Privacy Policy
TopTenArr is a self-hosted application that builds Plex collections from public streaming Top 10 charts. It runs on your own device or server (or, on Android TV, on your NVIDIA Shield). This policy explains exactly what data is and is not handled, in plain terms. The short version: we collect almost nothing, we don't track you, and there are no ads.
1. What stays on your device and is never sent to us
The following are stored locally, encrypted, in TopTenArr's own database on the device or server where you run it. They are never transmitted to TopTenArr's servers:
- Your Plex authentication token.
- Your Radarr / Sonarr URLs and API keys (if you choose to connect them).
- Your sync schedule and app settings.
These secrets are encrypted at rest using a key that lives only on your device. The Plex token is used solely to talk to your own Plex server (via plex.tv), exactly like any Plex client app — it is not collected by us.
2. What our servers receive
TopTenArr connects to our hosted service at api.toptenarr.com for three things:
- The Top 10 feed. For the paid services, the app requests the current charts. Each request carries your licence key, the service and media type, and your country code — nothing else. We receive which charts are requested in order to serve them; we do not build a profile from this. The free Netflix tier never contacts our servers at all — those charts are fetched by your own instance directly.
- Licence validation. If you use a Pro/beta key, the app sends that key, and only that key, to confirm it's valid. No machine identifier, install ID, version, or usage count is sent. We store the key, its plan, its status and its expiry — we hold no name, email, or other purchaser identity against it.
- Feedback you choose to send. If you use the in-app feedback / bug-report form, we receive what you submit: an optional email address, your message, and an optional screenshot. It also attaches a diagnostic bundle: your app version, your last 30 sync log entries, which services you have enabled, your licence plan, whether Radarr/Sonarr are reachable, and your Plex server's friendly name — which is often a personal or family name. This is entirely voluntary — nothing is sent unless you fill out and submit the form.
3. What we do NOT do
- No ads.
- No analytics or third-party tracking. The app and this website contain no analytics SDKs, trackers, or advertising identifiers.
- No selling or sharing of your data with third parties for advertising.
- No accounts beyond signing in to your own Plex.
- No tracking cookies. TopTenArr sets exactly one cookie and it is strictly necessary: after you sign in with Plex, a 30-day session cookie keeps you signed in so that nobody else who can reach your instance can use it. It holds a random value only, it is readable only by your own instance, and it is never sent to us. Nothing is written to your browser's local or session storage.
4. Third-party services
Your device may make ordinary network requests to the following. These requests can expose your IP address to those services as a normal part of how the internet works. We don't control and aren't responsible for their privacy practices.
plex.tv— to authenticate and reach your own Plex server.api.toptenarr.com— our feed and licence server, as described above.www.netflix.comandwww.rottentomatoes.com— contacted by your own instance to read public charts and ratings. These are not proxied through us.api.themoviedb.org— for artwork and title matching.cdn.simpleicons.org— loaded by your browser to render service logos in the TopTenArr web interface.- Google Fonts — on this website only.
5. Security
Data sent between the app and our servers travels over encrypted HTTPS. On-device secrets are encrypted at rest. No method of storage or transmission is 100% secure, but we keep the attack surface deliberately small by keeping your credentials on your own device.
6. Data retention & deletion
License records persist while the key is active. Feedback submissions are retained so we can respond and improve the app. To request deletion of feedback you've sent or a license record, email help@toptenarr.com; we action deletion requests within 30 days. Delete Your Data sets out the exact steps and what is removed. Anything stored locally on your device is removed when you uninstall the app or delete its data directory.
7. Children & child safety
TopTenArr is intended for adults 18 and over and is not directed to children. We do not knowingly collect personal information from anyone under 18. See our Child Safety Standards for our zero-tolerance policy on child sexual abuse and exploitation, and how to report a concern.
8. Changes
We may update this policy as the app evolves. Material changes will be reflected here with a new "Last updated" date.
9. Contact
Questions about privacy? Email help@toptenarr.com.
TopTenArr is not affiliated with, endorsed by, or sponsored by Netflix, Disney+, Max, Prime Video, Hulu, Apple TV+, Paramount+, Peacock, Plex, or any streaming service. All product names and logos are the property of their respective owners.