Security

Theatrium and your network

Theatrium runs inside your home network — often behind a VPN or on a locked-down VLAN. Here is exactly what it does on the wire, so you can decide what to allow.

Last updated 15 August 2026

The short version

Everything runs on your Apple TV. There are no accounts, no cloud relay, no analytics or tracking SDKs, and no third-party code phoning home. Theatrium never accepts connections from the internet, never opens ports on your router, and never sends your smart-home data anywhere.

Inside your network

With Home Assistant, the Apple TV talks directly to your server at the address you give it. Your access token is stored only on the Apple TV and is sent only to that server. With Apple Home, everything goes through Apple's HomeKit framework on the device — Theatrium never sees your HomeKit keys.

The companion app Coming soon

The iPhone/iPad companion pairs over your local network only. Pairing shows a 4-digit code on the TV; five wrong attempts burn the code. After pairing, the phone holds a long random token in the iOS Keychain, and the TV stores only a SHA-256 hash of it — neither ever crosses the internet. The link between phone and TV is a WebSocket on your LAN, like most local smart-home traffic; every command requires the paired token, and you can revoke any phone from the TV at any time (Settings › Connections › Phone Remote).

What goes out to the internet

Only read-only requests for public data, with no account or device identifier attached (the weather card sends an approximate location, and tempo lookups send the playing track’s title, as detailed on the privacy page): weather and rain radar (Open-Meteo, RainViewer), the news feeds you choose (e.g. BBC), public webcams (Windy), market and crypto quotes, song-tempo lookup (GetSongBPM), Last.fm if you connect it, and Apple's own services (App Store, Apple Music, Maps traffic). Block the internet entirely and those cards degrade — everything else keeps working.

What it never does

No inbound connections from outside your network. No UPnP or port mapping. No microphone or camera access. No telemetry. Crash reports exist only through Apple's own opt-in mechanism. We could not sell your data even if we wanted to — we never have it.

Running it on a VLAN

Theatrium needs to reach your Home Assistant server (or your HomeKit accessories), and the companion app uses Bonjour (mDNS) to find the TV — so allow mDNS between the phone's and the TV's segments if they differ. Nothing else is required.

Questions

Ask anything: hello@theatrium.info. See also the privacy policy.