Privacy Policy

Last updated: 2026-11-03

sofalet is not released yet. This page describes the app as it is built today, and it changes with the app. Where something is planned and not built, it says so.

This policy explains what the sofalet Android TV app (name.gpm.sofalet) does with data. It covers the app only. There is no phone app.

The short version: sofalet keeps what it reads on your TV, on your TV. It needs no account. It calls a few outside services to get a photo, the weather and, if you ask, a city, and it talks to a service of ours only if you write to us or sign in. There is no advertising in it. The play build also carries Google’s Firebase Crashlytics (crash reports) and Analytics (usage statistics), which it asks you about once, the first time you open it; the foss build has neither, nor anything else from Google.

There are two builds: play (Google Play) and foss (the family’s own F-Droid repository). Where they differ, this page says which.

Who is responsible

Gabriele Proietti Mattia is the data controller for the processing described here. Contact: apps@gpm.name.

Wallpapers

The home screen draws a wallpaper behind everything: a photo, an animated aurora (on Android 13 and later; a gradient below that), or a gradient. The aurora and the gradient are drawn on your TV and call nothing.

Photos are fetched, one at a time, every few minutes you choose, and the current one is kept on your TV so it shows at once on the next start. Your TV’s address reaches whoever serves the photo.

• foss: with your own Unsplash Access Key, pasted in Settings, sofalet asks Unsplash (api.unsplash.com) for random landscape photos, downloads them from Unsplash, and tells Unsplash when a photo is actually shown, as Unsplash’s guidelines ask. The key stays on the TV and is sent only to Unsplash. The photographer is named on screen and linked back to Unsplash.
• play: photos come through sofalet’s own service, sofalet-app.gpm.name, which keeps the Unsplash key so it is never on your TV. The app asks it for a batch of photos (optionally with the search words of the theme in use), downloads each one from Unsplash, and tells the service when a photo is actually shown, so that Unsplash can be told. The service sees your TV’s IP address, as any server does; it uses it only to keep abuse out, in memory, and stores nothing about you. If the service cannot be reached, this build uses the fallback below.
• Without a key, and as the fallback in both builds: Lorem Picsum, which needs no key and serves Unsplash photos. sofalet asks it for a list of photos and downloads one.

None of these requests carries your name, your address or anything else about you. What you search for in the weather, the apps you have and what is playing are never sent with them.

Themes

A theme sets a wallpaper, colours and layout, and is only data. Settings, Themes lists the themes on your TV and a catalogue written by the community. The catalogue is downloaded from sofalet.gpm.name only when you open the Themes screen, never at startup or in the background, and it is hosted on GitLab Pages, so GitLab sees the request like any web server does. Nothing about you is sent with it: no account, no identifier, nothing from your TV. If you install a theme, its file is downloaded from the same place and checked before use. Installed themes are kept on your TV and removed when you remove them or uninstall the app. Both builds use the catalogue.

Weather

The weather widget asks Open-Meteo (api.open-meteo.com, and geocoding-api.open-meteo.com to find a city by name). Weather data is by Open-Meteo, under CC BY 4.0, and is credited in Settings. Nothing is requested until you have chosen a city.

• Choosing a city. You type a name with the on-screen keyboard; that name goes to Open-Meteo’s search. No location permission is asked or used. The chosen city, with its coordinates, is kept on your TV.
• Each forecast sends the city’s coordinates to Open-Meteo. It refreshes about every 30 minutes, only while the home screen is showing, and the last answer is kept on your TV.
• Estimating the city from your internet connection. The first time you open the weather screen with no city, sofalet offers to estimate one from your IP address, and asks again only when you ask. Nothing is called until you accept.
  • foss: the estimate comes from GeoJS (get.geojs.io), which sees your IP address and answers with an approximate city.
  • play: the estimate comes from sofalet’s own service, sofalet-app.gpm.name, so that no third party sees your IP address. It reads the approximate location that Cloudflare derives from the address and answers with a city, without logging or storing the address. This build never calls GeoJS.

The network strip

The strip along the top says whether you are on Wi-Fi (with its signal), on Ethernet or offline, and whether the network has internet. It reads that from Android and sends nothing. It does not read the name of your Wi-Fi network, and no location permission is used.

Now playing

The Now playing widget shows what is playing in any app and lets you pause or skip. To list the active media sessions Android requires notification access, so sofalet declares a notification-listener service. It is used for that and for nothing else: sofalet does not read, store or show your notifications. You turn it on yourself in the system’s settings, after a screen in the app that says this, and you can turn it off there at any time.

What the widget shows (title, artist, artwork, progress) is read from the media session and drawn on your TV. It is sent nowhere.

Continue watching

This row is off by default. When you turn it on, sofalet asks for the TV listings permission (READ_TV_LISTINGS) and reads the “Watch Next” entries that your other apps publish to Android TV: title, picture, progress and where to resume. It reads them with no filter and keeps nothing of them: it queries them when the home screen appears and while it is showing, and sends them nowhere.

As a fallback for apps that publish nothing, sofalet also remembers the last ten items that Now playing saw (title, artist or subtitle, a small copy of the artwork, the app, the position and the time). That history is a file on your TV only, is never sent anywhere, and is deleted when you turn the setting off.

Nothing is queried and no permission is asked while the setting is off.

The Home button

Google TV does not let you pick another home screen. sofalet therefore ships an optional accessibility service, which only you can enable, in the system’s accessibility settings, after a screen in the app that explains it. sofalet never enables it for you.

It reacts to two things only: the Home key, which it answers by bringing sofalet to the front, and Google TV’s own home screen coming to the front, which it answers the same way. Android delivers every key press to such a service, and it ignores all of them except Home. It does not read what is on screen, what you type or anything else, it keeps nothing, and it sends nothing anywhere. You can turn it off in the same place at any time.

Modules

A module is a separate app made by somebody else that adds a widget or a row to the home screen. Modules are off until you turn each on in Settings, where sofalet lists them with the app that installed them. Only enabled modules are contacted, and only while the home screen is showing. What a module sends sofalet is drawn on the screen; sofalet sends a module nothing about you. Pictures a module points to are fetched from the address it gives (an https address or one of its own), so that module’s author can see that request. What a module does on its own is covered by that module’s own policy, not this one.

Your apps

The app rows are built from the apps your TV lists as launchable. sofalet asks Android for that list, filtered to the two launcher categories, and does not request the permission that lists every installed app. The list, and which apps you made favourites, stay on your TV.

Writing in, signing in and licences

Info has a screen for sending a report (a bug or an idea) and a sign-in. Both are optional and nothing is sent until you write something and press send, or ask for a code.

What a report carries

• What you wrote: whether it is a bug or an idea, the title and the description.
• What makes it fixable: the app’s version, your Android version, and your device’s manufacturer and model.
• Your email address, only if you type one. Without it a report is anonymous and cannot be answered.
• The IP address it was sent from, stored with the report and seen only by the moderator.
• A fingerprint of your device, made from its Android ID (Settings.Secure.ANDROID_ID), which the app reads without any permission. Android gives every app its own value. The service keeps only a keyed one-way hash of it, and uses it to keep abuse out: if a device is used to send abuse, the author can stop reports coming from that device, without knowing who you are. The same fingerprint accompanies the sign-in and the licence check.

No log and no screenshot are attached, and none can be. Never the advertising id, and no install id of our own.

All of this goes to apps-management.gpm.name, the family’s service, run by the author. It is not shared with anyone, not used to build a profile and not published.

Signing in

Signing in exists so that a licence granted to your address finds your TV. There are two ways to prove an address:

• an address and a six-digit code, sent to that address, in both builds, typed with the on-screen keyboard;
• Google, in the play build only, where the TV offers it (a Google TV may not). The app asks Google for an ID token and sends it to our service, which checks it with Google’s own keys and keeps your email address and your Google account id (an identifier Google gives your account). The app reads no name, no picture and nothing else from your Google account.

Once the address is proved the app keeps a key. It hangs from the address, not from your TV; it works for sofalet only; the service stores a one-way hash of it, not the key; it stops working after a year without use; and Sign out withdraws it at the service as well as on the TV.

The licence check. When you are signed in, the app asks the service whether your address holds a licence, each time it starts. The request carries the key and nothing else; the answer is a yes or a no, and “cannot say” (offline, or a key the service no longer recognises) changes nothing on your TV. Where nobody has signed in, nothing is asked.

Pro, and syncing between TVs

Everything in the app is free today. A paid Pro tier, which would keep your settings in step between TVs, is planned and not built. It would go through sofalet’s own service, and this page will describe it the day it exists.

Donations (foss only)

The foss build sells nothing. It shows a weekly reminder to donate, which is a local notification created on your TV (it needs the notification permission, and no server is involved), and Info shows donation links as QR codes. It stops for good once a donation is proved to us by an address. You can silence it in two taps. The play build has none of this.

What stays on your device

Your settings (including your two diagnostics answers in play), the city you chose, the favourites, the themes you installed, your Unsplash key (foss), the cached wallpaper and weather, the Continue watching history, and your sign-in key. Uninstalling the app removes all of it. Android’s backup may copy app data, as for any app that does not opt out.

Permissions

These are the permissions in each build’s merged manifest.

Both builds:

• INTERNET, to call the services above.
• ACCESS_NETWORK_STATE and ACCESS_WIFI_STATE, for the network strip (they do not read your network’s name).
• READ_TV_LISTINGS, asked only when you turn Continue watching on.
• name.gpm.sofalet.permission.BIND_MODULE, sofalet’s own permission that lets only sofalet bind a module.

foss only: POST_NOTIFICATIONS, for the donation reminder.

play only, added by Google’s libraries and not used by the app for anything of its own:

• com.android.vending.BILLING and com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE, from Google Play’s billing library (nothing is sold today).
• com.google.android.gms.permission.AD_ID, android.permission.ACCESS_ADSERVICES_AD_ID and android.permission.ACCESS_ADSERVICES_ATTRIBUTION, which Firebase Analytics brings so that it can read the Advertising ID (see Diagnostics). sofalet shows no advertising.
• WAKE_LOCK, from Firebase, so a crash or statistics report can be sent in the background.
• USE_BIOMETRIC and USE_FINGERPRINT, from a Google library, never used: sofalet has no biometric prompt.

The accessibility and notification-listener services described above are not permissions the app can grant itself: you enable them in the system’s settings. There is no location permission.

Diagnostics: play build only, on until you say otherwise

The foss build has no diagnostics at all: it does not link Firebase or any Google library, and nothing in it sends crash reports or statistics. If it crashes, nothing is sent: the only way anything about a problem reaches Gabriele Proietti Mattia is the report you write yourself.

The play build carries two of Google’s Firebase services, and both start on. The first time you open the app it asks one question, on the TV, with the two switches in it and what each sends; you can turn either off right there with the remote, and that takes effect before a session has been recorded. They stay in Settings, Diagnostics afterwards.

• Crash reports. If this is on and the app crashes, Firebase Crashlytics receives the stack trace, the device model, the Android version, the app version and an installation identifier Crashlytics generates. It does not include what you wrote, your city, your apps or what is playing.
• Usage statistics. If this is on, Firebase Analytics records which features are used (which screen was opened, which setting was changed), together with the identifiers it collects by default: an app-instance identifier, the device model, the Android version, a coarse region from the IP address, and the Android Advertising ID, a cross-app identifier Google gives your device. sofalet shows no advertising; the identifier comes with Analytics, and the Play Console is told so. It never records what you wrote.

Turning a switch off stops that collection from then on. What was already sent is held by Google under its own terms (Firebase privacy).

What the app never does

• No account that you need, and no sign-up.
• No sale or sharing of data with anyone, apart from the services named on this page that carry out the requests above.
• No advertising, and no tracking of what you do across other apps. The only identifier of that kind is the Advertising ID that Firebase Analytics collects in the play build while usage statistics are on (see Diagnostics).
• No reading of your notifications, of the screen, or of what you type.
• No sending of your apps, what you watch or what is playing, to us or to anyone.

Legal basis (GDPR)

For readers in the EU/EEA and the UK: the reports you send and the address you prove rest on your request and consent; you may ask for them to be deleted at any time. The play build’s diagnostics rest on your consent (Article 6(1)(a)), given by leaving the two switches on after the question the app asks before you use it; withdraw it by turning them off in Settings. The calls to Unsplash, Picsum, sofalet’s photo and location service, the theme catalogue, Open-Meteo and GeoJS rest on your use of the features that need them, and you can avoid each by not choosing it. Keeping the IP address and the device fingerprint with a report, to keep abuse out, rests on a legitimate interest (Article 6(1)(f)).

Retention

A sign-in key stops working a year after you last use it, and is withdrawn the moment you press Sign out. Reports are kept while they are useful: an open one until it is answered, a closed one as the record of a decision, with the IP address and the device fingerprint for as long as the report is kept. Crash reports and statistics sent to Firebase are kept by Google under the Firebase terms, not by us. The photo, weather, city and Continue watching data on your TV stay there until you change or turn off the feature, or uninstall.

Your rights, and deleting your account

Under the GDPR you may request access to, correction of, or deletion of your personal data. To have your address and everything that hangs from it deleted, follow Delete your account, or write to apps@gpm.name from the address you signed in with. It is done within 30 days. You retain the right to lodge a complaint with a supervisory authority. The outside services keep their own records of the requests they receive; ask them.

Children

sofalet is not directed at children under 13 and knowingly collects no data from them, or from anyone.

Changes

Material changes will be published on this page with a new date, and significant ones will be noted in the app’s changelog.

Last updated: 2026-11-03