Companion Remote privacy policy

Last updated 12 October 2026, for version 1.0.0.

Companion Remote is published by PGH Holdings (Pty) Ltd, which is responsible for this policy. Contact details are at the end of this page.

Companion Remote controls your Apple TV over your local network. The app contains no adverts, no analytics, no tracking and no crash-reporting service. It does not require a Companion Remote account, and there is no Companion Remote server: the app has no developer backend of any kind.

Information the app uses

The app looks for compatible devices on your local network. It reads their advertised names, network addresses and service information so you can choose a television and connect to it.

When you pair, the app uses the PIN shown by your Apple TV to establish pairing credentials. It gives the television a name for the pairing that contains your phone's model, so the pairing can be identified in Settings on Apple TV and removed there. It saves those credentials, the television's name and its last known local address in app-private storage on your Android device. The PIN itself is not saved. Pairing credentials let the app reconnect without asking you to pair each time. Your selected remote mode, your Settings choices and the last connected television are also saved locally.

Remote commands and text you choose to send travel directly to your paired Apple TV over encrypted connections. The app can receive the television's app list, focused text-field content, playback state and any media details the television makes available. This is used to display and operate the remote. The app does not save a viewing history or a history of text you send.

After a successful app launch, the app saves that app's identifier in a bounded list of recently used apps for the selected television. This list stays in app-private storage on the phone and is not sent to the developer or a catalogue. Choose Clear recent apps in Apps to erase it, or Forget the television to erase its list and saved pairing from the phone. Clearing Android app storage or uninstalling also erases all local recent-app lists.

Typing on the television

When Synchronise text input is on, the app reads the text already in the television's focused field so you can edit it, and each change you make is sent as you type. A field the television marks as secure is masked and is never prefilled with text read from the television. The app removes its references to secure text when the field loses focus or is replaced, when UI input stops, and when the connection or session closes. Pending edits are discarded at those boundaries and are not replayed on another field or connection. The runtime uses immutable strings, so the app cannot guarantee immediate erasure of every copy from system memory. The app does not save or record text in either case.

For ordinary fields, the app can retain the current text in memory across refocus and reconnect so an old television report does not replace your edits. This text is never saved to storage. Forgetting the television, choosing another television, or a change in the field's secure status discards it. After a full session teardown, the app keeps only the field identifier, not a copy of its text.

The Now Playing notification

When Show Now Playing notification is on and you have allowed notifications, leaving the app while your television plays keeps the connection open and shows what is playing, with its controls, in a notification. The picture it shows is requested from the television over the same local connection and held in memory only; the app does not download artwork from the internet. The connection and the notification end when playback stops or stays paused for five minutes, when the connection closes, when you return to the app, when you close the app from your phone's recent apps, or when you turn the setting off. Dismissing the notification ends them too, on a phone that lets you dismiss it: some do not allow a notification like this to be swiped away, and on those the actions above are how you end it.

On the lock screen, Android shows what is playing in its media player. That player follows Android's media settings, not the setting that hides notification content, so the title can appear there even when other notifications hide theirs. Turn off media on the lock screen in Android's settings if you do not want it shown there.

These connections stay on your local network. The app restricts them to local addresses in code: a television at a public internet address is refused rather than contacted. Local discovery and network addressing remain visible to equipment on your network, as they are for any device that advertises itself there; that is not the same as the encrypted remote-control session.

How pairing credentials are protected

Saved pairing credentials are encrypted with a key held in the Android Keystore on your device. The key does not leave the device and cannot be extracted by the app. Credentials saved by an earlier version of the app were stored unencrypted; the first time this version opens, it encrypts them, verifies that it can read them back correctly, and only then removes the unencrypted copy.

Encrypted material is bound to the entry it belongs to, so a credential copied out of the app's storage into another entry cannot be decrypted there.

The app disables Android backup and excludes both pairing stores from Android cloud backup and device transfer, so credentials are not copied to another device. Protect your phone with its screen lock and keep Android updated.

Optional catalogue search

Streaming availability information is provided by Streaming Availability API by Movie of the Night.

Search is optional and requires internet access. Remote control does not use it and continues to work on the local network alone. Nothing leaves your device for a catalogue unless you submit a search.

This app carries no catalogue of its own and has no developer-operated catalogue service. A catalogue search happens only after you enter your own Movie of the Night API key in Search settings. Without a key it searches no catalogue at all, and the search panel says so.

Your own Movie of the Night key

With a key saved, your query and selected country go over HTTPS to api.movieofthenight.com, and nothing else about your television. The key is sent only to that service, in a request header. Its account, plan and quota apply separately.

Automatic country selection uses the phone's region setting. If that is not a country, no country is chosen for you: catalogue searches are not sent until you pick one on the search panel, and the panel says so. Sending a title to your television's own Search needs no country and still works. A country you choose on the search panel overrides automatic selection. The mobile network's country and the SIM's country are not read. No location permission, phone identifier or external IP-location service is used.

One search can make a second request, with a different country

When the catalogue has no Disney+ for your selected country, and Wider Disney discovery is on, which is its default, the app sends your query once more to the same service, with the same key, and the country GB in place of yours. It does this so it can tell you whether the title is on the international Disney+, which most countries outside the United States share.

That second request carries nothing about you or your television that the first did not, and the country in it is a fixed value rather than your own. Results found this way are labelled in the app as coming from another country's catalogue and are not verified for yours. Turning Wider Disney discovery off in Search settings stops the second request being made at all.

What your television has is decided on the phone

Which services a search offers, and which results it shows, are decided on the phone from the list of applications your television reports. That list, and anything derived from it, is never sent to a catalogue. No request carries it, or a filter built from it, so a catalogue is not told what you have installed. Results for applications your television does not have are removed on the phone, after the reply arrives.

What the catalogue provider receives, and what it never receives

The selected provider receives your internet address as part of the connection and handles the request under its own privacy practices. Companion Remote does not control any provider's server logs or retention.

The app sends no pairing credentials, no television name or address, no app inventory, no playback history and no advertising identifier to any catalogue. Results stay in memory. The app saves no search history and downloads no catalogue images. Redirects are refused on every internet request, so no host other than those named above is contacted.

The API key is issued to a provider account and may identify that account to the provider. The provider may infer an approximate location from the internet address it receives; a country preference is not a GPS reading. Ask the provider about its own records, retention and deletion.

Opening a result

Opening a result sends its content link to the selected television and may start playback. A published Apple TV or regional playback link is preferred where one is available and valid. Known campaign and referral fields are removed from the link; content identifiers and Netflix's fixed entry-point value (source=topshelf) are kept. That value does not identify you or your device. The streaming app handles access and playback under its own practices. Launch status and any error code stay in memory and are not saved or sent anywhere.

Tapping a catalogue attribution opens that provider's site in your browser, where its own privacy practices apply. The app embeds no browser and no tracking code.

Optional Plex search on your own server

Plex search needs the server's address and a token that you supply. You can enter the server's local IP address with its server code, copied from Plex Web. The app then opens an encrypted connection to that address which carries no request and no token, checks that the server presents Plex's publicly trusted plex.direct certificate for that server code, and saves the server's plex.direct name in its place, not the certificate. The token is not sent to a server whose code differs. Save and test connects directly to the server, checks authorised library access and saves its identity. The server address must be on your local network: a plex.direct name is reached at the address written in it, without a DNS lookup, every address any other name resolves to is checked, and the app does not use Plex cloud discovery or relay services. Searches send the query and the token only to that server, with the token in a header.

Requests use HTTPS with normal certificate and hostname verification. The token is never sent over plain HTTP: an address beginning http:// with a host name is refused and never contacted. Redirects are not followed.

The token can identify a Plex account or server user to the configured server. The owner of that server controls its request logs and their retention.

Plex-only searches contact no public catalogue. Selecting Plex together with streaming services sends the query separately to each source. Returned Plex titles and item identifiers stay in memory. A Plex link sent to the television contains the server and library item identifiers and never the token; the Plex app on the television uses its own existing access.

Your Plex token is encrypted with an Android Keystore key and excluded from backup and device transfer. The server URL and its name are saved privately on the phone. Removing the Plex server in Search settings deletes its saved credentials, URL and name from the phone. That does not revoke the token at Plex; use Plex's own account controls to revoke it.

The diagnostic record

The app can keep a short record of what it did, to help explain a problem. It is off until you switch it on in Help and privacy, keeps nothing while it is off, holds only a limited number of recent entries, and is emptied when you clear it or switch it off.

The record never leaves your device on its own. If you copy it and send it to someone, that is your choice and your copy. It is written so that it carries no PIN, key, token, credential, password or search text, and that is enforced by an automated check on every build.

Storage and deletion

Everything the app keeps is on your phone. There is no server-side copy to request deletion of, because there is no server.

• Forget a television to remove its saved remote and media pairings from this phone.
• Remove a saved key or Plex server in Search settings to delete it from the phone.
• Clear the app's storage in Android settings, or uninstall the app, to remove everything at once.

Forgetting a television does not remove the matching pairing entry held by the Apple TV itself. Use Settings on Apple TV if you want to revoke access there as well. Removing an API key or Plex token here does not revoke it at the provider; use that provider's account settings.

Requests already made to a catalogue provider, purchase records held by Google Play, and any support correspondence are held by those parties under their own processes.

Permissions

The app requests these six permissions:

• INTERNET, for the connection to your television and for optional catalogue search.
• ACCESS_NETWORK_STATE, to notice when the network returns so the remote can reconnect promptly.
• CHANGE_WIFI_MULTICAST_STATE, so local discovery can receive the multicast replies that televisions answer with.
• POST_NOTIFICATIONS, to show the Now Playing notification. Android asks you first, and the app asks only when you tap Allow notifications.
• FOREGROUND_SERVICE and FOREGROUND_SERVICE_CONNECTED_DEVICE, to keep the connection to your television open while the Now Playing notification is showing, and only then.

Android's support library adds a seventh, which the app declares and holds itself: com.pghholdings.companionremote.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION. Only an app signed with the same key can hold it, and it exists so that the app's own internal receivers accept messages from the app alone. It gives the app no access to anything.

Copies installed from Google Play carry an eighth, com.android.vending.CHECK_LICENSE. Google Play adds it, together with a check that runs when the app opens, to confirm that the app was installed from Google Play; if it was not, you are asked to get it from Google Play. The check works through the Google Play Store app on your phone, and Google Play's own privacy practices apply to it. Companion Remote's own code does not use this permission.

The app does not access your microphone, camera, contacts, files or phone identifiers. The app does not request Android location permission or read GPS location. An optional catalogue provider receives your internet address and may infer an approximate location from it.

Other software and services

Your chosen Android keyboard handles text entry under its own settings and privacy practices. The television, and the apps running on it, handle the commands and text they receive under theirs.

Google Play handles the app's purchase and distribution separately from the remote's local connections. Companion Remote contains no payment code and never receives payment-card details.

Children

The app is a remote control for a television and is not directed at children. It has no social, messaging or user-generated-content feature. An optional API key or Plex token may identify a provider account to that provider; an internet host may infer location from the connecting address.

Changes to this policy

If this policy changes, the date at the top changes with it. A copy of the policy is also bundled inside the app under Help and privacy, so it can be read without an internet connection. Where the two differ, this page is the current one.

Third party names

Disney+, Netflix, Prime Video, Plex, DStv, Crunchyroll and YouTube are third party names used descriptively as text. No provider logo, wordmark artwork or brand colour is used.

Companion Remote is an independent app and is not affiliated with, sponsored by or endorsed by Apple Inc. Apple TV is a trademark of Apple Inc. Android and Google Play are trademarks of Google LLC. Netflix is a registered trademark of Netflix, Inc.

Contact

Companion Remote is published by PGH Holdings (Pty) Ltd. For questions about this policy or about the app, email pgh-holdings-apps@proton.me.

The app itself sends nothing to PGH Holdings. If you email, your message is used to answer you. Please do not send pairing codes, keys, tokens or a full log; they are never needed.