Privacy Policy
Rex is an app for managing and playing media content you have the right to access. This Policy explains when and why the Rex App, rexnow.tv, and Rex services process personal information, and the choices available to you. Servers you connect and third-party websites and services are also subject to their own privacy policies.
1. Who is responsible for processing information
Operating entity: Rex Studio. Privacy contact email: hello@getrex.tv. You may also contact the support team through “Settings → Feedback” in the app. Do not include passwords, access tokens, or complete payment credentials in feedback.
2. Information processed during use
- Media library and playback: Server addresses, connection credentials, media file names and paths, media identifiers, favorites, playback progress, and preferences you add are used to connect, organize, play, and resume viewing. Rex stores related settings and indexes on your device. It sends necessary requests to servers you choose when connecting, finding resources, and reporting progress. Server operators can also see your connecting IP address and corresponding actions.
- Content information and search: When loading film and television descriptions, posters, cast information, or searching for subtitles, danmaku comments, and opening or ending times, the relevant service receives media names, identifiers, episode numbers, search terms, language, and network request information. Media matching may also use file names or paths. Rex proxy services forward necessary queries to the corresponding data providers.
- Device and service sessions: To identify service sessions, process requests, and prevent abuse, Rex uses an app-generated device identifier, access credentials, and request information such as IP address, request time, API path, and system or app version. Service credentials are managed through the app's secure storage mechanism.
- iCloud sync: Once you enable sync, settings, preferences, and media records within its scope are uploaded to the private iCloud data space of your Apple account to restore and sync across your devices. Turning off sync does not automatically delete previously uploaded data; deleting data and turning off the switch are separate actions.
- External accounts: When connecting services such as Plex or Trakt, authorization takes place on that service's authorization page. Rex uses the returned credentials to provide the features you select. Trakt features exchange viewing history, favorites, or other account data according to the sync behavior you enable. You may revoke relevant connections in Rex or on the third party's account management page.
- AI subtitles: When you use external AI translation, the subtitles to be translated, languages, translation prompt, and necessary context are sent to the service address you configure using the API credentials you provide. Presets include OpenAI, DeepSeek, Moonshot, Zhipu, Tongyi Qianwen, Doubao, SiliconFlow, OpenRouter, Groq, xAI, and Gemini. The actual recipient depends on the address you choose; the relevant provider describes its retention and use rules. Local speech recognition and external translation are separate processes: a local model processes the media audio track, while the model resource service receives a download request when a model is downloaded.
- Feedback: The description, selected screenshots, device information, and diagnostic attachments you submit are uploaded to the support service to diagnose problems and respond. Attachments may contain media or server information; check them before submitting. Feedback conversations are not public forums, but authorized support personnel can view them.
- Extension modules: Modules you add or run may request network data according to their functions. The services accessed and purposes of data use depend on the module implementation. Learn about the author and permissions before installation, and use care when providing private addresses or access credentials.
3. Third-party services and network transfers
Rex uses cloud infrastructure to provide the website, APIs, and delivery of resources. Relevant providers process data needed for hosting, transmission, and maintenance. Apple provides system services and iCloud. TMDB, Plex, Trakt, subtitle and danmaku data providers, and the AI services you select process requests necessary for their respective features. Different services may be located in different countries or regions.
A list of third-party services and arrangements for cross-border processing of personal information will be added in the final version based on the actual recipients, purposes, and regions. Processing that requires separate notice or consent must be addressed before it occurs; this Policy does not replace necessary separate notice or authorization.
When you open an external website, it may use cookies or other storage. Rex's legal document pages themselves do not load third-party scripts, fonts, or analytics components.
4. Permissions and your choices
You can choose whether to add servers, sign in to third-party services, enable cloud sync, or use external AI. Rex uses corresponding system capabilities to access local network devices, choose files or screenshots, or save images. You can manage applicable permissions in system settings. Declining an optional permission affects features that depend on it.
You can remove local connections and records, clear caches, turn off related features, or revoke third-party authorization. Clearing local app data does not automatically delete information already stored on third-party servers, in iCloud, or by the support service.
5. Retention and deletion
Local settings and records are generally retained until you delete the corresponding content or clear app data. System caches may be cleared automatically. Keychain credentials have a different lifecycle from ordinary app files; uninstalling the app should not be regarded as deleting all credentials. Use the relevant service's operations or request channel to delete cloud data.
We retain personal information only for as long as necessary to achieve the stated processing purposes, except where law requires a longer period. In determining retention periods, we consider the actual needs of providing the service, resolving feedback, protecting security, handling disputes, and meeting legal obligations. Once a purpose is fulfilled, a retention period expires, or the statutory conditions for deletion are met, we will delete or anonymize the relevant information according to law. For information that must continue to be retained by law, we will restrict its use and access.
Server-side sessions, access logs, feedback text, attachments, and backups are kept only for the shortest period necessary for the above purposes. Once the purpose is fulfilled, or after you request deletion through the contact details in this Policy, we will delete or anonymize the relevant information, except where retention is required by law.
6. Your personal information rights
To the extent provided by applicable law, you may request access to, copies of, correction, completion, or deletion of relevant personal information, withdraw consent, or request an explanation of processing rules. Submit your request through the contact details in this Policy or in-app feedback, describing the data involved and what you seek. We may need to verify your identity first. If a request cannot be carried out or the information cannot legally be deleted immediately, we will explain why and what happens next.
We will handle your request promptly and respond with a result or progress update within 30 calendar days after verifying your identity. Where applicable law provides a shorter deadline, a different starting point, or other requirements, those rules govern. Identity verification requires only information necessary and proportionate to the request's risk; we will not ask for account passwords or complete access tokens. If more information is needed or the processing period is lawfully extended, we will explain the reason and expected completion time. A progress update does not replace completion required by law.
Withdrawing consent does not affect processing already carried out on that basis before withdrawal, but features dependent on that processing may no longer be available. If you disagree with the result, you may request a review at hello@getrex.tv or file a complaint with a competent authority or seek a legal remedy.
7. Security and minors
Rex uses access controls, encryption in transit where applicable, and credential protection measures to reduce the risk of information exposure. Protect your device, server credentials, and API keys, and review the security settings of services you connect.
If a personal information security incident occurs or may occur, including a leak, alteration, or loss, we will promptly take remedial measures, investigate its scope, reduce further harm, and report to competent authorities as required by law. Where the law requires us to notify you, we will use an available contact email, in-app notice, or another appropriate channel to explain the types of information involved, possible effects, actions taken, protective steps you can take, and contact details. Where individual notice is impractical, we will use a public notice or another method as permitted by law. Statutory exceptions to notice are handled under the relevant rules.
If you discover an information security issue involving Rex, contact hello@getrex.tv and avoid including working passwords, tokens, or unrelated personal information in your report.
Minors should use Rex under a guardian's guidance and access only age-appropriate content they have the right to access. A guardian who believes related personal information has been mishandled may contact us through the channels above.
8. Policy updates
We will update this page and show its effective date when features or data processing change. Material changes to processing purposes, methods, or categories of personal information will be separately notified as applicable, and consent will be obtained again where required.