Kymelo is a media player for files you already have and for media servers you run yourself. This policy covers the Kymelo apps for Windows, macOS, iOS, iPadOS and Android, and this website.
The short version
- Your media, library, playback history and settings stay on your device. Kymelo never uploads your media or your library.
- A Kymelo account is optional. If you create one, we keep your email address and the list of devices you're signed in on, nothing else.
- The iOS, iPadOS and Android apps show ads from Google AdMob, unless you buy Kymelo Ad-free. The Windows app shows no ads.
- We do not sell your personal data.
What stays on your device
To remember where you stopped and to build your library, Kymelo keeps a local database containing the paths, names, sizes and playback positions of media you open or add, your settings, any subtitles you add, download or generate, and the media servers you connect (their address, your user name and a sign-in token, kept in the system's secure storage where available). On Windows this is in %LOCALAPPDATA%\Kymelo. If Kymelo crashes, it saves an error report in the same place; reports never leave your device unless you choose to send one to us. Uninstalling the app removes everything on mobile; on Windows it keeps this folder so your library survives a reinstall, and you can delete the folder to remove everything.
Kymelo account (optional)
You can use every playback feature without an account. An account lets one Kymelo Ad-free purchase cover up to five of your devices. It is provided with Google Firebase (Firebase Authentication and Cloud Firestore, data stored in the EU).
- What we keep: your email address and a user ID; if you sign in with Apple or Google, the identifier and email that service gives us (Apple lets you hide your real email). For each signed-in device: a random device ID, the device name, its platform, and when it was added and last used. Your password, if you use one, is held by Firebase in hashed form and never seen by us.
- Why: to sign you in and to enforce the five-device limit. Legal basis: performing our agreement with you.
- How long: until you delete the account. You can delete it at any time in Account & settings; this removes the account and its device list straight away (backups within 30 days).
Ads (iOS, iPadOS and Android)
The mobile apps show a banner on the home screen and, at most every ten minutes, a full-screen ad when you leave the player, never during playback. Ads are served by Google AdMob, which receives your device's IP address, device and app information, the advertising identifier (if allowed) and ad interactions, under Google's privacy policy.
- Your choice: in the EU, EEA, UK and Switzerland, the app asks for your consent with Google's consent form before any ad request; you can change it any time under Privacy options in Account & settings. Without consent, ads are not personalised. On iOS and iPadOS, the app also asks whether it may track you across other companies' apps (App Tracking Transparency); if you decline, the advertising identifier is not shared.
- Legal basis: your consent for personalised ads and storing identifiers; our legitimate interest in funding the free app for non-personalised ads where consent is not required.
- Ad-free: with Kymelo Ad-free on a signed-in device, the ads SDK is not started at all, so no ad requests are made.
Kymelo Ad-free purchases
Purchases are made through the App Store or Google Play, which process your payment under their own policies; we never see your payment details. We use RevenueCat, Inc. to check purchases: it receives your Kymelo user ID, the store's purchase receipt and basic device and app information, and keeps the purchase history so the unlock can be restored on your other devices. Legal basis: performing our agreement with you, and our legal obligation to keep transaction records.
Media servers (Jellyfin)
When you connect a media server such as Jellyfin, Kymelo talks only to the server address you entered: it signs in, browses your libraries, streams media and reports playback progress to that server. That server is yours (or whoever runs it) and its own policies apply. Nothing about it is sent to us.
Casting to TVs
To find TVs and speakers, Kymelo looks for Chromecast and AirPlay devices on your local network (the system asks for local network permission first). When you cast a file from your device, Kymelo makes it available to that TV over your local network only, for as long as you're casting, at a random address nobody else can guess. When you cast an item from your media server, the TV fetches it from that server directly. Google's Cast software on the TV and on your device may send Google technical information under Google's privacy policy.
Other times Kymelo connects to the internet
| Feature | What is sent, and to whom | When |
|---|---|---|
| Updates (Windows) | A request for the latest version list and update files from our download server. Like any web request it includes your IP address and the app version. | Shortly after the app starts |
| Speech model download | A request to Hugging Face, Inc. for the open-source Whisper model file. Hugging Face's privacy policy applies to that request. | Once, after you agree, the first time you generate subtitles |
| Generated subtitles | Nothing. The audio is processed on your device and the temporary audio file is deleted afterwards. | When you choose Get subtitles |
| OpenSubtitles search (optional, off by default) | A fingerprint of the file (a hash of its size and first and last 64 KB), its size, a cleaned-up title from the file name, the language you chose and your OpenSubtitles API key, sent to OpenSubtitles (opensubtitles.com), whose terms and privacy policy apply. | Only when you have switched the option on and choose Get subtitles |
Who processes data for us
- Google LLC and Google Ireland Ltd: Firebase (accounts) and AdMob (ads).
- RevenueCat, Inc.: checking and restoring purchases.
- Apple and Google: app distribution and payments, under their own policies.
Some of these companies process data in the United States. Transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
This website
The website uses no cookies, analytics or third-party scripts. Our server keeps standard access logs (IP address, time, requested page or file and browser user agent) for up to 30 days to keep the service secure and working, then deletes them. Legal basis: our legitimate interest in running a secure service.
App stores
If you install Kymelo from the App Store, TestFlight or Google Play, Apple or Google process data about your download and purchase under their own privacy policies. We receive the aggregated statistics they provide to all developers.
Your rights
You can ask us for access to, correction, deletion or a copy of personal data we hold about you, object to its processing, or withdraw consent at any time (for ads, under Privacy options in the app), by emailing us. Deleting your account in the app removes your account data. If you are in the EU, EEA or UK you may also complain to your data protection authority; in Cyprus that is the Commissioner for Personal Data Protection.
Children
Kymelo is a general-audience app, not directed at children under 13 (or the minimum age in your country). Accounts are for people of that age or older, and we do not knowingly collect personal data from children.
Changes
If Kymelo starts sending more data, we will update this policy with a new date and explain the change in the app before it applies.
Contact
Questions about privacy, or to use your rights: support@kymeloapp.com.