Privacy Policy

Last Updated: October 12, 2026

← Back to Home

1. Overview & Architecture

SlimMedia (“we,” “our,” or “the Service”) provides automated local media management, transcode orchestration, and agent worker coordination. We believe your media files, library contents, and home infrastructure are personal and private.

SlimMedia operates under a local-first design principles model: your actual media files (videos, movies, audio tracks) remain on your local storage and are processed locally by your configured agent workers. Media payloads are not transmitted to or stored on our external servers.

2. Information We Collect

We collect only the minimum necessary information to authenticate users and coordinate transcoding tasks:

  • Account Credentials: Email address, hashed password (when registering directly via email and password), account verification status, and timestamp of account creation.
  • OAuth Profile Information: When signing in through Google or GitHub OAuth, we receive identity tokens and basic profile details authorized by you (see Section 3 below).
  • Worker Node & Fleet Metadata: Agent hostnames, hardware capabilities (such as GPU model, AV1/HEVC encoder support, CPU thread counts), agent status, and job execution logs necessary to schedule and monitor transcode tasks.
  • Operational Logs: Request timestamps, IP addresses for security and rate limiting, and anonymized error diagnostics.

3. Third-Party OAuth Sign-In (Google & GitHub)

To streamline authentication, SlimMedia supports Single Sign-On (SSO) via Google OAuth and GitHub OAuth.

Google OAuth

When you authenticate using Google, we request the standard identity scopes: openid, email, and profile.

  • Data Accessed: Your primary Google account email address, Google account ID, and display name.
  • Purpose: Creating and verifying your SlimMedia user account, maintaining authenticated sessions, and associating your transcode jobs and agent fleets with your account.
  • Google API User Data Policy Compliance: SlimMedia strictly complies with the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to serve advertisements, train machine learning models, or sell to third-party data brokers.

GitHub OAuth

When you authenticate using GitHub, we request the scopes: read:user and user:email.

  • Data Accessed: Your primary/verified GitHub email address, GitHub username, and public profile identifier.
  • Purpose: Creating and verifying your account identity and managing user authorization.
  • Restrictions: We do not request repository access (repo scope) or permission to act on behalf of your GitHub account outside of basic identity verification.

4. Media Files & Transcode Processing

Your video, audio, and subtitle files remain entirely on your infrastructure. Transcoding commands are executed locally by agent nodes communicating with your instance. Neither SlimMedia nor any third-party provider receives, inspects, or hosts your media files.

5. Data Storage, Security & Cookies

  • Session Authentication: We use secure, HttpOnly, SameSite session cookies to authenticate requests between your browser and the API. These cookies store cryptographically signed session tokens and cannot be accessed via client-side JavaScript.
  • State Verification: During OAuth workflows, temporary CSRF defense cookies (oauth_state) are utilized to validate authentication transactions and prevent cross-site forgery.
  • Security Measures: We employ industry-standard encryption in transit (HTTPS/TLS) and cryptographically strong hashing (Argon2id for direct passwords).

6. Data Sharing & Third-Party Disclosure

We do not sell, rent, or trade your personal information. We only share information in the following limited situations:

  • Essential Infrastructure: Transactional email delivery (for account verification notices) and security bot mitigation (such as Cloudflare Turnstile).
  • Legal Compliance: If required by applicable law, regulation, subpoena, or enforceable governmental request.

7. Your Rights & Data Deletion

You maintain full ownership of your data. You may request account deletion, unlinking of OAuth providers, or export of your account configuration at any time by contacting us. Upon account deletion, all associated sessions, tokens, and worker registrations are permanently purged from active databases.

8. Contact Information

If you have any questions or concerns regarding this Privacy Policy or your data, please contact:

SlimMedia Support
Email: [email protected]