Your remote actions stay close to home.

01 / Scope

Who we are

Cryptid Remote is operated by Cryptid VPN Ltd ("we", "us" or "our"). Cryptid Apps is our developer name on Google Play. This policy covers the Cryptid Remote phone app, its connection to Cryptid Remote Desktop, the supporting movie and TV catalogue service, and this privacy page.

Legal company

Cryptid VPN Ltd

Company number

17203075

Registered office

227 Anlaby Park Road South, Hull, United Kingdom, HU4 7JD

Privacy contact

[email protected]

This policy does not cover other Cryptid-branded products, which may have their own notices.

02 / On your network

Information handled locally

These features work between your phone and the TV or computer you select. Their contents are not sent to Cryptid VPN Ltd's servers.

03 / Online catalogue

Information processed by our catalogue service

When you use the movie and TV catalogue, the app contacts api.cryptidvpn.com. We process only what is needed to return and protect the requested service:

Search caches may contain a search term and returned results for no more than 24 hours; the term is hashed in the cache filename. Other catalogue response caches expire within three days, with top-ten caches limited to 24 hours. Cache entries are not associated with an account, visitor ID, or IP address.

Using search and filters is optional, but the catalogue cannot return the requested result without them. Local remote-control features work without an account or the hosted catalogue.

Visiting this page

When you visit this privacy page, Cloudflare and our host receive ordinary technical request information such as your IP address, browser information, route, and time so the page can be delivered securely. We do not use that request to choose your catalogue country. This page does not set advertising or analytics cookies and contains no third-party analytics tracker.

04 / Your device

Permissions

Cryptid Remote asks for a device permission only when the related platform or feature requires it. Depending on your device, these may include:

• Approximate location is optional and requested only when you first open Titles. If allowed, Android provides a coarse location that the phone converts into a country code. We do not send coordinates to our catalogue service. If location is unavailable or declined, the app uses your last selected country or defaults a first-time user to the United Kingdom; you can choose another country or All at any time.
• Local network and nearby Wi-Fi to find and connect to TVs and computers. Nearby-device scanning is not used to derive your physical location.
• Microphone only when you start a supported voice-control feature.
• Screen capture or media projection only when you start Android phone screen sharing.
• Nearby Bluetooth for supported gamepad and nearby-device features. We do not use Bluetooth scanning to derive your location.
• Notifications and foreground service to keep an active Android screen-sharing session visible and controllable.
• Infrared to send commands on phones with compatible IR hardware.
• Network access for local device control, catalogue results, artwork, update checks, and links you choose to open.

You can deny or revoke a permission in your phone's settings. The related feature may then stop working.

05 / Other organisations

Providers and sharing

We use providers only where needed to deliver, distribute, support, or protect Cryptid Remote:

Artwork and provider images may load from TMDB, Movie of the Night, Google favicon services, or another relevant image host. That host receives technical connection information such as your IP address and user agent when your device loads an image directly.

If you deliberately open a title or search on IMDb, Reddit, Letterboxd, Rotten Tomatoes, YouTube, Wikipedia, Google, TMDB, a streaming service, or a custom provider, your request is handled under that service's privacy policy. We do not control independent services.

We may also disclose limited information to professional advisers, courts, regulators, or authorities where legally required or needed to establish or defend legal rights, or to a successor organisation if the business is reorganised or sold, subject to appropriate notice and safeguards.

06 / Lawful bases

Why we use information

Where UK data-protection law applies, our lawful bases are:

Contract

To provide the local remote-control, pairing, catalogue, optional account and cloud-sync functions, and premium features or purchase entitlements that you request.

Consent

For permissions and features such as microphone use and screen capture. You can stop the feature or withdraw permission in system settings.

Legitimate interests

To keep the service secure, available, and reliable; diagnose faults; and maintain strictly necessary operational records, balanced against your rights.

Legal obligation

Where we must keep or disclose a particular record or respond to a lawful request.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

07 / Deletion

How long information is kept

No Hetzner server backups are currently enabled for the catalogue API. If backups are introduced, we will update this policy, restrict access, exclude disposable caches and logs where possible, and use a maximum 30-day encrypted rolling lifecycle unless a different period is specifically justified.

08 / Protection

Security

Our hosted API and this site use HTTPS/TLS. We minimise application logging, restrict production access to authorised people and providers who need it, and use app-private encrypted storage or platform keystores for sensitive local credentials where the platform implementation supports them.

No transmission or storage method can be guaranteed completely secure.

09 / Control

Your choices and rights

Where the right applies, you may request access to or a copy of your personal information, ask us to correct or delete it, restrict its use, receive portable information, or withdraw consent. Withdrawal does not affect processing that was lawful beforehand.

We may ask for proportionate information to verify a request. We will respond within the period required by applicable law and explain if an exemption applies.

UK users may complain to the Information Commissioner's Office (ICO). You may also complain to the data-protection authority where you live or work.

10 / Locations

International transfers

Our API is hosted in Germany, while providers such as Cloudflare, Google, and catalogue suppliers may process information in the UK, European Economic Area, United States, or other countries where they operate.

Where personal information is transferred to a country without applicable UK adequacy regulations, we use an approved mechanism where required, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with appropriate safeguards. You may request details from [email protected].

11 / Age

Children

Cryptid Remote is not directed to children under 13, and children under 13 should not use it. Users aged 13 to 17 should use the app with a parent or guardian's involvement where local law requires it. We minimise personal-information use for everyone.

If you are a parent or guardian and believe a child has provided personal information to us, email [email protected].

12 / Optional services

Accounts, premium features and deletion

Optional sign-in

If you create or use an email-and-password account, Firebase Authentication processes your email address, Firebase user ID, authentication state, IP address, device or user-agent information, and security records needed to create, authenticate, protect, and administer the account. Your password is handled by Firebase Authentication and is not visible to us in readable form.

If Google sign-in is added to a future mobile release and you choose it, Google may provide the profile fields shown during sign-in, such as your email address and name. We will not receive your Google password.

When optional cloud sync is enabled, we may use Google Cloud Firestore to store favourites, watchlists, preferences, subscription entitlement, and other information you choose to sync, associated with your Firebase user ID. Local device-control credentials, live remote input, microphone audio, and screen-share frames will not become cloud account content.

Free download and optional premium features

Cryptid Remote will remain free to download and use, with optional premium features or access tiers available as in-app purchases. Google Play or the Apple App Store will process payment. We do not receive your full payment-card details.

To validate, provide, and restore premium access, we may process a store purchase token or transaction identifier, product or plan selected, purchase and subscription status, renewal or expiry information, store platform, and the entitlement linked to your account or device. The app store also processes purchase information under its own privacy policy.

What we delete

For a current optional account, deletion will remove the Firebase Authentication account, its email address and Firebase user ID, and associated authentication information, subject only to the limited security or legal retention explained here. We will also delete support or privacy correspondence and other information we can identify from the email and details you provide, unless a limited record must be retained for a stated legal reason. We will delete the account rather than merely disabling sign-in.

Catalogue searches are not linked to an email, account, or persistent visitor ID and their caches expire automatically within the periods stated above. If synced favourites, watchlists, preferences or premium entitlement records are introduced later, those associated records will also be included in account deletion when they are no longer legally required. We will request deletion from service providers acting for us where applicable.

What may be kept

We may retain only limited purchase, accounting, tax, fraud-prevention, security, dispute, or legal records where necessary and permitted. We will restrict retained records to that purpose and keep them only for the applicable period. Fully anonymised information that can no longer be connected to you is not account data.

Local pairing details, preferences, and saved content remain on your device because we do not hold them; remove them by forgetting devices, clearing the app's storage, or uninstalling. Deleting a Cryptid Remote account will not automatically cancel billing managed by an app store, so store subscriptions may need to be cancelled separately through Google Play or the Apple App Store to prevent future charges.

The current app supports Firebase email-and-password accounts but does not currently collect cloud-synced favourites, purchase transactions or subscription information. We will verify each released implementation and update this policy and the app-store declarations before Google sign-in, cloud sync, or paid features go live.

13 / Updates

Changes to this policy

We will update this page when our practices or features change and revise the effective date above. If a change materially affects how we use personal information, we will provide additional notice in the app or another appropriate way before it takes effect where required.