Software that watches you is the default, not the exception
Somewhere along the way, "free" software learned to pay for itself with your attention and your data. What you watch, when you watch it, how long you linger before picking something — all of it became a stream pointed at a server you do not control. In a market where personal viewing habits are quietly treated as inventory, the surprising part is not that it happens. It is that we stopped noticing.
A media server is one of the most intimate pieces of software you can run. It knows your taste, your routines, the things you return to late at night. That is exactly why we decided, before writing the parts people see, where that knowledge is allowed to live.
Privacy is not a setting you bury three menus deep. It is an architecture decision you make on the first day, when it is still cheap to do the right thing.
Local-first, in the literal sense
FluxPlay runs on your hardware — a NAS, a spare PC, a dedicated box in the cupboard. Your library and the record of what you do with it stay there. Playback on your own network does not need to phone home, ask a cloud for permission, or route your activity through anyone else to function.
- Your media files never leave your server unless you choose to share them.
- Watch history, playlists, and preferences are stored on your machine, not in our database.
- Local playback keeps working even with the internet unplugged — your server is the source of truth, not a remote service.
- When you stream remotely, the connection is yours to your server; we are not a hop in the middle that gets to see the content.
Diagnostics you can read — and switch off
We will not pretend we collect nothing, because honesty is the entire point. To fix crashes and understand which features are worth investing in, FluxPlay can send anonymous diagnostics: error reports, crash traces, and coarse feature-usage counts. None of it includes your media, your library contents, your filenames, or what you watched. And all of it is yours to control — every category is a toggle, and one switch turns the whole lot off.
# fluxplay.config.yaml — diagnostics are opt-out, per-category, and documented
diagnostics:
enabled: true # master switch — set false to send nothing, ever
categories:
crash_reports: true # stack traces when something fails (no media data)
error_events: true # handled errors, to catch problems before you report them
feature_usage: false # anonymous counts of which features get used
# We never collect: media files, library contents, filenames,
# titles, watch history, IP addresses, or anything that identifies you.That block is not marketing shorthand — it reflects how the controls actually behave. The default is modest, the categories are named in plain language, and the comment about what we never collect is a commitment, not a footnote. You should never have to reverse-engineer your own software to find out what it is saying about you.
No cloud to lock you out
Local-first has a quieter benefit that only shows up on a bad day: there is no remote account whose outage takes your living room down with it. If a provider has trouble, your evening should not. Because FluxPlay does not depend on our infrastructure to play your own files, the thing you built keeps working regardless of what happens to us.
That is the version of privacy we think is worth having — not a promise printed on a pricing page, but a design where the private outcome is the path of least resistance. Your media stays on your server because that is simply how the software is built. Everything else is just us being clear about it.
