen.

The playlists you send are encrypted in your browser with the device's key before they leave it (NaCl: X25519 and XSalsa20-Poly1305). The portal keeps them encrypted, unable to read them, only until the device collects them, usually within seconds, and deletes them on delivery. Not even the name you give the playlist is sent unencrypted.

The public website uses no cookies, no analytics and no third-party resources.

Technical logs

Like any web server, ours records each request (IP address, date and path) to defend against abuse. These logs are deleted automatically after 14 days. The portal itself does not record IP addresses or the content of any request in its own logs; to limit abusive attempts it uses the IP in memory only, without storing it.

Speed test

The app's speed test downloads test data from Cloudflare's measurement service (speed.cloudflare.com), which has servers near you and therefore measures your real connection. As with any download, Cloudflare sees your device's IP address; it receives nothing else (not your playlist nor what you watch). If it does not respond, the test runs against our server.

What is stored on your device

• Your playlists (server, username and password). On phones, tablets and Android TV, in the system's secure store (Apple Keychain or Android Keystore). On computers and on Samsung or LG TVs, in the app's private storage.
• The programme guide, so it is not downloaded every time.
• Your settings: enabled sources, hotel mode and, if you use it, parental control. Only a hash of the PIN is stored, never the PIN itself.

Where you left off in a film is stored by your video library server, not by BluePIN.

Signing out erases all of the above from the device and asks the portal to delete the device as well. Hotel mode does the same on its own after the chosen time.

How long

• Sent playlists: deleted on delivery; if the device never collects them, after 7 days.
• On-screen code: 10 minutes.
• Synced favourites: one encrypted block per playlist that only your devices can open; deleted after 6 months without changes.
• Devices: deleted when you sign out on them; otherwise after 6 months without connecting. Devices that start linking and never finish, after 7 days.
• Technical logs: 14 days.
• Infringement notices and their attachments: at most 3 years from closure, unless the law or a proceeding requires longer (see below).

Your rights

You can ask to access, correct or delete your data, and object to its processing. Using BluePIN does not require your name, email or any personal detail, so we usually cannot identify you: the most direct way to erase everything is to sign out on the device. If you sent us an infringement notice, please give us its reference. For any other request, write to hello@bluepin.club.

hackesp LLC is a New Mexico (United States) company. Regardless of where you live, the processing of your data is governed by the laws of the State of New Mexico and the federal laws of the United States. If you believe we have not handled your request properly, write to us again and we will review it.

If you send us an infringement notice

If you use the infringement notice form, we store what you write in it (type of sender, name, organisation, email, country, phone, the description of the notice, the server or device details, the links and your signature), any documents you attach (stored encrypted and only accessible to our team), and the IP address and browser it was sent from, to prevent abuse of the form.

We use them only to handle the notice: check it, reply to you, block devices or servers, meet our legal obligations and deal with any claims. We do not send you automatic emails or use this data for anything else.

We keep them for as long as needed to handle the notice and deal with claims or proceedings, and at most 3 years from its closure unless the law or a proceeding requires longer.

We may share them with authorities that request them in accordance with the law and, if the law requires it, with the person affected by the notice.

Children

BluePIN is not directed at children under 13 and does not knowingly collect their data. For family use, the app includes a PIN-protected parental control that hides the categories you choose.

Security

All connections are encrypted (HTTPS); the app does not accept playlists that do not use HTTPS. Playlists are end-to-end encrypted between your browser and your device, so not even an attack on the portal would allow them to be read. The server stores no passwords.

Changes

If anything described here changes, we will update this page and its date.