Privacy and data flow

Data stored locally

Brokerr stores provider instance settings and identity, encrypted credentials, profile configuration, selected scope, canonical observations, mappings, fingerprints, feature state, managed-list bindings, run operations, audit logs, and cached artwork. Run history can include media titles, provider IDs, progress, ratings, watched state, and diary dates.

Provider API traffic

The source sends reads to Plex server/account services. Targets receive only the reads and writes required for enabled profile features. Provider-specific opaque payloads stay inside the runtime and persisted audit data; the frontend receives a safe representation.

Enabling Plex Synchronize recorded history uses the connected account’s cloud activity and can retrieve historical titles and dates. Enabling Sync watched media missing from libraries can bring titles absent from the selected server into mapping and run history.

Hosted authorization

The hosted gateway temporarily holds an encrypted provider token bundle until the initiating instance claims and acknowledges it. The gateway does not receive Plex libraries, profiles, run operations, or synchronized media state. See the hosted gateway for lifetimes and logging controls.

AniBridge and artwork

AniBridge mapping releases are downloaded as shared catalog data; media account credentials are not sent to AniBridge. Artwork is fetched by the backend and served from a local cache so provider tokens are not embedded into browser URLs.

Operator responsibilities

• Protect backups and the master key.
• Use HTTPS and explicit trusted-proxy configuration.
• Review provider privacy policies and granted scopes.
• Limit access to run history because titles and playback dates can be sensitive.
• Disable recorded-history features when the additional history is unnecessary.
• Revoke provider authorization and disconnect the instance when decommissioning.