How your account and keys are protected.

Passwords and sessions

• Passwords are stored as scrypt hashes with a per-user salt, never in plain text.
• Sign-in uses a secure, HTTP-only session cookie. Sessions expire, and signing out ends them.
• Sign-in and account creation are rate-limited to slow down password guessing.

Keys and logins

• Debrid, MDBList, RPDB, TMDB and scraper keys, IPTV logins and MyAnimeList tokens are kept with your account and encrypted at rest.
• They are used only to reach the service they belong to, and they are never placed in your addon install URL.
• The TV app never receives your RPDB or TMDB keys back from the server; it can only save new ones.

Your install URL

• Your Stremio/Nuvio manifest URL is a long random token. Anyone who has it can use your setup, so treat it like a password.
• If it leaks (a shared screenshot, a public chat), rotate it from the Dashboard or Configure. The old URL stops working immediately.
• Each Premium profile has its own install URL, rotated separately.

LiteAIO TV

• A TV signs in with a short pairing code that only someone signed in to your account can approve, at liteaio.com/link. Codes are short-lived.
• You can see and revoke paired TVs at liteaio.com/link or in the TV’s Settings. Revoking signs that TV out.
• Install the app only from liteaio.com/apk or liteaio.com/app, and update it from its own Settings. Updates come from liteaio.com over HTTPS.
• Jellyfin and Plex logins, and the app’s proxy settings, are stored only on the TV.

The website

• Everything is served over HTTPS.
• Pages send a strict content security policy: they can only send requests to liteaio.com, and other sites can’t embed them.
• Unsubscribe links in our emails are signed, so they only work for the account they were sent to.
• Payment webhooks from Whop are signature-checked before they can change a plan.

What we log

• Operational logs: errors, billing events and service health.
• Daily usage counts per account (streams, catalogs, Live TV requests), not a record of what you watched. What the TV app keeps to power Continue Watching and My List is described in the Privacy Policy.

Payments

Paid Premium goes through Whop. Card details are entered on Whop and never reach LiteAIO. Free trials and the free-month offer don’t need a card.

Deleting your account

Delete your account from Dashboard → Account (password and confirmation required). Your data, install URLs and paired TVs are removed right away. See the Privacy Policy for backup rotation and billing records.

Reporting a problem

Practical tips: use a password you don’t use anywhere else, keep your install URL out of public chats and screenshots, and rotate it if you think it has been seen.