What stays local on a privacy-conscious media server

Where each piece of your data sits. Your files never move: the server reads the folders you point it at, on the machine you run, and that’s the end of it. What travels is your account (who you are, which servers you linked, and the things you’d lose on a reinstall). Everything past that is a switch you turned on.

What stays and what follows you

• Media: the server reads the folders you chose and serves them to the clients you authorised. Nothing else is done with them.
• Account and profile state: a sign-in, a list of linked servers, and per-person state such as watchlists, ratings, reviews and the position you stopped at in an episode. Reinstall the server on new hardware, sign in and it’s all where you left it. That’s the only reason any of it is held anywhere but your own disk.

Analytics

Product analytics is off until you grant it.

1. Open the portal, go to Privacy & data sharing and find the card Help improve Quven.
2. Switch it on or off there. The consent lives on your Quven Account, so one switch covers every server and client you own.
3. Withdrawing it empties the queue of events waiting to be delivered on the spot. Unlinking a server from the account does the same.

Once you say yes, an event can carry less than most people assume, because its shape is checked before anything is queued:

• It must be one of the catalogued names, such as scan.completed or playback.started, out of about fifty.
• Each field must be on that event’s own allowance.
• A measurement must be a non-negative number.
• A label must be a word from a closed vocabulary: hevc or av1 for a codec, uhd or fhd for a resolution, 1gb_10gb for a file size, relay or lan for the route.
• A label stops at 64 characters, and an event carries at most 24 of them.
• Free text isn’t a shape a label may take, and the validator throws out any value that reads like a path, an email address, a bearer token or a JWT.

So a title can’t ride along, even by mistake. From a scan we learn that it finished, how long it took and how many files it saw at each resolution.

Matching a title

To work out what a file is, the server asks the catalogues you configured, using what it can read from the name.

The AI matching card holds a separate switch, Enable AI matching, off by default. When a title can’t be named with confidence, the server sends what your library read of it, plus the candidate rows the catalogue already returned:

Kind	What is sent
Film	Title and year parsed from the names, what an .nfo beside it states, the title and description its container carries, the edition its name marks, the measured running time, the picture size, the audio and subtitle languages
Series	The above for each episode file (season, number, running time) and the episode titles the scan read while no catalogue described the series
Book, audiobook, album	Title and subtitle, authors, narrators or artist, year, language, publisher or label, ISBN, ASIN, barcode or catalogue number, series and position, subjects or genres, description, chapter, part or track titles, running time
Ebook	The opening of its text, past the front matter, up to 1,500 characters

Every kind also sends the library type, the language its titles are described in, and the names of the files and of the folders between your library’s root and the title. The root stays behind, and so does everything above it, where a folder named after you would sit. The audio never leaves, and neither does anything a recording says.

The quota row that counts your weekly allowance keeps a request identifier, a status and a fingerprint, so nobody here can read back which title you matched. Point the server at your own provider key and it talks to that provider directly, under their terms and never through us. Turning on a provider means taking on its privacy terms too, so read them first.

The same card holds Draw a cover when none is found, on a Max annual or Lifetime plan. When no catalogue covers a book or an album, audiobooks included, the server sends its title, creators, year, language, description and genres. A film or a series that neither the catalogues nor its own files picture sends the same, minus the creators and with its synopsis as the description, and a personal video library is left out. Quven Cloud keeps each picture it draws under a one-way hash of the work, with no account attached, so the next server that asks for that work gets the same picture and spends nothing.

Subtitles

• Generating from the audio is local. The server extracts the exact audio stream you picked into 16 kHz mono through FFmpeg, hands it to a local build of whisper.cpp and writes the result beside your file. No audio leaves the machine, and neither does the transcript. See generating subtitles locally.
• Translation travels, only when someone asks. The request carries the subtitle text, its language, the target language and a little public context when the title is matched: name, year, genres and the synopsis a catalogue already publishes. Your server signs the call with its own pairing identity, so which profile pressed the button doesn’t go along. The translation comes back as a subtitle asset on your disk. See AI subtitle translation.

Retention: the account-linked copy kept so a retry doesn’t cost the whole job is stripped after seven days. A second cache, keyed by a SHA-256 digest of the source text with its target language, format and model, lets a common subtitle skip the provider, carries no account at all and is deleted after ninety days.

Diagnostics

Crash and playback reports are scrubbed on your machine before anything leaves it:

• Absolute paths are hashed.
• An email or a token is redacted.
• A library name or a person’s name is replaced by a stand-in.
• The scrubber walks the whole event, so breadcrumbs, tags and attached request data cross the same boundary. Report names come from a fixed catalogue of operations, so a title can never become one.

The app shows what that covers before it asks, and you can say no. The same information still lands in your local log files, which is where the Recent warnings and errors panel reads it. A build capable of collecting isn’t consent: unless you agreed, nothing is sent.

The relay

The managed relay is the one place where something of yours passes through hardware we run. It terminates encryption, so while it forwards your stream it can see it. It keeps no record of what passed and does nothing else with it, and the only thing counted is how many bytes crossed in your billing period.

To keep us out of the path entirely, reach your own server through a port forward, a reverse proxy or a VPN.

The Privacy Policy is the authoritative text on purposes, providers, retention and your rights. This guide describes the architecture in practical terms.

Frequently asked questions