WWPlayer

Privacy Policy

Last updated: October 8, 2026

This policy explains how the WWPlayer Windows desktop app, account and configuration sync, metadata services, viewing reactions, and the NEXUS website and sharing services handle data. It also explains the language preference used on this website.

Scope

This policy is maintained by the WWPlayer developer and applies to the app and related services described above. Media servers, cloud drives, WebDAV, Trakt, module endpoints and other services you add are independently operated. Their providers' privacy policies also apply to their data processing.

Data stored on your device

Depending on the features you enable, your device may store:

Account sessions and the metadata installation private key are protected by Windows secure storage and are not given to webpage scripts. This does not encrypt all other settings, exports or caches. Protect your device, Windows account and backup files.

WWPlayer accounts

During registration, sign-in, email verification, password recovery and profile maintenance, the account service processes your nickname, email address, password verification data, email verification status, stable account identifier, avatar, sessions and related timestamps, IP addresses and client information. These are used for authentication, profile maintenance and abuse prevention. Passwords are stored as hashes. Email codes are verified using hashes and expire after 10 minutes. Sending email involves the mail provider processing the recipient address, code and message.

An avatar you choose to upload is re-encoded on your device as a 256 × 256 PNG before it is sent to the account service. Your WWPlayer password is used only for account authentication; it is not stored in player settings or used as a configuration backup key.

The desktop main process holds account sessions and uses them only for requests requiring WWPlayer identity, such as account, NEXUS and viewing reaction requests. Sessions are not sent to media servers or ordinary metadata providers. Account sign-in is separate from media server sign-in and does not grant Microsoft Store purchase entitlements.

Account configuration sync

When you upload your configuration, the account service receives settings, servers and connections, homes, lists, modules and parameters for restoration across devices. A snapshot may contain source addresses or folders, media server passwords or tokens, Trakt authorization tokens, TMDB or other API keys, and other credentials stored in app settings. Before uploading, confirm that you want these contents stored by the account service.

Local playback history, Store licensing, installation identity, diagnostic logs, caches and media files are not uploaded with account configuration. WebDAV backup login credentials, personal backgrounds and device-specific folders for player programs, captures and caches are also excluded.

Configuration is transmitted over HTTPS and encrypted on the server using a separate key. This is server-managed encryption, not end-to-end encryption: the service can decrypt your configuration. Compression and Base64 encoding do not themselves provide encryption. No additional configuration password is required.

On the first successful sign-in for each account on each device, the app reads and restores the current cloud configuration once. If no cloud backup exists, local settings remain and defaults are not automatically uploaded. You can subsequently upload or confirm a restore manually; local edits are not continuously overwritten. Existing older-format account backups are not automatically restored or overwritten by new uploads.

WebDAV configuration backups

WebDAV configuration backup uploads or downloads a JSON configuration file using the folder, username and WebDAV login password you specify. Only WebDAV credentials are used. There is no separate backup password, and no backup key is derived from your login password.

The backup has no additional file encryption and may contain media server passwords, tokens, Trakt authorization tokens and API keys. The WebDAV provider or anyone else authorized to read the file can read its contents. Access protection depends on the provider's permissions and connection method. Prefer HTTPS.

WebDAV backup login credentials, local playback history, Store licensing, installation identity and media files are excluded. Changing the WebDAV login password does not change an existing backup. Disconnecting or uninstalling WWPlayer does not delete remote files. Older backups encrypted with a separate password are not automatically decrypted or deleted by the new version.

Metadata services

Online queries may send search terms, media titles, years, seasons and episodes, languages, public media IDs and subtitle search criteria to the WWPlayer metadata service. These requests provide metadata, images, ratings, trailers, streaming availability and online subtitles. The service may obtain information from TMDB, TVDB, Fanart.tv, OMDb, Trakt, Douban, IMDb, TheAudioDB, MusicBrainz, Cover Art Archive, OpenSubtitles or SubHD. If you explicitly configure official TMDB credentials, corresponding requests go to the official API according to your settings.

Installation authentication sends a random installation identifier, public key, app version and platform information. The server applies keyed hashing to the installation identifier and IP address and stores the public key, version, authentication state, connection times and per-minute summaries of request types, results and counts. This supports authentication, rate limiting, abuse prevention and troubleshooting. Hashing is not complete anonymization. Request activity summaries are cleared according to a 90-day retention period.

Public query caches are shared by query parameters and are not used to build account viewing profiles. General metadata is cached for 90 days by default, images for 365 days and subtitle search results for 7 days. Some results have shorter lifetimes, updates reset expiry, and capacity limits can cause earlier cleanup. Subtitle files are not stored in the gateway cache; the client temporarily stores downloaded files for playback.

Ordinary metadata requests do not upload media files, media server passwords or tokens, cloud drive authorization or Trakt authorization credentials. Account configuration sync is a separate service that may receive those configured credentials. Viewing reactions process WWPlayer identity as described below.

Viewing reactions

You can view a title's reaction totals without signing in. When a signed-in user reads their own reaction or submits a choice, the metadata service receives their WWPlayer session and verifies identity with the central account service.

The service stores one current emoji and update time per account identifier, movie or series type, and TMDB ID to count distinct participants. Changing a reaction replaces the previous choice; repeated submissions do not add votes. These records are stored persistently and are not removed with metadata cache cleanup.

Public results show only aggregate emoji counts, not voting accounts, email addresses or sessions. A user's current choice is returned only to that verified user. Selecting a draft, displaying existing rankings or enabling automatic animations does not submit a reaction or upload local playback history.

NEXUS browsing and sharing

Ordinary NEXUS browsing, downloads and anonymous submissions do not create anonymous accounts, issue login cookies or request the central account service. Submissions store files or text, names, descriptions and optional attribution. Homes, modules and lists also store versions, styles and applicable optional screenshots. Text shares do not have a version. Anonymous attribution is not verified identity, and anonymous works cannot be self-managed or updated.

Publishing and managing shares through the app uses your existing WWPlayer account. NEXUS verifies the session through the central account service and stores a stable ownership reference, public sharer ID, necessary profile data and operation records. It does not create a second password system. The public ID is optional; changing it updates attribution on your works without changing your central nickname. Email addresses, sessions and stable account identifiers are not public.

New submissions are public and can be browsed and downloaded. Older unlisted works remain accessible to anyone with their share code. A share code is not an access password for a private file. Administrators can view submitted source files, text, screenshots and related records.

App sharing removes private source bindings, filters recognized sensitive fields and credentials, and does not attach your complete account configuration, caches or module runtime records. Home files may include redacted module code. Automatic processing cannot identify every private detail you manually place in code, descriptions or images. Review content before publishing.

Screenshots are re-encoded, stripped of attached metadata and proportionally limited to 1280 × 720. Names, addresses and credentials visible in the image are not automatically obscured. NEXUS list previews request public information and size-limited images through the metadata service without exposing backend credentials. Your device records a work's source, version and destination for loading and syncing.

New shares require no manual review and become public after format validation. Updates immediately replace the previous files; historical versions are not offered for download. Submission, version change, takedown and existing historical review records are retained. A takedown stops public access but does not immediately delete every backend record or backup, and cannot recall copies already downloaded by others.

The administration interface is available only to existing administrator accounts. It uses HttpOnly, host-scoped session cookies and revalidates sessions and permissions. Ordinary browsing does not create a login identity through this mechanism.

After the player successfully imports a NEXUS resource, NEXUS receives the resource ID, existing software installation identifier and registration time to deduplicate installation counts and determine popularity rankings. Repeated imports or syncs of the same resource from the same installation count once. Web browsing and file downloads do not count. These statistics do not require sign-in or upload account information, server credentials or playback history. Public pages show aggregate counts, not installation identifiers.

Third-party services and network requests

Recipients and hosting infrastructure generally receive IP addresses, request times, destinations and client network information. Enabled online features may make requests during startup, refresh, playback or background updates, not only when you click. The software proxy follows your network settings and local address bypass rules; the separate TMDB proxy setting remains available. Your chosen proxy provider may also process destinations and connection information.

Logs, storage and security

App diagnostic logs are stored locally and are not automatically uploaded. The developer receives logs, screenshots or issue details only when you submit them. Logs may include server addresses, media requests, component versions and errors. Inspect and redact private information before sharing.

Account, metadata and NEXUS services record necessary request times, addresses, IP addresses, client information and results for operation, security and troubleshooting. Hashing IP addresses for installation authentication does not mean all infrastructure logs avoid raw IP addresses. Authentication headers and sensitive request contents are redacted, and records are not used for advertising tracking or cross-service behavioral profiling.

We use HTTPS, access controls, credential isolation, operating-system secure storage and protected service backups. HTTP services you configure, or settings that ignore certificate validation, may reduce transport protection. Protect local configurations, ordinary exports, modules and WebDAV backups.

Retention and deletion

Local data usually remains until you delete the relevant sources or content, clear caches or remove app data through Windows. Uninstalling alone may leave local data. Removing a source does not delete data on the corresponding media server, cloud drive or third-party service, or withdraw previously uploaded backups.

Account profiles, cloud configurations and installation authentication records are retained as needed to provide accounts, restore settings and secure services. Viewing reactions, NEXUS works and review records do not follow ordinary cache expiry. Access-controlled service backups support recovery and are not public historical downloads. Backup cleanup and deletion of online records may not finish at the same time.

Signing out or clearing local login state does not close your account or delete cloud configurations, viewing reactions or NEXUS works. The current client has no self-service account closure, cloud configuration deletion or reaction record deletion entry. Request correction, deletion or takedown through the contact channels below. Mention older-format account backups if you want those addressed too.

Your choices and contact

You can choose not to register, upload settings, submit reactions or publish NEXUS works, and can export files locally instead. NEXUS attribution and screenshots are optional. You can disconnect online accounts, remove sources, turn off online features, clear caches and delete remote data through your own WebDAV or third-party service.

For requests concerning account information, cloud settings, installation records, viewing reactions or NEXUS correction and takedown, contact carrot@wwplayer.com or the WWPlayer Telegram community and privately identify your message as a privacy request. We verify ownership and explain the scope of processing and records that must be retained for legal or security reasons. Verification does not require your password or access token. Do not post email codes, private addresses, complete logs or other sensitive information in a public group.

See the Terms of Use for NEXUS sharing requirements.

Website language preferences

This website reads your browser's preferred languages and, when none matches Chinese or English, your browser-reported time zone to select a language locally. A manual selection is stored in browser local storage under wwplayer-site-language and can be carried in the page URL as a language parameter. The language-selection code does not transmit your browser language or time zone to WWPlayer services.

You can switch languages at the top of the website. Clearing this site's local storage removes the remembered choice. Browser storage restrictions do not prevent using the explicit language links.

Policy updates

When product features, data processing or applicable requirements materially change, we update this page and its date and communicate important changes through app release notes or community channels.