LesHubPrivate media library

Privacy Policy

Effective date: 2026-10-28 · Last updated: 2026-10-28

This policy describes the LesHub app and the leshub.leston.com.cn website. LesHub is in development; the release version may add or change features, and this policy will be updated before those changes take effect. This document is not legal advice.

1. Who we are

LesHub is operated by Leston Trading (Shanghai) Co., Ltd., No. 118, Building 20, Lane 83, Hongxiang North Road, Lingang New Area, China (Shanghai) Pilot Free Trade Zone ("LesHub", "we", "us"). For privacy questions, contact info@leston.com.cn.

We act as the data controller for account, device, purchase, and support data described below. For media files you access through LesHub, you remain responsible for the source and its terms.

2. What we collect

2.1 Account data

When you create or use a LesHub account, we process your email address, a user identifier, the sign-in method you used, session tokens, and the timestamps of sign-in and account changes. Email sign-in uses a one-time code. Passwords for LesHub are not required or stored. Session tokens are stored in the platform keychain on your device and are also held by our authentication provider so the session can be refreshed and revoked.

2.2 WeChat sign-in (when enabled)

When WeChat sign-in is enabled, our server receives the WeChat openid and, where available, unionid for the LesHub WeChat applications (website and mobile), together with the nickname returned by WeChat. The current integration does not request the avatar. We use the UnionID to keep the same person on Mac and iPhone in one LesHub account. WeChat does not provide your email address to us. We do not receive your WeChat password or your WeChat access token in the app.

Native WeChat sign-in sends a one-time authorisation code to our server, which exchanges it with WeChat. The app never receives the WeChat AppSecret.

2.3 Purchases and subscriptions

Apple processes payments. We receive transaction identifiers, product identifiers, purchase and expiry dates, renewal and revocation status, the environment (sandbox or production), and an account token that links the purchase to your LesHub account. We do not receive your payment card number or billing address.

2.4 Device data

For the three-device entitlement and session security, we record a randomly generated device identifier, the platform (macOS or iPhone), an optional device name, the last-seen time, and whether the device is active or revoked. We do not use the advertising identifier (IDFA) and do not track you across apps or websites.

2.5 Media sources and credentials

NAS/SMB usernames and passwords, Baidu Netdisk cookies and login state, and any TMDB token you supply are stored in the system keychain on your device. They are not uploaded to our servers. LesHub uses them locally to connect to the source you configured.

File names, paths, and file contents are processed on your device to build your library and play the file. We do not upload your video files. If you use a remote source, the request goes to that source (for example, your NAS or Baidu), subject to that provider's terms and privacy policy.

2.6 Metadata queries

To match a title, LesHub processes the title, year, media type, season, episode, and language. In the release version, these queries are planned to go through our metadata service and TMDB; the current development build may call TMDB directly using a token you provide. We do not send file contents or your NAS/Baidu credentials with metadata queries.

2.7 Diagnostics and support

Baidu-related diagnostics may be written to a local log on your device. The app does not include third-party advertising or analytics SDKs. If you contact support, we receive your email and whatever you include in the message; please do not send passwords, cookies, or verification codes. Our servers and hosting providers may keep standard request logs such as IP address, user agent, and timestamp for security, abuse prevention, and reliability.

2.8 Website

The leshub.leston.com.cn website does not use advertising or analytics cookies. Our hosting provider may process standard request logs (IP address, user agent, requested URL, timestamp) to serve the site and protect it from abuse.

3. How we use data

We do not sell personal information. We do not use your data for advertising. We do not use your media files to train models.

4. Legal bases (EEA/UK)

Where GDPR applies, we rely on: performance of a contract (account, playback, purchases); legitimate interests (security, abuse prevention, service reliability); consent (optional WeChat profile data and any optional feature that asks for it); and legal obligation (tax, accounting, and lawful requests). You can withdraw consent at any time without affecting prior processing.

5. Sharing and subprocessors

We share data only as needed:

We may disclose data if required by law, to protect rights and safety, or in connection with a merger or acquisition, subject to appropriate safeguards. We do not sell personal information.

6. International transfers

Our authentication and database service is hosted in Singapore, and some providers process data in the United States and other countries. Where required, we use contractual safeguards for cross-border transfers. Data protection laws in those countries may differ from your own.

7. Retention

Account data is kept while your account exists. Device records are kept until revoked or the account is deleted. Purchase and entitlement records may be kept for as long as required for tax, accounting, fraud prevention, and App Store obligations. Support messages are kept for as long as needed to resolve the request and for a reasonable period afterwards. Server logs are kept for a limited period for security and reliability. Local data on your device remains until you delete it or uninstall the app.

8. Security

We use TLS for network traffic, platform keychain/keystore for credentials and session tokens, access controls on the server, and signed server notifications for purchases. No method is completely secure. If you believe your account is compromised, contact us and revoke devices from the app.

9. Your rights

Depending on your location, you may request access, correction, deletion, portability, restriction, or objection, and you may withdraw consent. Use the in-app account deletion flow or email info@leston.com.cn. We may need to verify your identity. You may also complain to your local data protection authority.

10. Children

LesHub is not directed to children under 13 (or under 16 in the EEA/UK where applicable). We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will delete it. You are responsible for the media you access and for complying with age ratings and local law.

11. Third-party services

The app connects to third-party services you choose, including your NAS, Baidu Netdisk, TMDB, Apple, and (when enabled) WeChat. Those services have their own terms and privacy policies. LesHub does not control their availability, content, or data practices.

12. Changes

We may update this policy as the app evolves or the law changes. We will post the new version here and update the effective date. If a change is material, we will provide additional notice in the app or by email before it takes effect.

13. Contact

Leston Trading (Shanghai) Co., Ltd.
No. 118, Building 20, Lane 83, Hongxiang North Road, Lingang New Area, China (Shanghai) Pilot Free Trade Zone
Email: info@leston.com.cn