Plain-text copy of https://metatana.com/privacy (version 2026-10-17). Privacy Policy Effective 17 Oct 2026 MetaTana is local-first software with a hosted account, billing, device-linking, email, and Pro AI Vision services. MetaTana needs a free MetaTana account: you sign in before it opens your library. Your media files remain on your machine or server unless you choose to send limited data to configured integrations or hosted features. MetaTana is operated by Watari Labs Pty Ltd (ABN 84 696 983 829). For privacy questions, access or correction requests, and complaints, contact support@watari.dev. What Changed On 17 October 2026 MetaTana 2.0 sends more usage data while the Share usage data switch is on. The new kinds are: - your operating system version and CPU type, and whether MetaTana runs emulated - rough hardware ranges: CPU cores, memory, free disk space, and screen size - rough library size and health ranges, such as how many titles are matched - your settings choices and which media servers are connected - which pages and actions you use, and speed and memory ranges - daily scan results rounded to 10%, and the kind of each failure - hosted metadata and AI use, as ranges Counts are ranges, not exact numbers. It still never includes titles, file or folder names or paths, searches, keys, or library contents. Section 9 has the full list. Crash reports now also list the details they already held: the CPU type and, from the desktop app, the operating system version, CPU model, memory, screen size, language, and time zone. When you next sign in, MetaTana asks you to confirm this version and to choose whether to share usage data. You can change that choice later in Settings. --- 1. Data That Stays On Your Machine By default, your local MetaTana installation stores and processes library data on your own device, server, or Docker volume. This can include: - media files, thumbnails, generated artwork, and sidecar files - the local SQLite database containing library metadata, identification results, configuration, and scan history - local logs, caches, provider responses, and rollback journals - local credentials or provider keys you choose to configure - an unfinished private support-form draft kept in this browser tab for up to two hours, when browser storage is available MetaTana does not upload full media files by default and does not send raw local filesystem paths to hosted AI Vision in the default hostedidentify path. 2. Hosted Account And Billing Data If you create an account, sign in, link a device, subscribe to Pro, or purchase AI credits, MetaTana processes hosted account data such as: - your email address, and the display name, time zone, and language you set - signed-in devices: device name, platform, app version, install type, sign-in time, last-used time, and the IP address of your most recent request (updated at most once an hour) - sign-in and device-link records: the email address and device name used, and when the code was requested and expires - how you found MetaTana when you signed up, if the link carried it: campaign source, referring site, and landing page - which versions of the Terms and this policy you accepted - subscription status, entitlements, AI credit balances and history, and daily counts of hosted requests - billing records, including the payment events our payment processor sends us, which can include your name, email address, billing address, and order details - a record of each email we send you: address, type, and delivery status - support requests and account-administration notes - support-report answers, impact and frequency choices, status history, replies, notification preferences, and any safe error code or request ID you choose to type To keep the service secure and stop abuse, the hosted service also keeps: - rate-limit counters keyed by your IP address (IPv6 addresses are shortened to their network prefix) and by a keyed hash of your email address, never the address itself - an email suppression list: when an email to an address bounces or is reported as spam, we store a keyed hash of that address so we stop sending to it The hosted service does not store the browser or app user agent of your requests, and its request logs do not record your IP address. When MetaTana staff use admin tools, we log the staff member's action, IP address, and user agent. Guests provide an email address for a private receipt and support replies. The support form does not automatically upload screenshots, files, logs, local paths, browser details, or diagnostics. Payment card details are handled by MetaTana's payment processor. MetaTana stores the billing records needed to operate subscriptions, entitlements, receipts, support, fraud prevention, and accounting, but does not store full card numbers. 3. AI Vision When AI-assisted identification is enabled, MetaTana may send limited data either to the AI provider you configure in BYOK mode or to the hosted AI Vision service for Pro accounts. This can include: - reviewed frame samples extracted from media files - privacy-reviewed hints such as filename basename, parsed title, year, media type, and provider candidate context - model-routing, cache, latency, cost, and credit-accounting metadata Hosted AI Vision is intended for hint-assisted identification. It does not upload full video files, does not need your full library inventory, and does not use raw local paths in the default hosted identify flow. Frame samples are not stored. For each Pro AI Vision request we keep the identified title, year, and media type with the model, cost, and credits used, so we can show your credit history, bill correctly, and investigate disputes. 4. Metadata Provider API Calls MetaTana fetches metadata from external providers such as TMDb, TVDB, OMDb, Fanart.tv, MDBList, and AniList to enrich your library. Direct provider requests generally contain search hints such as title, year, media type, and provider IDs, not media files. Provider requests are governed by the privacy policies, terms, and rate limits of the provider you use. Hosted provider-backed routes may add MetaTana-operated caching, quota, entitlement, and compliance checks when those routes are enabled. When a Pro account uses hosted metadata, MetaTana's server sends the title, year, and provider IDs to the provider for you, and keeps a request log with your account ID and the title, year, season, and episode looked up. Request logs are deleted after 90 days. 5. Playback Server Sync If you configure playback server integrations such as Plex, Kodi, Emby, or Jellyfin, MetaTana communicates with those servers to sync library data, watch status, and metadata. This communication happens directly between your MetaTana instance and your configured server unless a future feature explicitly says otherwise. 6. How We Use Hosted Data We use hosted data to operate the Services, authenticate accounts, link devices, maintain subscriptions and AI credit balances, process payments and receipts, route hosted AI Vision requests, prevent abuse,investigate security issues, provide support, comply with law, and improve reliability. We do not sell personal information. We do not use your local media files for advertising. Hosted AI Vision remains hint-assisted: it usesreviewed frame samples and limited local title, year, media-type, and provider-candidate context, not full media uploads or full library inventory. 7. Legal Bases If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on these legal bases: - Contract: your account, sign-in, device linking, subscriptions, credit purchases, Pro features, and support - Legitimate interests: keeping the service secure, rate limiting, stopping abuse, the email suppression list, keeping records for disputes, and website analytics - Legal obligation: tax, accounting, and other records the law requires us to keep - Consent: usage data from the app (your choice on the agreement screen and the Share usage data switch, see section 9), marketing email, and advertising measurement on the website, and crash reports from the app (they start off in these places; you turn them on with Send crash reports). You can withdraw consent at any time. For usage data and crash reports, turn the switch off in Settings Everywhere else, usage data also follows your choice on the agreement screen and in Settings. In Brazil, South Africa, and Singapore we rely on our legitimate interest in seeing which parts of MetaTana are used and where setup or updates go wrong, and you can object at any time by turning the switch off. MetaTana 1.x apps (before 2.0) send a smaller set of daily usage categories for signed-in accounts, on by default, without asking first. For those 1.x categories we rely on our legitimate interest in seeing which parts of MetaTana are used, in every region, and you can object at any time by turning off Share usage data in Settings. From MetaTana 2.0 on, usage data follows the choice described above. Crash reports rest on consent wherever they start off under the time zone rule in section 9. Where they start on, we rely on our legitimate interest in finding and fixing crashes, and you can object at any time by turning off Send crash reports in Settings. 8. Email, Support, And Operations Providers MetaTana may use third-party providers to operate the Services, including email delivery, payment processing, hosting, logging, security monitoring, and customer support. These providers process data only as needed to deliver those functions. Current provider categories include: Category | Current providers | Purpose Hosting and infrastructure | Hetzner (hosted API and database), Vercel (website), Cloudflare (DNS and encrypted backups) | Operate the hosted API, website, storage, backup, and network paths Payment processing | Polar | Checkout, subscriptions, invoices, refunds, chargebacks, and tax records Email delivery | Resend | Sign-in codes, device-linking email, service email, and account notices Advertising measurement | Google Ads | Measure installer, Start Pro, and server-guide clicks from paid ads only after the visitor allows measurement AI routing and model providers | OpenRouter and selected model providers used for hosted AI Vision | Route reviewed frame samples and limited hints for hint-assisted identification Crash reporting | Sentry | Receive crash reports from MetaTana 2.0 desktop and Docker installs, with file paths removed from the error text, unless crash reports are turned off. Sentry sees the IP address a report comes from; we have set it not to store IP addresses Support, logging, and security | Account-operations, logging, monitoring, security, and support tools | Support requests, diagnostics, abuse prevention, incident response, and reliability We review this list as hosted infrastructure changes and update this policy when provider categories or material processing purposes change. These providers may process data outside Australia. Likely countries or regions include Australia, the United States, the United Kingdom, the European Union or European Economic Area, Singapore, and other regions used by our hosting, email, payment, AI routing, model, and support providers. Provider locations can change as infrastructure and routing changes. 9. Basic Product Data And Website Analytics MetaTana does not require library analytics for normal local use. Usage data is sent only for signed-in accounts, and only while the Share usage data switch is on. It is tied to your account and device, so it is not anonymous. After this policy changed on 17 October 2026, MetaTana 2.0 shows a one-time screen the next time you open it signed in, and the website shows the same on your Account page. The screen explains what is sent and has the Share usage data (optional) switch, which you set yourself before you go on. MetaTana 2.0 sends no usage data until you confirm. In the app you can confirm or sign out. MetaTana 1.x apps keep sending only the smaller set of categories they always sent: on by default for signed-in accounts, until you turn off Share usage data in Settings (see section 7). The switch, and crash reports (below), start on only if your computer's time zone is in the United States, Canada (except the time zones it shares with Quebec), Mexico, Brazil, Australia, New Zealand, Japan, Hong Kong, Taiwan, or South Africa. There the button says Agree. Everywhere else, and when the time zone can't be read, they start off and the button says Continue, which confirms you have read this policy. MetaTana reads only the time zone setting to decide this; nothing is looked up or sent. A choice you have saved always wins over the starting position. While the switch is on, MetaTana sends, tied to your account and device: - the days you open the app - which broad features you use each day: scan, organize, metadata, artwork, subtitles, playback, and sync - which kinds of work ran on their own each day: Autopilot, watched folders, scheduled sync, the command-line tool, and AI assistants connected through MCP - whether a scan, a match, a scrape, or a rename failed that day. We get the kind of failure only, never the error text, file, or title - first-use milestones: your first scan and first new result - setup steps you reached, such as your first folder, first scan, first rename, first sync, starting a Pro checkout, and having Pro active, and which Pro prompts you saw - update steps: prompt shown, download started, restart, and success - the app version, platform, and install type (for example the Windows installer, AppImage, or Docker), the operating system name and version, the CPU type (x64 or ARM), and whether an x64 build is running emulated on an ARM PC - rough hardware ranges: CPU cores, memory, free disk space on the drive that holds your MetaTana data, screen size, and the maker of your graphics chip - your time zone offset, the language you use MetaTana in, and the language you chose for metadata - whether ffmpeg and MediaInfo are installed - rough library size and health ranges: how many library folders, movies, shows, episodes, and extras you have, how many are matched, waiting for review, or missing artwork, and whether your library folders or your MetaTana data folder are on a network share - which media servers are connected (Plex, Jellyfin, Emby, Kodi, Trakt), how many syncs ran and failed for each as ranges, and which metadata providers you added your own key for. We get yes or no per provider, never the key - your settings choices, such as Autopilot, renaming, NFO format, naming preset, episode order, and whether subtitles, trailers, and watched folders are on - which pages you opened and which actions you used each day, such as scan, rescrape, rename, or undo, as ranges, and roughly how long MetaTana was open - speed and memory ranges: how long startup, Home, the Library, and an item take to load, scan time per title, peak memory use, and the size of MetaTana's library database - daily scan results as percentages rounded to 10%: how much was matched on its own, sent to review, or failed, overall and for movies, TV, anime, and extras, plus ranges of how often hosted metadata made the app wait or timed out - failure categories: upgrades, startup, updates, file operations (such as a rename blocked by permissions or a full disk), errors shown in the app, and media server syncs. We get the step and the kind of failure only, never the error text, file, or title - hosted metadata and AI use as seen by the app, as ranges: lookups, AI identify and AI Scrape runs, rate limits, timeouts, and whether you ran out of AI credits Counts are sent as ranges (for example 501 to 2,000 titles), not exact numbers. It never includes media names, titles, file or folder names or paths, computer or network names, searches, keys, or library contents. We use it to see which parts of MetaTana are used and where setup or updates go wrong. We delete it after 13 months. For each first-use milestone we also keep a marker that it happened, with no time, device, or version, so it is not counted twice. Markers are kept until you turn the setting off or delete your account. To change your choice later, use the Share usage data switch under Settings → Account → Privacy & data. The choice applies to your account on every device. Turning it off stops future usage data and deletes what we have stored for your account straight away. Deleting your account also deletes it. MetaTana 2.0 sends crash reports from the desktop app and from Docker installs. MetaTana 1.x apps do not send crash reports. In 2.0 they start on or off by the same time zone rule as the usage data switch (for Docker, the container's time zone); a setting you changed yourself stays. A crash report holds the error, where in MetaTana's code it happened, the app version, the platform, the install type, and the CPU type. Crash reports from the desktop app also hold the operating system version, the CPU model, how much memory the computer has, the screen size, and the language and time zone settings. Before a report leaves your computer, MetaTana removes file and folder paths (and so the media names in them), web addresses, email addresses, and long tokens from the error text. If the desktop app itself stops unexpectedly, the report also includes a snapshot of the crashed process's memory, which can contain whatever MetaTana had in memory at that moment, such as a file name; Sentry uses it to find where the crash happened and does not keep it. While crash reports are on, the desktop app also tells Sentry when it starts and stops, without details about you, so we can see how often MetaTana crashes. Reports go to our error tracker, Sentry, which sees the IP address they come from; we have set Sentry not to store IP addresses. Crash reports are not tied to your account. Turn them off with Send crash reports under Settings → Account → Privacy & data, or set METATANA_CRASH_REPORTS=off for a Docker install; it stops at once and applies to that install only. To tell you about new versions, MetaTana reads a version file from updates.metatana.com shortly after it opens and every four hours. The request carries no account details. Turn it off under Settings → General → Updates. The website uses Vercel Web Analytics and Speed Insights to count page views and measure page speed. They do not set cookies. Vercel receives the page address, referring site, and your browser, device type, and country. Optional OpenTelemetry export in a self-hosted MetaTana install is configured by you and sends data only to the endpoint you choose. When a website visitor arrives through a Google ad, the site offers a separate advertising-measurement choice. If the visitor allows it, Google Ads may store ad-measurement data and receive an event when a visitor clicks an installer download, Start Pro, or a server install guide link. These clicks do not prove an installation or purchase. The tag is not loaded for ordinary visitors or for a visitor who declines. This measurement does not send media files, library data, or local filesystem paths. 10. Docker Deployment When running MetaTana via Docker, local app data is stored within your configured host volumes. Hosted account, billing, and AI Visionbehavior is the same as other MetaTana deployments. A Docker install also needs you to sign in to a free MetaTana account before it opens your library. 11. Security And Retention You are responsible for securing your local device, server, container, filesystem, media library, backups, provider keys, and playback server credentials. MetaTana uses access controls and operational safeguards for hosted data, but no system can be guaranteed perfectly secure. MetaTana retains hosted data for as long as needed to provide the Services, maintain accounts, comply with legal and accounting obligations, resolve disputes, prevent abuse, and enforce terms. Retention periods for hosted data: Data | How long we keep it Account records (profile, subscription, AI credits, usage counts, product data choice, accepted policies) | Until you delete your account. The account is permanently deleted 30 days after you ask. Signed-in devices and their IP addresses | IP addresses on a device that is still signed in are cleared after 90 days. A device that signs out, is revoked, or goes unused for 90 days is deleted, with its IP addresses, 30 days after that. Sign-in codes and device-link requests | Sign-in codes, sign-in links, and device pairing requests are deleted 7 days after they expire (they expire after minutes). Device-link codes lose their device name after 7 days and are deleted after 91 days. Records of account emails we send | The recipient address is kept for 30 days, then replaced by a keyed hash. Records and their delivery events are deleted after 13 months. Email suppression list | Only a keyed hash of the address, never the address. Kept until we clear it, including after account deletion, so we do not email that address again. A temporary bounce is kept for 24 hours. Payment events from our payment processor | The full event, which can include your name, email address, and billing address, is kept for 90 days. It is then cut down to the accounting fields: order and subscription IDs, amounts, currency, status, dates, and product. Billing records | Kept for 7 years for accounting, tax, and disputes, including after account deletion, then deleted. Basic product data | Deleted after 13 months, straight away when you turn the setting off, or with your account. Milestone markers are kept until you turn the setting off or delete your account. AI Vision request metadata | The identified title, year, and media type, model, cost, and credits: until you delete your account. Hosted metadata request logs | Deleted after 90 days. Support reports, replies, and support email | Redacted 180 days after the report is closed or its fix is available. Open reports are kept until then. Redacted when you delete your account. Saved request results (so a retried request does not run twice) | Deleted after 24 hours. Rate-limit counters (IP address, hashed email) | Deleted 8 days after the last request. Counters keyed by your email are also deleted with your account. Staff admin logs | Kept to audit staff access. Backups | Nightly encrypted copies of the hosted database, stored with Cloudflare R2. We have not yet set a fixed deletion period for them, so data you delete, or that we delete under this table, can remain in a backup until that backup is deleted. Copies taken just before a server update are kept on the server itself for at most 14 days, and only the newest 2. We do not restore deleted data from a backup except to recover from a failure, and if we do, we delete it again. You can export your hosted data or delete your account under Settings → Account in the app or on the website Account page. The export includes your profile, how you found MetaTana when you signed up, the policy versions you accepted, your devices, subscriptions, billing records, usage counts, email history, and support reports, your product data choice, events, and milestones, and your AI credit balance and history. Deleting your account signs out every device straight away. The account is permanently deleted 30 days later, and you can cancel during that time. An active subscription that will renew must be cancelled first. Some records are kept after deletion as listed above. 12. Access, Correction, And Complaints You may ask to access or correct personal information that Watari Labs holds about you by emailing support@watari.dev. We may need to verify your identity before acting on the request. We aim to respond within 30 days where practicable, or within another period required by applicable law. If you are in the EU or UK, you can also ask us to delete, export, or restrict your data, and you can object to processing based on legitimate interests. You can complain to your local data protection authority, such as the Information Commissioner's Office in the UK. If you have a privacy complaint, contact us with the account email, the issue, and the outcome you are seeking. We will acknowledge the complaint, investigate it, and provide a response within a reasonable time. If you are not satisfied with the response, you may contact the Office of the Australian Information Commissioner (https://www.oaic.gov.au/privacy/privacy-complaints). 13. Marketing Communications We may send service emails about sign-in codes, device linking, billing, security, account administration, and support. We may send marketing emails only with consent or where permitted by law. Marketing emails will identify the sender and include a functional unsubscribe method. You can also ask to unsubscribe by emailing support@watari.dev. 14. Data Breaches If a data breach involving hosted personal information is likely to result in serious harm, we will assess and notify affected users and regulators where required by Australian law. 15. Contact Questions about this privacy policy can be sent to support@watari.dev. We may update this policy. When we do, the effective date at the top of this page will change.