Jellyfin Security & Privacy Scorecard
Android
The media library and viewing activity stay on the user's own server and are not shared with advertisers or data brokers. Google Cast and Android Auto are the only outside services involved, and they handle playback routing, not personal data. The connection between the device and the server may not fully protect user activity when used outside the home network or on public Wi-Fi.
Best for
Home media server users who value privacy
Avoid if
Users who connect on public or untrusted Wi-Fi
Findings
- 3 critical
- 3 high
- 5 medium
- 1 low
- 3 info
1 issue identified across security and privacy analysis.
Top security issues
- Cleartext HTTP Traffic Globally Permitted
- Sensitive Data Included in Android Backups
- Access Tokens Stored in Unencrypted SQLite Database
Top privacy issues
- Third-Party Google Services Integration Without Explicit User Consent
- WebView DOM Storage Enabled Without Encryption
- Downloads Default to External Storage
Full analysis
Jellyfin
| Security Score | 48/100 |
| Privacy Score | 97/100 |
| Version | 2.6.3 |
| Scan Date | 2026-03-04 |
What This Means for You
The media library and viewing activity stay on the user's own server and are not shared with advertisers or data brokers. Google Cast and Android Auto are the only outside services involved, and they handle playback routing, not personal data. The connection between the device and the server may not fully protect user activity when used outside the home network or on public Wi-Fi.
Recommendation: Use With Caution
Best For: Home media server users who value privacy
Avoid If: Users who connect on public or untrusted Wi-Fi
Key Findings
Data Security - 4 findings (1 critical, 1 high, 2 medium)
Network Security - 4 findings (2 critical, 1 high, 1 info)
Code Safety - 0 findings
Privacy - 2 findings (1 medium, 1 low)
Privacy Concerns
What Data is Collected
Jellyfin collects minimal personal data. Media playback activity and server connection details remain on the user's own server. The app does not gather user information for advertising or behavioral profiling.
Third-Party Data Sharing
| Service | Purpose |
|---|---|
| Google Cast Framework | Casting media to compatible devices on the local network |
| Google Play Services Base | Core Android platform services |
| Android Auto | In-vehicle media playback |
None of these services receive personal media library data or viewing history.
Understanding the Scores
| Category | Score |
|---|---|
| Security | 48/100 |
| Privacy | 97/100 |
| Data Security | 60/100 |
| Network Security | 56/100 |
| Code Safety | 88/100 |
| Data Collection | 97/100 |
| Data Sharing | 100/100 |
| User Control | 94/100 |
Positive Security Features
- Limits third-party integrations to three well-known playback routing services
- Keeps all media library data and viewing history entirely on the user's own server
- Zero personal data transmitted to advertising or analytics services
- Provides strong user control over app behavior and permissions
Areas for Improvement
- The connection between the app and the server travels with less protection than expected when used outside the home network or on shared Wi-Fi.
- Some data stored on the device may be accessible under conditions that reduce protection.
- Certain network communication behaviors may reveal information about the server to others on the same network.
About This Analysis
This scorecard is generated through automated static analysis of the app's code and configuration. Scores reflect the security and privacy posture observed at the time of the scan.
App Details
| Field | Value |
|---|---|
| App Name | Jellyfin |
| Package ID | org.jellyfin.mobile |
| Version | 2.6.3 (versionCode: 2060399) |
| Scan Date | 2026-03-04 |
| Platform | Android |
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 72/100 |