Privacy Policy

Last updated: August 2026

The short version

DashTheater stores the account you create and the links and preferences you save. It does not record what you watch, where you drive, or which services you open. There are no advertising or tracking cookies, and your data is never sold. You can delete your account, and everything attached to it, yourself at any time.

1. What we collect

Only what the Service needs to work:
  • Your account — email address, an optional display name, the date you signed up, and your password stored only as a bcrypt hash. We never store or have access to your password itself.
  • What you save — the custom links you add (their label and web address) and your tile preferences: which tiles you have favorited, hidden, or reordered.
  • Sign-in security records — when a sign-in attempt fails, we record the email address used and the time, purely to limit repeated password guessing. Successful sign-ins are not recorded.
  • Password reset tokens — stored only as an irreversible hash, valid for one hour and usable once.

2. What we don't collect

We do not collect your location or any data from your vehicle. We do not record what you watch or listen to, which tiles you open, or which third-party services you visit from the launcher. We do not build advertising profiles, and we do not sell or rent your information to anyone.

3. Cookies and on-device storage

There are no advertising or cross-site tracking cookies. What exists is:
  • A session cookie, set only when you are signed in, so the Service knows it is you. It is removed when you sign out.
  • A theme preference saved in your browser's local storage, so the app reopens in the light or dark mode you chose. It stays on your device.
  • An offline cache holding pages, logos, and the bundled games, so the launcher still opens when your car has no signal. It stays on your device and clearing your browser data removes it.

4. Analytics

We use Vercel Analytics to understand how the Service is used in aggregate — page views, rough device type, referring site, and country. It does not use cookies, does not identify you, is not linked to your account, and cannot follow you to other websites.

5. Where your data is held

Your account data is stored in a PostgreSQL database hosted by Neon on Amazon Web Services in Ohio, United States, and is encrypted in transit. The Service itself is hosted by Vercel. Password reset emails are delivered by Resend, which receives your email address and the reset link for that purpose alone. If you are located outside the United States, using the Service means your information is processed there.

6. Services you open from the launcher

DashTheater is a launcher: its tiles take you to third-party services such as streaming, music, and gaming sites. Once you open one, you are on their website and their privacy policy applies, not this one. We receive nothing about what you do there. Any username or password for those services is entered on their own site — never through DashTheater, and we never see it.

7. How we protect your account

Passwords are hashed with bcrypt and are unreadable to us. Password reset links are stored only as a hash, so even a database breach could not be used to seize accounts. Repeated failed sign-ins to the same account are throttled. All traffic is served over HTTPS.

8. How long we keep things

Your account and everything attached to it are kept until you delete them. Failed sign-in records are erased as soon as you sign in successfully, and are otherwise discarded within fifteen minutes. Password reset tokens expire after one hour, and are invalidated as soon as one is used.

9. Your control over your data

You can add, edit, or remove your saved links and reset your tile preferences at any time. You can change your password from the Account page, which is also where you can delete your account. Deleting it immediately and permanently removes your account, your saved links, your preferences, and any outstanding reset tokens. This cannot be undone.

10. Children

The Service is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has created an account, contact us and we will remove it.

11. Changes to this policy

We may update this policy from time to time. When we do, we will revise the date at the top of this page. Continued use of the Service after a change takes effect means you accept the revised policy.

12. Contact

Questions about this policy, or requests about your data, can be sent to our support team. See also our Terms & Conditions.