TPB 4K Porn GitHub

Privacy Policy

Last updated:

Overview

This page describes the data practices of the TPB 4K Porn Stremio Addon - a self-hosted, open-source Node.js server that acts as a Stremio addon. Because the addon is self-hosted, the operator (the person who deploys it) controls all data. End users interact with their own instance, often one they deploy themselves.

The short version: your debrid API keys and metadata keys are never stored server-side. They live only in your personal install URL and in your browser.

What data is handled

Debrid provider API keys

When you configure the addon on the /configure page, your debrid API key (Real-Debrid, TorBox, etc.) is embedded in your personal install URL as a base64url-encoded JSON blob. This segment travels inside every Stremio API call, where the server decodes it at request time and uses it to call the relevant debrid API.

  • The key is not stored in any database, log file, or Redis cache.
  • The configure form uses HTTP POST so keys are not written to server access logs (they never appear in query strings on form submission).
  • The key is never shared with any party other than the debrid provider's own API.

TPDB and StashDB API keys

Your ThePornDB (TPDB) and StashDB API keys follow the same model as debrid keys - encoded in the install URL, decoded per-request, used only to call the respective metadata API. They are not persisted server-side.

If the operator sets a server-side TPDB or StashDB key (via TPDB_API_KEY / STASHDB_API_KEY environment variables), that key is stored in the deployment environment (e.g. as a container environment variable) by the operator, not by this software.

Redis cache contents

When Redis is connected, the following data is cached:

  • Catalog torrent lists - raw torrent metadata (title, infoHash, seeders, size, cover URL) fetched from public torrent indexes. TTL: 30 minutes.
  • Cover/poster images - resolved image URLs for torrent covers. TTL: 24 hours.
  • TPDB metadata - scene titles, performer names, cover images from ThePornDB, keyed by infoHash. TTL: 30 days. This is shared across all users of the same instance (see below).
  • StashDB metadata - scene metadata from StashDB, keyed by infoHash. TTL: 30 days. Also shared.
  • Debrid-resolved file metadata - CDN URL, file name, and size for a resolved torrent, keyed by a hash of the user's API key + IP. TTL: 4 hours. This cache scope ensures CDN URLs minted for one user are never returned to a different user.
  • PornRips magnet URLs - resolved magnet/torrent URLs keyed by post slug. TTL: 30 days.
  • Torrent records - full torrent record (title, infoHash, URLs) for items shown in the catalog, keyed by the Stremio item ID. TTL: 6 hours.

What is NOT in Redis: debrid API keys, TPDB/StashDB user keys, IP addresses (only a one-way hash is used for cache scoping), or any personal identifiers.

IP addresses

The addon extracts your public IP address from the incoming request (req.ip, after trust-proxy processing) for two purposes:

  • Real-Debrid and TorBox IP forwarding: your public IP is forwarded to these two providers so the CDN links they mint are bound to your location (required for proper playback). Your IP goes directly to the debrid provider's API - not stored by this addon.
  • Cache scope: a one-way SHA-1 hash of (apiKey | userIp) is used as a Redis cache-key prefix for debrid stream results. This ensures CDN URLs are never shared across users or locations. The raw IP is never written to Redis.

Your IP may appear in the server's HTTP access logs (if the operator's hosting provider or reverse proxy logs requests), subject to the operator's own logging and data retention settings.

Shared metadata cache

The TPDB and StashDB metadata caches are shared across all installs on the same server instance. This is a deliberate design: once any user with a metadata API key has matched a torrent, the result (title, cover, description) is cached under the torrent's infoHash and served to every subsequent user - including those without their own key.

This does not expose any personal data. The shared cache contains only metadata about torrents (titles, covers, descriptions from TPDB/StashDB), not information about the users who triggered the lookups.

What is not collected

  • No user accounts, profiles, or identities.
  • No persistent storage of debrid API keys, TPDB/StashDB keys, or any credential.
  • No tracking pixels, analytics scripts, or third-party telemetry.
  • No cookies (the configure page uses a POST form; no session cookies are set).
  • No advertising or data brokering.

Third-party API calls

Depending on configuration, the addon may call these external services:

  • The debrid provider you chose (e.g. Real-Debrid, TorBox). Your API key and torrent infoHash are sent to their API. Subject to that provider's own privacy policy.
  • ThePornDB (api.theporndb.net) - scene metadata lookups. Torrent titles are sent as search queries. Subject to TPDB's privacy policy.
  • StashDB (stashdb.org) - scene metadata via GraphQL. Subject to StashDB's privacy policy.
  • The operator's torrent-search backend - catalog browse/search requests routed through the backend. Subject to that service's own policies.

This addon does not control and is not responsible for the data practices of these third-party services.

Self-hosted deployments

Because this software is self-hosted, the operator (the person running the server) is the data controller for their deployment. If you are running a shared instance for multiple users, you are responsible for communicating your own data practices to those users and complying with applicable privacy laws.

The software itself does not send any data to the project maintainers. There is no telemetry or phone-home behaviour.

Contact

Questions about this privacy policy or the addon's data practices can be raised as a GitHub issue at github.com/akshatsinghkaushik/stremio-tpb-porn/issues.