Privacy policy.

F5signage is a digital signage platform: you upload content, build playlists, and push them to screens you own or manage. This page explains what we collect to make that work, and what we don't.

What we collect

• Account: the email, password, and name you register with. Your password is never stored in plain text — it's salted and hashed with scrypt before it touches the database.
• Content you upload: images, videos, and website URLs you add to your library, plus the playlists and schedules you build from them.
• Screens: the name you give each screen, its pairing key, and a last-seen timestamp so the dashboard can show you whether it's online. We do not log which physical location a screen is in, or anything about the people who walk past it.

What we don't collect

No payment or billing information — F5signage doesn't process payments yet; early clients are invoiced manually, outside this system entirely. No analytics or tracking scripts, no advertising cookies, no third-party trackers of any kind. The only cookie this site sets is a single first-party session cookie that keeps you signed in — nothing else reads or writes it.

How your account is secured

Sessions are HTTP-only, signed cookies that JavaScript on the page can never read directly, and they carry the Secure flag so they're only ever sent over HTTPS. Login and signup are rate-limited to slow down anyone trying to guess a password. Uploaded files are checked against their actual file signature, not just the filename or the browser-supplied type, before they're accepted.

Where your data lives

F5signage runs on infrastructure we operate ourselves — not a third-party cloud platform. Your account and content data live in a Postgres database we host; your uploaded media files live on disk on the same server that runs the app. We don't sell, rent, or share your data with anyone.

Content that plays on a TV

A screen fetches its playlist and media over an unauthenticated connection by design — that's what lets a dumb TV or a $30 Android box play your content without you having to type a password into a remote control. Media is served by an unguessable identifier rather than a sequential one specifically so that content can't be discovered by guessing.

Deleting your data

Deleting an asset removes both its database record and the underlying file immediately. Deleting your account removes your screens, groups, and playlists along with it. There is currently no self-service account deletion in the dashboard — contact us and we'll do it for you.

Questions

This is a small, actively developed product, not a large company with a dedicated privacy team. If anything here is unclear, or you want your data removed, reach out to the person who set up your account.