Security

Couchwave is a TV player built with your privacy and security in mind. Here's how it protects what you give it, everything it connects to, and how to check it yourself. For what we keep and why, see Privacy.

Your logins and keys

• Each TV makes its own key pair the first time Couchwave needs one. The private key is created and kept in the TV's secure key storage (Android Keystore, in hardware where the TV box has it) and never leaves the TV.
• When you add a TV service login, network drive password, VPN settings, or camera or Ring sign-in on couchwave.tv, your browser locks it to each of your TVs' keys before anything is sent (RSA-OAEP with AES-256-GCM). A login your provider sends is locked to your TV the same way.
• couchwave.tv stores only those locked copies, can't open them, and deletes each one once its TV has it.
• On the TV, saved passwords are encrypted with a key held in Android Keystore.

Your lists

My List, Resume watching, recent channels and your teams are shared between your TVs end to end encrypted, with a household key that only your TVs and your signed-in browsers hold. couchwave.tv stores the encrypted data but can't read it.

Recordings

Recordings are encrypted with AES-256 using a key that's protected by the TV's Android Keystore and never leaves that TV. They play only on the TV that recorded them.

Cameras

Your TVs talk to UniFi Protect directly on your home network, and to Ring directly over the internet. No camera picture, ring or motion alert passes through couchwave.tv.

App updates

Every Couchwave update is signed with RedLogic's release key. The app checks each download against the checksum published with it, and Android installs an update only if it's signed with the same key as the Couchwave already on your TV. To check a Couchwave APK yourself, its signing certificate's SHA-256 fingerprint is:

51:70:7D:5A:0B:D7:1D:62:53:0B:80:EA:84:53:91:50:AB:9D:69:94:05:11:C8:D5:B8:F3:A0:7F:88:42:5C:C1

Everything the app connects to

You can check this against your router or a network filter such as Pi-hole.

• couchwave.tv: your account, linking codes, updates, encrypted lists, and the locked settings above.
• Your TV service: its server, for channels, the guide, movies and shows, and the pictures it lists (often TMDB's image server, image.tmdb.org).
• Your provider's logo, once, if your provider set up your TV with their branding.
• ESPN (site.api.espn.com and ESPN's image servers): sports schedules, scores and team logos.
• Netflix's public Top 10 list (netflix.com): for the Top 10 row. No Netflix account is involved.
• Google (www.gstatic.com): a time check, so the app knows the correct date.
• On your home network: your UniFi console, network drives and media servers, if you use them.
• Ring (ring.com) and Google's notification service (googleapis.com, android.clients.google.com), only if you connect Ring.
• Your VPN provider's server, only if you add your VPN.

Your TV box's own system (Android TV or Google TV) makes connections of its own; those aren't Couchwave's.

Check it yourself

• Watch your router's traffic list while Couchwave runs: you'll see only the addresses above.
• Copy a recording off the USB drive and try to play it on a computer: it won't play.
• On your account page, open your browser's developer tools and look at the network requests when you add a network drive: the password isn't in them, only a locked copy. The code that locks it is couchwave.tv/seal.js.

Report a security problem

Found a problem? Tell us with the contact form (choose Security) or email support@couchwave.tv. We'll reply, and we won't take action against anyone who reports a problem in good faith, doesn't harm our users or their data, and gives us a reasonable time to fix it before telling others. Our security.txt has the same details.