This page says where each piece of your data sits. Your files never move. The folders you point Quven at are read by the server on the machine you run, and that’s the end of it. What travels, then? Your account: who you are, which servers you have linked, and the handful of things that’d be maddening to lose if you reinstalled tomorrow. Everything past that is a switch you turned on, and each section below will tell you what its switch actually sends.
Your library stays put; your profile follows you
The server reads the folders you chose and serves them to the clients you’ve authorised, and it will never do more than that with them.
That’s all there is to it for media. Everything else we hold is smaller and less interesting: a sign-in, a list of linked servers, and the per-person state that makes a library feel like yours: watchlists, ratings, reviews, the position you stopped at in the third episode. Reinstall the server on new hardware, sign in, and everything should be where you left it. That’s the whole reason any of it is held anywhere other than your own disk.
What an analytics event is allowed to say
Product analytics stays off until you grant it, and the grant lives on your Quven Account, in the portal under Privacy & data sharing, on the card headed Help improve Quven. Your server reads that consent from the account it’s linked to, so a single switch can cover every server and every client you own. Withdrawing it does more than stop the next event: the queue of events still waiting to be delivered is emptied on the spot, and unlinking a server from the account has the same effect.
So what can an event carry once you’ve said yes? Less than most people would assume, because the shape’s checked before anything is queued. An event has to be one of the catalogued names, scan.completed or playback.started or one of the thirty-odd in the list, and each field on it has to appear on that event’s own allowance. A measurement has to be a number that isn’t negative. A label has to be a word from a closed vocabulary: hevc or av1 for a codec, uhd or fhd for a resolution, 1gb_10gb for a file size, relay or lan for the route a client took to reach the server. Anything outside the vocabulary will fail, and the event fails with it.
That design leaves no seat for a film title. Free text isn’t one of the shapes a label may take, so a title could not ride along even by mistake, and the validator throws out any value that reads like a Windows or Unix path, an email address, a bearer token or a JWT. Labels stop at 64 characters, and no event may carry more than 24 of them. All we can learn from a scan is that it finished, how long it took and how many files it saw at each resolution. What the titles were called stays with you.
Matching a title talks to the outside
To work out what a file is, the server asks the catalogues you configured, using what it can read from the name.
Managed AI matching is its own switch and it ships off. Turn it on, and when an ordinary match comes back ambiguous the server sends the title and year parsed out of the name, the running time measured from the file itself, the file name, and the candidate rows the catalogue already returned. The folder holding the file stays behind: the code takes the file name and drops the path before the prompt is built. The quota row that counts your monthly allowance keeps a request identifier, a status and a fingerprint, so afterwards nobody here can read back which film you matched. Point the server at your own provider key instead and it will talk to that provider directly, under their terms and never through us.
Turn on a provider and you’ve taken on its privacy terms as well as ours, which is a good reason to read them before you do.
Subtitles split into a local half and a travelling half
Making subtitles out of the audio happens on your own hardware. The server pulls the exact audio stream you picked into 16 kHz mono through FFmpeg, hands that to a local build of whisper.cpp and writes the result beside your file. No audio will leave the machine, and the transcript doesn’t either. Generating subtitles locally covers the models and what they ask of your processor.
Translation is the half that travels, and it travels only when somebody asks for it. The request carries the subtitle text, the language it’s in and the language you want, plus a little public context to steady the wording when the title is matched: the name, the year, the genres and the synopsis a catalogue already publishes to the world. Your server signs the call with its own pairing identity, so which profile pressed the button doesn’t go along. The translation comes back and is written as a subtitle asset on your disk. The copy we hold so that a retry doesn’t cost you the whole job is stripped after seven days, and a second cache keyed by a SHA-256 digest of the source text with its target language, its format and its model can let a common subtitle skip the provider altogether. That one carries no account at all, and it’s deleted after ninety days. AI subtitle translation walks through the feature itself.
Diagnostics: stripped first, and yours to refuse
Crash and playback reports are scrubbed on your machine before anything leaves it. Absolute paths are hashed, an email or a token is redacted, and a library name or a person’s name is swapped for a stand-in. The scrubber walks the whole event, so breadcrumbs and tags and attached request data all cross the same boundary, and the names reports are filed under come from a fixed catalogue of operations, which is why a title can never become one by accident. The app shows you what that covers before it asks. You can say no, and if you do, the same information still lands in your local log files, which is where the Recent warnings and errors panel reads it.
Analytics is a separate question with its own answer, and shipping a build that’s capable of collecting has never been the same thing as you agreeing to it; unless you did, nothing is sent.
The relay is the one place your bytes meet our hardware
The managed relay is the one place, though, where something of yours passes through hardware we run. It terminates encryption, so while it forwards your stream it can see it; it keeps no record of what went by and does nothing else with it, and the only thing counted is how many bytes crossed in your billing period. If that’s a boundary you would sooner not have at all, reaching your own server through a port forward, a reverse proxy or a VPN leaves us out of the path entirely.
Read the complete policy. This guide describes the architecture in practical terms. The Privacy Policy is the authoritative text on purposes, providers, retention and your rights.
Frequently asked questions
Does any of my media ever get uploaded?
No. The server streams to the clients you authorised and nothing copies your library anywhere. The relay is the single exception in the sense that bytes will pass through it while you’re watching from outside your network, and even then they’re forwarded and forgotten instead of stored.
Can I run Quven with every optional feature switched off?
Yes, and plenty of people do. Scanning, matching against the catalogues you configure, playback, transcoding and subtitles made from your own audio will all run without a single optional consent. What you’d give up is the managed relay, managed AI help on the titles nobody could match, and cloud translation.
If I turn analytics off on one device, is it off everywhere?
Yes. The consent is held on your Quven Account and read from there, so a server or a client that finds it withdrawn will stop collecting and discard whatever it had queued. There’s no per-device copy that can quietly disagree with the account.
Who can read a subtitle I send for translation?
Our cloud service passes it to the language-model provider and hands the answer back. They’re contracted on terms that should keep submitted text out of their training, the account-linked copy here is stripped after a week, and the shared cache behind it is keyed by a hash with no account attached to it.
What happens to all of this if I delete my account?
Deleting from Delete account in the portal removes the account-linked personal data and any avatar you uploaded, apart from whatever the law may require us to keep for a while. Aggregate figures that can no longer be traced back to you survive, because there’s nothing left in them to trace. Your files and your server are untouched by any of it; they were never ours to delete.