Accounts And Pro#

MetaTana is local-first, but a hosted account adds Pro services such as hosted metadata, hosted AI Vision credits, account billing, and device linking.

Sign-In Model#

The app signs in through MetaTana's hosted account API with an email code:

1. Open the sign-in screenWhenever MetaTana is signed out, including right after you sign out, it opens the sign-in form with the email field in place of the app. Your library stays on disk but stays behind that screen until you sign in again.
2. Enter an emailPick the email tied to your Pro plan, or the one you will upgrade later, then select Send code.
3. Receive a sign-in codeA six-digit code usually arrives within a minute. If it doesn't, check spam, then select Resend code, or use Use a different email to fix the address. See Install and sign-in problems.
4. Verify the codeType or paste it, then select Verify and continue.
5. Hosted session is storedThe app caches a hosted session for plan and account checks. You don't sign in again unless the session expires, is revoked, or you sign out.

If sign-in fails, the app says why: the code expired, too many incorrect codes were entered, too many codes were requested (with how long to wait), MetaTana can't be reached, or sign-in email is unavailable. The fixes are in Install and sign-in problems.

Desktop installs keep the hosted session in the Electron app data directory. A pending Link device code is kept there too, protected by the same operating-system storage when available, so quitting and reopening the desktop app can resume the 30-minute claim even though Electron starts on a new local port. A completed, expired, signed-out, or deleted-account flow clears that pending claim. Docker WebUI sessions live in the browser's local storage for that exact origin; changing the scheme, hostname, port, or browser can require sign-in again. The mounted Docker data volume persists the library and app configuration, not browser sign-in state. If a desktop auth record is malformed, MetaTana treats it as invalid local auth state and waits for a fresh sign-in instead of reviving stale port-scoped browser storage.

The website uses the same hosted account model for account management, checkout, and device linking.

If MetaTana cannot send the sign-in email, it shows a delivery error and returns that attempt to your email-code allowance. Wait for delivery to recover, then try again.

Passkeys#

A passkey signs you in to metatana.com with your device's screen lock, such as Touch ID, Face ID, Windows Hello, or your phone's PIN. There is no code to type, and a passkey only works on metatana.com, so a look-alike site can't use it.

• Add one at Account › Security with Add a passkey, then follow your browser's prompt. Your password manager or device may save it so it works on your other devices too; the Security page marks those as Synced. You can add up to 10 and rename or remove each one there.
• Signing in. On the sign-in page, select the email field and pick your passkey from the suggestions, or select Sign in with a passkey. The same works on the device link page.
• A passkey counts as two-step sign-in. Once you have one, signing in with an email code also asks for the passkey (or an authenticator code or a recovery code). Adding your first passkey shows 10 recovery codes, once; keep them somewhere safe.
• In the MetaTana app. Passkeys work only on metatana.com. The app lists your passkeys in Settings › Account and opens metatana.com to manage them. To sign in to the app with a passkey, use the device link: the app shows a code, and you sign in on the page it opens.
• Removing your last one. If you have no authenticator app, removing your last passkey turns two-step sign-in off and your recovery codes stop working, so the page asks first. Devices that signed in with a removed passkey are signed out.
• MetaTana emails you when a passkey is added or removed, and if a sign-in with one is refused because it may have been copied.

Two-Step Sign-In#

Two-step sign-in adds a second code to signing in. After the email code, MetaTana asks for the 6-digit code from an authenticator app on your phone. It is optional and stays off until you turn it on.

• Turn it on at Account › Security with Set up authenticator app. Scan the QR code with your authenticator app, or type the key shown under it, then enter the 6-digit code the app shows. Sign out of all other devices is ticked by default. Keep it ticked if you are turning this on because you think someone else signed in.
• Save your recovery codes. Turning it on shows 10 recovery codes, once. Copy them, download them as a .txt file, or print them, and keep them somewhere other than your phone. Each code has 16 characters, shown as XXXX-XXXX-XXXX-XXXX, and works once.
• Signing in. After the email code, enter the code from the app, or use a passkey if you have one. If you can't use either, select Use a recovery code instead. The second step lasts 5 minutes and allows 5 wrong codes; after that, start signing in again. In the MetaTana app, an account with two-step sign-in finishes signing in on metatana.com: the app shows a device code, and you sign in with both steps on the page it opens. Older app versions can't do this; sign in from the website and link the device instead.
• Running low on codes. The Security page shows how many recovery codes are left and warns when 3 or fewer remain. Make new recovery codes replaces the whole set, and the old codes stop working.
• Turning it off. Select Turn off on the Security page. Your recovery codes stop working too, unless you still have a passkey.
• Recent activity. The Security page lists recent sign-ins, linked devices, and two-step sign-in changes. MetaTana also emails you when two-step sign-in is turned on or off, when recovery codes are made or used, and when a device is linked.

Confirm it's you#

Some changes need a recent sign-in: turning two-step sign-in on or off, making new recovery codes, and adding or removing a passkey. Opening billing, exporting your account data, and deleting your account can ask too. If you signed in more than 10 minutes ago, MetaTana shows Confirm it's you. On metatana.com you can use a passkey for this in one step. Otherwise it emails you a 6-digit code, and with two-step sign-in on it then asks for the code from your authenticator app, a passkey, or a recovery code. The change goes ahead once you finish.

One Account Per Install#

Each MetaTana install belongs to one MetaTana account. This matters for Docker, NAS, and server installs that you open from a browser on another device. The desktop app on its own computer always opens.

• The first account to sign in becomes the owner. The same account can sign in from any browser or device.
• A new Docker or NAS install asks for a claim code. Until an account is linked, MetaTana prints a one-time claim code to the server log every time it starts, and metatana owner claim-code shows it on the machine. After you sign in from another device, MetaTana shows Enter the claim code; the account that enters it becomes the owner. Only someone who can see the server can claim it. The desktop app needs no code, and installs that already have an owner never ask.
• Other accounts are refused. They see This MetaTana is linked to a different account. with a Sign out button, and cannot open the library.
• Installs updated from an earlier version link the account that was already signed in. Upgrading to 2.0 explains how the owner is picked.
• Signing out or deleting the account keeps the owner. A running install is never left open for the next account on the network to claim.
• Households. If several people used their own accounts on one install, only the owner's account can sign in now. Use the owner's account on every device, or run a separate install per account.
• Change the owner only from the machine that runs MetaTana. Run metatana owner reset (Docker: docker exec metatana owner reset), then sign in with the new account and enter the new claim code the command prints. metatana owner status shows whether an account is linked. Scripts can call DELETE /api/auth/owner with the local API key. These work without Pro.

When MetaTana Can't Be Reached#

A network problem or a MetaTana service outage does not sign you out. The app opens as normal and shows Can't reach your MetaTana account. Pro features are paused; your local library still works. Settings › Account shows Offline. Your library, local settings, and local features keep working, and Pro features resume once MetaTana is reachable again. The app checks again when you return to the window or your connection comes back.

Only a session MetaTana rejects as invalid, for example one that was revoked or signed out elsewhere, signs you out.

What Stays Local#

Your media library, local database, local settings, source paths, sidecar files, and organized outputs stay on your machine or in your Docker volume.

MetaTana's hosted account system does not replace the local SQLite library database. The hosted system is for account identity, billing state, device linking, hosted metadata, and hosted AI features.

Free And Pro Behavior#

Everyone signs in before the first scan. An active Pro plan makes hosted metadata ready without a personal metadata provider key. Free users can scan first and add a key later; a personal TMDb key licensed for their use, or Pro, then improves the matches. The app walks Free users through getting a free TMDb key in about 2 minutes and checks it with TMDb before saving it. No Pro plan is needed for the key. See API keys: guided TMDb key setup.

Pro users can access every feature in the callout above when the account has an active Pro plan: hosted metadata, AI features, subtitle search and fetches (including queued subtitle fetches), Trakt sync, hooks and webhooks, API-key access to the local MetaTana API, the standalone CLI, and MCP agent access. Pro also includes monthly AI Vision credits. Extra AI credit packs are bought on the website's Account page.

Hooks and webhooks do not run without Pro. Saved ones are kept and run again after you upgrade. Subtitle fetches and automatic hook runs that were queued while you had Pro do not run after Pro ends. They wait with an "Upgrade to Pro" note in Activity (Show: Fetches or Tools) and run after you upgrade, or you can cancel them there.

After metadata is ready, follow Add Your First File Or Folder for the first scan.

Plans And Billing#

Pro is available on two billing cycles:

• Monthly: US$5/month. Renews automatically every month until you cancel.
• Annual: US$50/year. Renews automatically every year until you cancel, and saves about 17% vs the monthly cycle. We email you about 35 days before each renewal.

Pick a cycle on the Pricing page before starting checkout; you can switch cycles later from the hosted billing portal at Account → Manage billing. Prices are in US dollars and include GST or VAT where it applies. In the US, Canada and India, sales tax is added at checkout. Polar Software, Inc. is our reseller and processes your payment.

To cancel, use Cancel subscription in Account → Billing or go to metatana.com/cancel. Pro stays on until the end of the period you paid for. If you live in the EU or the UK, you can withdraw within 14 days of buying. If you ticked Start Pro now at checkout, you pay for the days you used; otherwise you get a full refund.

Active Pro accounts can also buy either of these optional AI credit packs from Account:

• 250 Credit Pack: 250 credits for US$5.
• Large Library: 10,000 credits for US$99. Save US$101 compared with the 250-credit pack rate, about 51%.

Each pack is a one-time purchase. It does not renew automatically. Purchased credits do not expire while the hosted account exists. They work while Pro is active; if Pro ends, unused pack credits stay on your account and work again when Pro is back, and you can ask for a refund of unused pack credits from Account. A refunded pack takes back only that pack's unused credits. Prices include GST or VAT where it applies; in the US, Canada and India, sales tax is added at checkout.

Deleting Your Account#

You can request account deletion from Settings › Account › Privacy & data in the app or from Account on the website. Deletion signs out every device right away and emails a link you can use to cancel during the deletion window. The account is permanently deleted 30 days after the request.

• Cancel Pro first. MetaTana refuses to delete an account while a Pro subscription is still renewing. Cancel it in billing (Account → Manage billing), then request deletion again. A subscription already set to end at the close of the current period does not block deletion.
• Changing your mind. Sign in at Account on the website: it shows the scheduled deletion date and a Cancel deletion button. Settings › Account in the app shows the same. The cancel link in the email also works.
• Resuming Pro cancels the deletion. If you turn renewal back on in billing during the deletion window, MetaTana keeps your account.
• Export first if you want a copy. The export in the same place includes your profile, how you found MetaTana when you signed up, the policy versions you accepted, devices, subscriptions, billing records, usage counts, email history, support reports, your product-use choice, events, and milestones, and your AI credit balance and history.
• What is kept after deletion. Records of what you agreed to (which Terms, Privacy Policy, renewal and files notice versions, and when) stay for 7 years with your email removed, so we can show what was agreed if there is a dispute. Billing records stay for 7 years for accounting and tax, cut down to order and subscription IDs, amounts, currency, status, dates, and product. The email suppression list keeps only a keyed hash of an address that bounced or reported our email as spam. The privacy policy lists every retention period.

Device Linking#

Device linking is useful when the app displays a code and the user finishes account sign-in in the browser. The website claim flow links that browser session back to the app device, then the app receives a hosted session. The six-character code never contains 0, O, 1, I, or L. If email-code verification fails, the page says whether the email code was invalid, expired, rate-limited, unreachable, or blocked by a server problem; that failure does not consume the device code.

Linking a device needs a sign-in on that browser within the last day, with both steps when two-step sign-in is on. If the browser signed in longer ago, the page asks you to confirm it's you first, then links the device. Each time a device is linked, MetaTana emails the account a new device linked notice, so you can spot a device you don't recognise and sign it out from Account.

Privacy Boundary#

Hosted features should receive only the data needed for the requested hosted operation. For AI Vision, that means sampled frames and reviewed hints, not a whole local video file. For hosted metadata, that means title/provider search or enrich requests, not unrestricted local library access.

Usage data is sent only for signed-in accounts, while Share usage data under Settings › Account › Privacy & data is on. It is tied to your account and device, so it is not anonymous. You set the switch on the one-time agreement screen described below, and MetaTana 2.0 sends nothing until you agree. You can change it at any time in Settings, and a saved off choice stays off on every device. While enabled, MetaTana sends the app version, platform, and install type plus broad daily categories such as scan, organize, metadata, artwork, subtitles, playback, sync, and update steps. It also says which kinds of work ran on their own that day (Autopilot, watched folders, scheduled sync, the command-line tool, MCP) and whether a scan, match, scrape, or rename failed, without the error text. It also records first-use milestones, the setup steps you reached, and the Pro prompts you saw, and confirms when an updated app opens. It also sends:

• the operating system name and version, the CPU type (x64 or ARM) and whether an x64 build runs emulated on an ARM PC, rough CPU core, memory, free disk, and screen size ranges, and the maker of the graphics chip
• your time zone offset, the app and metadata languages, and whether ffmpeg and MediaInfo are installed
• rough library size and health ranges (movies, shows, episodes, extras, matched, waiting for review, missing artwork) and whether library folders or the MetaTana data folder are on a network share
• which media servers are connected and which providers have your own key (yes or no, never the key)
• your settings choices, such as Autopilot, renaming, NFO format, and naming preset
• which pages and actions you used each day as ranges, and roughly how long MetaTana was open
• speed and memory ranges, such as startup and Library load time and peak memory
• daily scan results as percentages rounded to 10% (matched on its own, sent to review, failed), overall and by kind
• failure categories for upgrades, startup, updates, file operations, errors shown, and media server syncs, plus hosted metadata and AI use as ranges

Counts are ranges, not exact numbers. It never sends media names, titles, file or folder names or paths, computer or network names, searches, keys, or library contents. MetaTana deletes these events after 13 months. It keeps a marker that each first-use milestone happened, with no time, device, or version, until you turn the setting off or delete your account. Turning the setting off deletes the saved events and markers for that account straight away. See the privacy policy for everything the hosted service keeps.

When the Terms or Privacy Policy change#

When we publish a new version of the Terms or the Privacy Policy that needs your agreement, your account asks you once. MetaTana 2.0 shows the agreement when you next open it signed in, and the website shows it on your Account page right after you sign in. It lists each updated document with a link to read it. Until you agree, the hosted service holds back account features such as checkout, AI Vision, and device management; signing out, billing, cancelling, exporting, and deleting your account always work. Every published version and its SHA-256 fingerprint is on Past versions.

Agreeing to the updated Privacy Policy#

The Privacy Policy changed on 17 and 18 October 2026 for the MetaTana 2.0 usage data listed above, so every account is asked to confirm it once. MetaTana 2.0 asks when you next open it signed in, and the website asks on your Account page. In the app you can't skip this step: confirm, or sign out. MetaTana needs you to be signed in to open your library, so after signing out you will see the sign-in screen until you sign in and confirm. Your files stay where they are.

The same screen has a Share usage data (optional) switch that you set yourself before you go on. The switch and crash reports start on only if your computer's time zone is in the United States, Canada (except the time zones it shares with Quebec), Mexico, Brazil, Australia, New Zealand, Japan, Hong Kong, Taiwan, or South Africa, and there the button says Agree. Everywhere else, and when the time zone can't be read, they start off and the button says Continue, which confirms you have read the policy. Only the time zone setting is read; nothing is looked up or sent. A choice you have saved always wins. Your choice is saved like the Settings switch, and you can change it later under Settings › Account › Privacy & data. Until an account agrees, the hosted service refuses the new 2.0 usage details and keeps taking only the basic daily categories that MetaTana 1.x sends.

MetaTana 2.0 also sends crash reports from the desktop app and from Docker installs (1.x apps do not). They start on or off by the same time zone rule (for Docker, the container's TZ), and a setting you changed yourself stays. A crash report holds the error, where in MetaTana's code it happened, the app version, platform, install type, and CPU type. Desktop crash reports also hold the operating system version, CPU model, memory, screen size, and language and time zone settings. File and folder paths (and the media names in them), web addresses, email addresses, and long tokens are removed from the error text first. If the desktop app itself crashes, the report also includes a snapshot of the crashed process's memory, which Sentry uses to find the crash and does not keep. The desktop app also tells Sentry when it starts and stops while crash reports are on. Sentry sees the IP address a report comes from and is set not to store it. They are not tied to your account. Turn them off with Send crash reports in the same place, or set METATANA_CRASH_REPORTS=off on a Docker install; it stops at once and applies to that install only.