Security
Passwords & sessions
- Passwords are stored as scrypt hashes with a per-user salt — not plain text.
- Sessions use an HTTP-only cookie (with a same-origin token fallback on some hosts).
- Login and registration are rate-limited per IP.
API keys & IPTV credentials
- Debrid, MDBList, RPDB, TMDB, IPTV credentials, and MyAnimeList tokens are stored with your account, not baked into your Stremio install URL.
- Those secrets are encrypted at rest and used only to talk to the services you connect.
Install URL (addon token)
- Your manifest URL is a long random token. Anyone who has it can use your LiteAIO setup until you rotate it.
- Treat it like a password. You can rotate the token from the dashboard or configurator if it leaks.
- Unlike some older addon patterns, the URL is not meant to embed your debrid or API keys in the path.
What we log
- Operational logs (errors, billing webhooks, health).
- Daily usage counters (streams / catalogs / IPTV requests) for plan and ops — not the content of what you watch.
Account deletion
You can delete your account from Overview → Account (password + confirmation). That removes your account data, configs, profiles, IPTV sources, and sessions. Addon URLs stop working immediately. See the Privacy Policy for retention notes on backups and Whop.
Payments
Paid Premium goes through Whop. Card details are handled by Whop, not stored as full card numbers by LiteAIO. Free Premium trials do not require a card.
Practical tip: use HTTPS only, don’t paste install URLs into public chats, and rotate the token if you ever shared a screenshot that included it.