App security
Security at Mixavio
This page plainly explains how Mixavio is meant to protect your data. It describes the current state and is checked when the app changes. There is no security certification.
Local architecture
Your library, playlists, favorites, downloads and settings are stored on your device. There is no Mixavio account and no media backend of Tommsel.
Credentials
Credentials for servers are managed locally or through Apple's secure storage intended for this. Exactly which mechanisms are used will be named here after the code has been checked. Tommsel does not receive your credentials.
Direct connections to your servers
Mixavio connects directly to the servers you set up yourself. Use HTTPS where possible. Local HTTP is only usable as far as the iOS configuration provides for it. Mixavio does not blindly trust all certificates and does not disable App Transport Security globally.
Responsibility of the server operator
A server and its network have security of their own, for which the respective operator is also responsible. A server can see connection data, IP address, requests and requested media.
No VPN in Mixavio
Mixavio contains no VPN. If you access a private server on the go, you use a solution of your own such as Tailscale or WireGuard, which is provided and managed outside Mixavio.
Downloads
Downloads are stored locally in the area of the app. This area is protected by the protection features of iOS, such as the device lock.
Export and sharing
After an export, the copy is outside the protected area of Mixavio. The iOS share sheet hands content to the destination you choose, whose terms apply.
Limits
No security product is absolute. Protection also depends on the device lock, the state of the device, iOS, your servers and how you handle credentials, exports and backups. Mixavio makes no claim to a security certification.
Security reporting
If you have found a security issue in Mixavio, please write to tshfm78@gmail.com with the subject Security: Mixavio. Describe the problem, the iOS version and the steps to reproduce it. Please do not send passwords, tokens, private server URLs or private media files unprompted.
Last updated: November 6, 2026