LibraryUnderstand privacy and network access
Understand Tuvima Library’s storage and network boundaries in about three minutes. Your library runs on your own host, while some optional services and the Places map can contact external systems.
Keep your library on your host
Your media files and SQLite database stay in configured local storage. Profiles, progress, settings, and review state are stored there too. Managed artwork, thumbnails, caches, staging data, and generated metadata use configured local paths.
The Engine and Dashboard run on that host. Local AI uses its CPU or GPU. There is no Tuvima-hosted account service or built-in telemetry pipeline.
Photos stay with the person who took them. Everyone in a household can browse one another’s photos, and the household has one Shared Library. A server administrator can also open other households’ photos through Other people in View, read-only. That is deliberate and visible: each time an administrator opens someone’s space or a household’s Shared Library, Tuvima records who looked and what they opened (at most once an hour per space), and the person whose photos were opened can see that record, read-only, under Settings > Security > Who viewed your photos (the household’s own administrator, the household owner, also sees views of the household’s Shared Library; a server administrator who does not look after that household does not). Nobody else can read it, and nobody can delete or clear it from there. People outside your household start with View switched off until an administrator turns it on for them.
This describes where Tuvima stores data. Your own network shares, backup destinations, reverse proxy, and installed plugins have their own access and privacy implications.
Know when external requests happen
Enabled metadata providers can request identifiers, descriptions, artwork, lyrics, subtitles, and relationship data. Examples include Apple, MusicBrainz, TMDB, TheTVDB, Comic Vine, LRCLIB, SubDL, Wikidata, and Wikimedia Commons. The optional ListenBrainz plugin, when a person links their own token, sends each finished song (title, artist, album and music IDs, plus when it was played) to ListenBrainz; it is off until switched on, never sends Vault items, and never sends anything for a profile that has not linked an account.
Provider behavior depends on configuration, credentials, media type, and processing state. Model downloads retrieve local model files from external hosts when you ask; subsequent supported inference runs locally. Everything that can be downloaded on request is listed below.
The plugin directory (Settings > Plugins > Available plugins) contacts GitHub, and only when an administrator opens Available plugins and the saved copy is more than a day old, or presses Check now. There is no background schedule. The request is a plain read of a public file, with the Library’s standard User-Agent and nothing about you, your media or your server in it. The Library keeps a saved copy of the list on the server, so the page works without GitHub. A switch on the section turns the lookup off completely: with it off no request is made. Installed plugins can use external services according to their implementation and declared permissions. Only install code you trust.
Know how scanned documents are read
Scanned pages and photos of paper are read by Tesseract, a program that runs on your own host. The text stays in your data store and is private to the owner’s space. Nothing is uploaded.
Text recognition uses the network in exactly one case: when you choose an extra language under Settings > Libraries > View > Documents and press Download. That downloads the language file from GitHub. English is included with Tuvima Library and needs no download.
The words of every document, whether read from the file or recognised from a scan, are used only for search on the Documents page. They never appear on Home, in the global search or in recommendations. The PDF viewer is bundled with the Dashboard and loads no outside files. Inbox suggestions and auto-filing rules run on your host without AI and send nothing anywhere, and the CSV export holds names and labels, never the words inside documents or your notes. See Documents in View.
Know how photos and videos are checked
When photos and videos arrive in the Import area, Library checks them on your own host: it reads each file’s contents to see that it is whole, works out a fingerprint of its contents to spot an exact copy, and reads the date it was taken. Nothing about a photo leaves the machine. A copy is only looked for in the library it is going into, so one person’s private library never learns what another person has. The one place a copy is checked across people is the Shared Library, which the whole household can already see, so being told “Already in the Shared Library” reveals nothing private. The duplicates report shows an administrator only the Shared Library and their own library, never another person’s. Refused and skipped files appear in Activity as counts and reasons, without file names.
Know what can be downloaded when you ask
Tuvima downloads a model only when you ask. It downloads two helper tools by itself: ExifTool (which writes the profile name into photos, videos and PDFs in View) whenever it is missing outside a container, and FFmpeg, and only while it is missing on a run from source or after a repair (never in the Windows installer or a container, which include it). It starts at first-run setup or when the Engine starts, shows its progress, and can be turned off with auto_install_required in config/tool_downloads.json (ExifTool also has its own exiftool.auto_install switch there). Every other download below starts when an administrator presses a button under Settings > Tools and requirements (or Install for me on the banner that appears above every Settings page when a Required tool is missing). The banner’s X does not download anything: it hides that line, and Tuvima remembers the choice for that profile (on any browser) until a different tool goes missing.
| What | Where from | When |
|---|---|---|
| FFmpeg and FFprobe (one pinned Windows build) | github.com (the GyanD/codexffmpeg release), which hands the file on from GitHub’s own release storage | Automatically at first-run setup and Engine start-up while it is missing (run from source or a repair), or Install for me or Download again; the Windows installer and the container image already include it |
| ExifTool (an unmodified copy of the official Windows zip or Perl distribution, used to write the profile name into photos, videos and PDFs in View) | github.com (the Tuvima/tuvima-library release exiftool-13.59) | Automatically when it is missing, on a run from source or the Windows installer; the container image includes it. The Linux copy needs Perl installed |
| Tesseract’s Windows setup program, plus English and page-orientation language data | github.com (UB-Mannheim/tesseract and tesseract-ocr/tessdata_fast) | Install for me on a run from source. You then run the setup program yourself and Windows asks for your approval |
| Extra text recognition languages | github.com (tesseract-ocr/tessdata_fast) | Choosing a language under Settings > Libraries > View > Documents |
| Local AI model files | The model host named for each model on the Local AI pages | Download on the Tools and requirements page |
The address and checksum of every FFmpeg, ExifTool and Tesseract download (the setup program and its English and page-orientation data) are written in config/tool_downloads.json. Extra text recognition languages use language_download_url in config/ocr.json, and each Local AI model uses the address and checksum in config/ai.json. For FFmpeg and Tesseract the Library only accepts fixed https addresses on github.com, checks each download (and each FFmpeg program inside its archive) against the recorded SHA-256 value, and throws away anything that does not match. Each attempt, including a refusal or a cancel, is written to the system activity log.
GitHub hands release and raw files on to its own storage, so a download from github.com may be redirected. The Library follows a redirect only over https, only to github.com, objects.githubusercontent.com, release-assets.githubusercontent.com or raw.githubusercontent.com, and for at most five hops; a redirect anywhere else is refused and nothing is saved.
No library data is sent. A download is a plain request for one file. The only thing the host can learn from it is that someone fetched that file from that internet address; no titles, file names, folders, profile or account details leave your host. Containers never download tools into themselves. The profile name that Library writes into your View files stays in those files and is never sent anywhere. ExifTool, like FFmpeg and Tesseract, runs only on your own computer: it reads and writes your files where they are, and none of them is uploaded.
Understand Places map requests
View > Places opens Tuvima Atlas. It first attempts OpenFreeMap’s dark map style, which can load external map resources. If that attempt fails, the map falls back to locally served country data.
Opening Places can therefore make external requests even though the media and place aggregates come from your authorized library. Do not describe this surface as always offline or free of third-party requests.
Use local AI with clear expectations
Local model files run through LLamaSharp and Whisper.net rather than a cloud prompt endpoint. Model-download URLs retrieve artifacts; they do not send prompts for remote inference.
AI can assist with classification, matching, descriptions, search intent, and supported audio tasks when the relevant feature is enabled and ready. It does not replace the Priority Cascade’s factual metadata rules.
Evaluation fixtures, outputs, reports, and models stay on the Engine host unless you deliberately export them. Gated models need deliberate license acceptance and a verified artifact. A source URL is provenance, rather than proof of an installed runtime.
Protect credentials and remote access
Keep provider keys in ignored secret files, rather than committing them to the repository. Missing credentials should remain visible as a configuration problem, not as a successful connection.
Tuvima is open from the start: any device that can reach the server can use it, and Tuvima sign-in is always required. Closed router ports are what keep the internet out, and a desktop install started without a password can be used from any device that reaches the server until its administrator adds a password or passkey. The Dashboard serves plain http, so for access from outside use a verified Tailscale Serve or HTTPS reverse-proxy path. Advanced router mapping is opt-in. Remote access guidance explains the deployment checks.
Plan an offline session
Browsing already indexed media and using ready local models can avoid provider lookups. For a restricted-network deployment, account for metadata providers, downloads, catalog refreshes, plugins, and the Places map.
Disabling metadata providers alone does not prove the entire Dashboard makes no external requests. Network policy and the surfaces you open determine that boundary.
Technical details
Long-lived provider credentials belong under config/secrets/. Base provider definitions remain under config/providers/; a blank base file does not establish that secrets are absent.
The Places client attempts https://tiles.openfreemap.org/styles/dark. Its local fallback uses /maps/world-countries.geojson. Local media authorization is separate from the map’s network source selection.
AI evaluation and hardware benchmarking follow explicit opt-in controls. Ordinary recorded-fixture tests do not need to load model weights. See security architecture for authentication and server boundaries.