Privacy Policy

Applies to CarCast for iOS 1.0.1 · Effective date: 2026-11-04

CarCast is a player and casting tool. It provides no content, and there is no sign-up or login. This version also has in-app purchases, usage reporting, advertising attribution and crash reporting. To run them, the app sends the data listed in section 1 to our payment and reporting services, to Adjust and to Google (Firebase). With your permission, that includes your device's advertising identifier (IDFA).

What you play stays yours: your sources, server addresses, credentials, favorites, history, local videos and browsing are kept on your device and are not part of that data (1.6). CarCast also connects to the addresses you enter or choose. Those belong to third parties, and they can see your requests. The in-app browser (Discover › Browser) opens the websites you choose; like any browser, those sites see your requests and may store cookies and other website data on your device (2.13). Everything the app connects to is listed in section 2. Your choices, including how to withdraw permission and ask for deletion, are in section 8.

0. Who we are

CarCast is developed and published by Lirvant Limited, Unit 225-12, 2/F, Mega Cube, 8 Wang Kwong Road, Kowloon Bay, Hong Kong. Questions about this policy: [email protected].

1. What we collect

CarCast has no account you create. The services below identify a device or an installation, not a name or email address you give us. Where a list below is marked for confirmation, we are still confirming it with the provider of that service.

1.1 Purchases (IAPPayment SDK, pay.lirvant.com)

1.2 Usage reporting (FunReport SDK, event.lirvant.com, track.lirvant.com, arg.lirvant.com)

1.3 Advertising attribution (Adjust)

1.4 Analytics and crash reports (Google Firebase)

1.5 The advertising identifier (IDFA) and the tracking prompt

1.6 What we do not collect

This matches the privacy manifest bundled in the app (NSPrivacyTracking is true, and NSPrivacyCollectedDataTypes lists coarse location, device ID, purchase history, product interaction, crash data and other diagnostic data) and the App Privacy section of our App Store listing. The manifests of the SDKs inside the app declare their own entries.

1.7 Sharing with third parties

We share the data above with the services named in 1.1 to 1.5, for the purposes given there, and with their hosting providers. We also disclose data if the law requires it. We expect these third parties to protect user data to the same standard as this policy. Their own policies:

What the app also does is connect, on your instruction, to addresses you chose yourself — your playlist host, your media server, the device casting to you, and the websites you open in the in-app browser. Those destinations are not ours and we send them nothing beyond what section 2 lists. They are operated by whoever you pointed the app at, under their own terms and privacy practices, which we neither control nor can vouch for. Choosing which of them to trust is yours; section 2 exists so that you can make that choice knowing exactly what each one sees.

1.8 How long we keep data, and where

2. Every network destination the app reaches

The following is the complete list of network connections CarCast may make in normal use, with what triggers each. Sections 2.1 to 2.8 are supplied by you or by another device on your own Wi-Fi network. The rest are screen mirroring (device-local loopback, 2.9), our own website for the legal pages (2.10), the browser's start-page shortcuts and default search (2.13; each shortcut is that site's own official address, requested only when you tap it, when you search, or when you return to the browser and it reopens the page you last had open; nothing is loaded at app launch), Apple's speech recognition service (2.14), and the purchase, reporting, attribution and crash services, which do connect at launch (2.15). Requests the app makes with Apple's networking stack to the addresses in 2.1 to 2.8 identify themselves either with the fixed header User-Agent: CarCast/1.0 (where noted) or with iOS's standard header of the form CarCast/<build> CFNetwork/<version> Darwin/<version>. Web pages — the legal pages (2.10) and the websites you open in the in-app browser (2.13) — are loaded by WebKit, which sends its own standard header (User-Agent: Mozilla/5.0 (iPhone; …) AppleWebKit/…, or WebKit's own desktop header after you ask for a desktop site, and on the car screen, where pages open in their desktop version); the app never sets a custom one. None of the requests in 2.1 to 2.10 and 2.13 carries a device identifier, except the random identifiers described in 2.5 and 2.8.

2.1 Playlist / subscription URLs you add

2.2 Channel probing and cover-frame capture

2.3 Playback

2.4 Channel logos and artwork

2.5 Your Jellyfin / Emby media server

2.6 Download URLs for local videos

2.7 Local network permission

iOS asks for Local Network access the first time the app needs it. CarCast uses it for two things only: being found as a cast receiver on your Wi-Fi (2.8), and connecting to addresses on your own network that you added — a Jellyfin / Emby server, a playlist or a download link on your LAN. If you deny it, those two features stop working on the local network; everything else is unaffected.

2.8 Casting on your local network (DLNA / UPnP)

2.9 Screen mirroring (device-local only)

2.10 This policy, the Terms and the Open Source Licenses

2.11 What never happens

2.12 About cleartext (HTTP) traffic

IPTV playlists, home media servers and some websites use http:// addresses, so CarCast permits cleartext connections. Media addresses come entirely from you; in the in-app browser, a website may also take you to an http:// page through a link or redirect you did not type. Any http:// traffic — including login credentials and anything you enter on an http:// web page — travels over the network in the clear and may be visible to others on the same network. Prefer https:// where you can.

2.13 Websites you open in the browser

2.14 Apple's speech recognition service

2.15 Purchase, reporting, attribution and crash services

3. Checking which apps are installed

On the Cast from Other Apps screen (Discover › Cast from Other Apps), CarCast asks the system whether each of a fixed list of 11 apps is installed, so that it can show only the ones you actually have. Each of the 11 is a cloud-drive or video app whose own Cast button can send video to CarCast; messaging and social apps are not on the list and are never asked about. Every other app is cast with Screen Mirroring, which does not need to know whether it is installed. This happens only while you have that screen open, the answers are used only to draw that screen, and they are never stored, counted or sent anywhere.

4. What is stored on your device, where, and how to delete it

Everything lives inside this app's sandbox container, which other apps cannot read.

4.1 Application Support (Application Support/CarCast/, JSON files)

4.2 Caches (Caches/)

4.3 Documents (Documents/LocalVideos/)

4.4 Keychain

4.5 App Group preferences (group.com.lirvant.carcast)

4.6 Browser bookmarks, tabs and website data

Your browser bookmarks and the list of open tabs are kept in the app's own preferences (user defaults). Cookies, cache and other website data from the sites you visit are kept by iOS's WebKit inside this app's container. None of it leaves the device or reaches us. The car browser keeps its own list of open tabs, and the zoom level you choose for each website, on the device. Bookmarks are shared between the iPhone and the car. The speech language you pick for Voice Input is kept in the same preferences. Deleting the app removes all of them.

4.7 How to delete

4.8 Purchase and SDK data on your device

5. System permissions

CarCast asks for exactly five permissions. Tracking is asked at launch; the other four only when you first use the feature that needs them:

Choosing videos to import, or a QR-code image to read, uses Apple's system photo picker, which runs outside the app: CarCast gets only the items you pick and never has access to your photo library, so no Photos permission is requested. When a website in the in-app browser asks you to upload a file, iOS shows its standard chooser in the same way: the website receives only the photos, videos or files you pick or take, and CarCast does not see your photo library. The app requests no location, contacts or Bluetooth permission. Any permission above may be denied; only the corresponding feature stops working. Denying Tracking stops no feature.

5.1 Speech recognition

Speech is converted to text with Apple's speech recognition. When your device supports on-device recognition for the chosen language, recognition happens only on your device; otherwise Apple's speech recognition service processes the audio under Apple's privacy policy. CarCast does not keep the audio. The text is used only for the search, address or field you are entering, as if you had typed it.

6. Required Reason API declarations

As Apple requires, each part of the app that calls a “required reason” API declares it, with the approved reason, in its own privacy manifest. The uses by the app's own code, by the broadcast extension and by MobileVLCKit involve no collection or tracking, and no information derived from them leaves the device. For the SDKs in sections 1.1 to 1.4, see the note on each:

7. Children

CarCast is not directed at children under 13 and does not knowingly collect personal information from children. If you believe a child has used CarCast and want the data in section 1 deleted, contact us (section 8). Please note that the app provides no content of its own: what can be played depends entirely on the sources its user adds, and that content is neither reviewed nor rated by us. The in-app browser can open any website and does not filter content; for this reason the app is rated 16+ on the App Store. If a child uses this device, we suggest a parent decide which sources are added and use iOS Screen Time.

8. Your choices and rights

Withdraw permission for tracking

Open iPhone Settings › Privacy & Security › Tracking and turn CarCast off. You can also turn off Allow Apps to Request to Track on that screen. The app then no longer has the IDFA. Nothing else in the app changes.

Stop the other data

This version has no in-app switch for the reporting, analytics and crash reporting in sections 1.2 to 1.4. To stop all of it, delete the app. Deleting the app does not cancel a subscription; see the Terms of Use.

Other permissions

Camera, Local Network, Microphone and Speech Recognition can be turned off in iPhone Settings › CarCast.

Ask us about your data, or ask us to delete it

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict how it is used, and to complain to your data protection authority. To make a request, write to [email protected]. So that we can find your data, include the Apple order ID or transaction ID of your purchase, if you have one. We pass deletion requests on to the services in section 1 where they hold the data. Purchase records we must keep by law or for accounting may be kept for as long as that requires. Data on your device is deleted as described in section 4.7.

9. Changes to this policy

If a change in the app makes anything above inaccurate, we will update this policy before shipping that version and update the effective date at the top. The same text is published on our website and ships inside the app. Settings › Privacy Policy shows the website version; when the website cannot be reached it shows the copy bundled with the version you have installed.

10. Contact

For support, or with questions, complaints or requests about this policy:

You can also use the “App Support” link on the CarCast product page on the App Store. This version does not include an in-app contact form.