Security

Theatrium and your network

Theatrium runs inside your home network — often behind a VPN or on a locked-down VLAN. Here is exactly what it does on the wire, so you can decide what to allow.

Last updated 9 October 2026

The short version

Everything runs on your Apple TV, Google TV or Android tablet. There are no accounts, no cloud relay, no analytics or tracking SDKs, and no third-party code phoning home. Theatrium never accepts connections from the internet, never opens ports on your router, and never sends your smart-home data anywhere.

Inside your network

With Home Assistant, your Apple TV, Google TV or tablet talks directly to your server at the address you give it. Your access token is stored only on that device, in the Apple Keychain on Apple TV and encrypted with a key held in Android's secure storage on Android, and it is sent only to that server. Many Home Assistant servers use plain http on the home network, so Theatrium on Android permits it for the servers you connect it to; use https where your server offers it. With Apple Home, everything goes through Apple's HomeKit framework on the device — Theatrium never sees your HomeKit keys.

With Google Home on Android, Theatrium reads and controls your home through Google's Home APIs. That traffic goes directly between your device and Google over encrypted connections and never passes through us. Google asks for your permission on screen, and you can remove it at any time at myaccount.google.com/permissions.

The companion app

The iPhone/iPad companion pairs over your local network only. Pairing shows a 4-digit code on the TV; five wrong attempts burn the code. After pairing, the phone holds a long random token in the iOS Keychain, and the TV stores only a SHA-256 hash of it — neither ever crosses the internet. The link between phone and TV is a WebSocket on your LAN, like most local smart-home traffic; every command requires the paired token, and you can revoke any phone from the TV at any time (Settings › Connections › Phone Remote).

What goes out to the internet

Only read-only requests for public data, with no account or device identifier attached (the weather card sends an approximate location, and tempo lookups send the playing track’s title, as detailed on the privacy page): weather and rain radar (Open-Meteo, RainViewer), the news feeds you choose (e.g. BBC), public webcams (Windy), market and crypto quotes, song-tempo lookup (GetSongBPM), Last.fm if you connect it, and Apple's own services (App Store, Apple Music, Maps traffic). On Android there are a few more public sources: commute and traffic times (HERE), place search (OpenStreetMap), public art collections, a network speed test, and the Relaxing Video clips from theatrium.info. The privacy page lists every service and what it is sent, for each device. Block the internet entirely and those cards degrade — everything else keeps working.

What it never does

No inbound connections from outside your network. No UPnP or port mapping. No microphone or camera access. No telemetry. Crash reports exist only through Apple's own opt-in mechanism, or on Android through Google's own diagnostics sharing if you have turned it on. We could not sell your data even if we wanted to — we never have it.

Running it on a VLAN

Theatrium needs to reach your Home Assistant server (or your HomeKit accessories), and the companion app uses Bonjour (mDNS) to find the TV — so allow mDNS between the phone's and the TV's segments if they differ. On Android, Theatrium can find Home Assistant on your network the same way, and if you choose Spotify the device appears as a Spotify speaker, which also uses mDNS. Nothing else is required.

Questions

Ask anything: hello@theatrium.info. See also the privacy policy.