Sync

Sync keeps your watch history, resume points, Watch list, recent searches and sources the same on every device you use Yonto Player on. It is part of Yonto Pro, and the 7-day trial includes it. It is off until you turn it on.

Sync is in beta, so its row in Settings shows a Beta tag, and its page starts with this note: “Sync is in beta. The server stores what syncs, encrypted with a key only your devices hold, so no one can read it, not even Yonto. Save your recovery key: without it, losing all your devices loses what synced. If something doesn’t sync as it should, tell us through Help and support in About.”

What syncs is encrypted on your devices before it leaves them, with a key only your devices hold. The server it goes through, ours or one you run, keeps it without being able to read it, and nobody can decrypt it, us included. What Yonto’s server can see says exactly what it keeps.

Turn it on

Go to Settings, Sync. The row says Off until Sync is on.
Under Where it syncs, keep Yonto’s server, or choose Your own server.
Choose Turn on: “Turning on makes the key your devices encrypt what syncs with. There’s nothing to write down first.”

The page then says “Syncing…”, and after that when this device last synced, “Last synced time”. It syncs by itself while Yonto Player is open; Sync now syncs straight away.

On Free, Turn on asks for Pro: “Syncing with your other devices needs Pro. Until then, everything stays on this device.” Nothing leaves the device.

Add another device

You don’t type a code or scan anything. Have both devices at hand, with Pro on both.

On the new device, go to Settings, Sync. Once your account syncs, Turn on is Join instead: “Your account already syncs. Join, and a device that already syncs gives this one the key.” A device with Pro also finds out by itself that your account syncs, and asks to join without you opening the page.
Choose Join. The new device says “Open Yonto Player on a device that already syncs”: “It shows this device’s request: choose Answer here on it. Keep both devices at hand.”
Every device that already syncs and has Yonto Player open shows “A new device (device) wants to join Sync”: “Choose Answer here on the device you’re using. The six digits to compare show on it.” While a film is playing it shows a banner instead, so the film keeps going. Choose Answer here on the one you’re at. The others then say “Being answered on device.” and can’t answer it; Close puts it away there.
Both devices show the same six digits. The new device says “Check that the other device shows the same six digits.”, and the other one “Allow it only if the new device shows the same six digits.”
If they match, choose The digits match on the new device and Allow on the other one. The new device says “This device syncs now”: “Your history, resume points and the rest arrive in a moment.”

If the digits differ, choose Don’t match or Don’t allow. Going back from the digits is Don’t allow too, since no other device can answer a request once one has. Nothing is shared, and the new device says “Nothing was shared. Try again, and if the digits still differ, use another network.” The digits are worked out from both devices’ own keys, so a server that tried to slip in a key of its own would change them.

There are no notifications: a device that syncs sees a request only while Yonto Player is open on it. A request nobody answers ends after ten minutes, and so does one that is turned down; the new device then says “Not joined”: “The request ended: it was turned down, or it waited too long. Nothing was shared.” It doesn’t ask again by itself. Choose Join to ask again. A request the allowing device was answering when Yonto Player closed on it is turned down when it opens again, so ask again then too.

Each device keeps the key in its own secure storage, never in a backup, iCloud Keychain or Google’s cloud. So reinstalling Yonto Player on the same device usually picks Sync up again as the same device, with no joining. Where it can’t, such as after a factory reset, join again. On Android, setting a new phone up from your old one with Google’s own transfer can carry the key across, without the two taps; the new phone then syncs as a device of its own, and shows under Devices like any other.

What syncs

Each device chooses for itself under What this device syncs: “Each device chooses for itself. Turning something off keeps what this device has; it just stops syncing.” No other device can change what this one syncs.

On the page	Starts	What it carries
Watch history	On	The titles you played and when
Resume points	On	Where you stopped in each film and episode. The newest change wins, not the furthest point
Watch list	On	The titles you saved to watch later
Recent searches	On	The queries you searched with, the newest ten
Sources	On	“Passwords you typed included. Sign-ins and folders on this device stay here.”
Repos	On	The repos you added and the catalogs you picked
Titles you matched by hand	On	What you chose with Wrong title?
Plugins	Off	“Off unless you turn it on. Another device installs a plugin only as the build you approved.”
Keys	Off	“Your TMDB key. Off unless you turn it on.”

Removing a title from History or the Watch list, or Clear all, removes it on every device that syncs it. So does removing a search from your recent searches, or Clear on that list. A search counts once you submitted it or opened a result from it, never while you type, and the same search typed on two devices is one search, whatever its case or spacing. Deleting a source deletes it on every device that syncs sources. With Plugins on, a plugin you install on one device installs itself on your other devices that have Plugins on, as long as its address still gives the build you approved, and removing it removes it there too. One that needs you instead waits under From your other devices in Settings, Advanced, Plugins, saying why: its address gives another build, it would read a catalog type another reader has, installing it needs Pro, this device can’t install that build (it needs a newer Yonto Player, for example), or its address didn’t answer. Choose it to get the same question any install asks.

These never sync: your Pro licence, the Master PIN, a sign-in such as Plex’s or a cloud drive’s, a Folder on this device or a USB drive, downloads, which source is active, the order of your sources and which are turned off, cached pages and pictures, and the app’s settings. Nor does a title’s poster: each device that has the title’s source takes it from there, or looks it up as a title page does, so a title saved on one device shows its poster on the others that have its source. On a device without the source the title keeps its placeholder.

Turning a kind off is a choice, not a lock: every device you allow holds the key, so only allow devices you would trust with your passwords.

Keep one source off Sync

A source’s form has Sync this source, on by default: “Off keeps it on this device alone, with its history, resume points and Watch list entries.” Turn it off and choose Save. A repo’s page has Sync this repo (“Off keeps it on this device alone, with the sources added from it.”), and a plugin’s page Sync this plugin (“Off keeps it on this device alone.”).

Made with the switch off, it never reaches another device.
Turned off after it synced, it stays on the devices that already have it, and they go on syncing it among themselves. This device’s copy becomes its own: deleting it here leaves theirs alone.
Turned on again, it first takes what changed elsewhere while it was off.

A folder on this device has no switch: it never syncs.

Devices

Devices lists every device that syncs, with when it last synced: “device · last synced time”, or “device · not synced yet”.

Each device is named with a code beside its name, six characters no other device can copy, and shows its own above the list: “This device’s code: code. …”. When a device asks about a new key, check the codes, not only the names, since two devices can share a name.

To take one off, choose it. A removed device still has the key, so removing one always starts over with a new key as well:

“Remove device from Sync?”: “It still has the key, so removing it also starts over with a new key, which only your other devices get.” It then names every device the new key goes to, and any it leaves out, as Start over with a new key does.
Choose Remove and start over.

Removing a device that syncs through Yonto’s server also signs it out of Yonto Pro: “It’s also signed out of Yonto Pro, so its licence stops working there until it’s activated again.” It signs out the licence the server saw that device sync with, whatever the device says of itself; at your own server nothing is signed out, so sign it out on your account page yourself. So a device you removed can’t sync, ask to join or use Pro until its licence is activated on it again, and its copy of your licence stops working anywhere else too. If that can’t be done just then, nothing is removed: “Couldn’t sign that device out of Yonto Pro, so it wasn’t removed. Try again.”

A removed device says “Another device removed this one from Sync. What’s on this device stays here. To sync again, join as a new device.” Its Sync page starts on the place it synced at, your own server’s address included, so Join takes it back there. It joins as a new device, so Plugins and Keys are off again until you turn them on. It keeps what it had already synced.

Turn Sync off on a device

Turn off Sync on this device: “Keeps everything on this device and stops syncing it. To sync somewhere else, turn Sync off here, then turn it on or join there.”

It asks “Turn off Sync on this device?”: “What’s on this device stays here, and your other devices keep syncing. This device knew the key, so if it’s lost or you’re giving it away, remove it from another device instead: that starts over with a new key.” Choose Turn off. The device leaves the list on your other devices, and keeps what it had already synced, as its own. To sync it again, join as a new device. If your other devices can’t be told just then, say with no network, it turns off anyway and says, at Yonto’s server, “Sync is off on this device, but your other devices couldn’t be told, so they still list it. Removing it from one of them takes it off the list, but that also starts over with a new key and signs this device out of Yonto Pro.” At your own server, where nothing is signed out, it says “Sync is off on this device, but your other devices couldn’t be told, so they still list it. Removing it from one of them takes it off the list, but that also starts over with a new key.” They can keep listing it: a device that turned Sync off can’t sync with them any more.

Start over with a new key

Start over with a new key: “Makes a new key and gives it to your other devices, so a device you removed can’t read anything synced from now on.”

It asks “Start over with a new key?” and names every device the key goes to: “The new key goes to devices. Any other device has to join again, and a recovery key you saved stops working.” It may leave a device out, and says so:

“devices won’t get the new key and will have to join again.”: a device from a test install that has no signing key, or one the server doesn’t list with the keys your other devices know it by.
“devices won’t get the new key, since none of your other devices let it in and device could have. If it’s yours, join it again afterwards.”: only while removing a device, for one this device can’t trace back, through who let whom in, to itself or the devices it joined through: one only the removed device let in, or one added with the recovery key, which no device let in. A device that held the key could have added one of its own under a name you know, so it gets no key until you let it in yourself.
“devices won’t get the new key, since another of your devices removed it.”: a device another of your devices removed. A removal counts only while the device that made it is trusted, so one made by a device you then remove goes with it.
“None of your other devices will get the new key. A recovery key you saved stops working.”: in place of the first sentence, when every other device is left out.

Every device signs its own entry in this list, so no other device can rename it, change its keys or take it off the list, and your devices keep the keys they first saw for each one. Check that you know every device it names, then choose Start over. The devices it names keep syncing without joining again; one that is switched off takes the new key the next time it syncs. Each other device asks before it takes the new key: “device started over and removed device. Use its new key?”, or “device started over with a new key. Use it?”. Choose Use the new key only if you started over on that device, and Don’t use it if you didn’t: it isn’t asked about again, and the device can join again. Not now, or Back, puts the question away, but nothing syncs until you choose, so Settings → Sync says “A new key from device is waiting. Nothing syncs until you choose.” Choose Choose now there, or Sync now, to be asked again; opening the page or starting the app again asks too. If two devices started over at once, each is asked about with “Another device started over at the same time with a different key. Use only the one you started over on; a device that doesn’t use it can join again.”

Afterwards the page says “The recovery key you saved before no longer works. Save the new one.”

The recovery key

Save a recovery key: “If every device that syncs is lost or reset, the recovery key gets everything back. Keep it somewhere safe and private: whoever has it can read what syncs.” It is letters and digits in groups of four, the same in every language, with Copy and Hide under it. With a Master PIN set, the page first asks “Enter your master PIN”: “The recovery key is shown once the PIN is right.”

You don’t have to save one. While only one device syncs, the page reminds you: “This is the only device that syncs. Save a recovery key, so you can get everything back if you lose it.” Any device that syncs shows it again whenever you ask.

To use it, on a device that doesn’t sync, choose Use a recovery key under No other device to hand?: “Type or paste the recovery key you saved, and this device syncs again with everything on the server.” On a TV, type it with the remote. If it is refused, Troubleshooting says what each message means.

Start fresh

If every device that synced is gone and the recovery key with them, nothing can bring the synced copy back, since nobody else holds the key. Start fresh: “Lost every device and the recovery key? Start again with a new key from this device.”

It asks “Start fresh?”: “Where Sync already keeps a copy on Yonto’s server, it’s dropped once your licence’s email address confirms it, or, for a licence with no email address, after seven days if no device that still syncs answers first. Then it’s gone for good, this device syncs again with what it has, and your other devices have to join again.” On a server you run it says “Where your server already keeps a copy, it’s dropped after seven days if no device that still syncs answers first. Then it’s gone for good, this device syncs again with what it has, and your other devices have to join again.”, since your own server never sends an email. Nothing on your devices is deleted.

Where your account already syncs, a device without the key can’t drop the synced copy by itself, and neither can anyone who got hold of your licence. So it asks, and the page says Waiting to start fresh:

If your licence has an email address, a link is sent there: “We emailed your licence’s address a link to confirm. The email shows the code code, the same as here: confirm only if they match. Sync starts again here once it’s confirmed.” Open the link, check the code and choose Reset Sync. The link works for an hour. Keep Yonto Player open on the device that asked, and it starts syncing a few seconds later.
If it has none, as with a licence bought in the App Store that nobody added an email to, or on your own server, it waits seven days: “Sync starts again here on date, unless a device that still syncs answers first, which cancels it.” A device that still has the key cancels it the next time it syncs, since that device can let this one join instead.

Cancel the reset stops it.

While a request waits for its email, and for a week after one was cancelled, every device that still syncs says so: “device asked on date to start Sync fresh without the key. Your licence’s email address was sent a link to confirm it. If that wasn’t you, don’t confirm.”, or “device asked on date to start Sync fresh without the key. This device still syncs, so it was cancelled. If that was you on a new device, join from here instead.” If it wasn’t you, don’t confirm the email, and remove any device you don’t know.

If a device you don’t know keeps cancelling it, the device that asked says “Don’t know that device? Add your email to your licence, then start fresh again: it then waits for a link sent there, which no device can cancel.” In an app that sells Pro through the App Store, Add your email there opens Yonto Pro, where you add it; then choose Start fresh again. On your own server, its delete-account command drops the account (its README says how).

Your own server

You can sync through a server you run instead of ours. The sync server is open source, and it is the same program Yonto runs, minus the Pro check: get it, with how to run it in Docker, from yonto-app/yonto-player-sync-server on GitHub.

Run the server, and note its address.
In Settings, Sync, under Where it syncs, choose Your own server: “A Yonto sync server you run. On your own network an http address works; anywhere else it needs https.”
Enter its Server address, such as https://sync.example.com, and choose Turn on.
On each other device, choose Your own server with the same address, then Join.

The page then says “Syncs through address”. Each device still needs Pro to sync. The server’s README says how to put it behind HTTPS and how to let only your own licence make an account on it. Update the server when you update Yonto Player: an app and a server a version apart can stop understanding each other, and then Settings, Sync says which one needs updating rather than syncing. Your server keeps what ours would, and no more. A device that syncs with your own server sends Yonto’s server nothing; before it syncs, a Pro device only asks Yonto’s server whether your licence already syncs there.

What Yonto’s server can and cannot see

It can’t see what you sync. Every record is encrypted on your devices with AES-256-GCM under a key that never leaves them unencrypted: a device gets the key only from another of your devices, sealed so that only it can open it. So the server never sees a title, a search, a source, an address, a password or a key, and neither do we. It also can’t add a device of its own, because a device joins only when you tap on both.

To do its job, it keeps:

your licence id; each device’s licence token, sent with the install id it was issued to, is checked with Yonto’s licence service, to make sure the licence has Pro and the token is that device’s own, and neither is kept;
for each record, a scrambled id, when it was changed and by which of your devices, whether it is a deletion, and how big it is;
for each device, a random id, its kind (such as Android TV or iPhone), its two public keys, a scrambled copy of a secret of its own, and whether it was removed;
a check value made from your key, so it can tell your devices from a stranger;
while a device joins or after Start over, the key sealed to that device, until it takes it;
while you start fresh without the key, the new check value and the asking device’s kind and public key, with when it asked, until it is done or cancelled, and a week after.

From that, and the address each device syncs from, it can tell when your devices sync and roughly how much you keep. It can’t tell what you watch. The privacy policy has the details, including how long it keeps each part.

Messages

Troubleshooting has every message Sync shows, and what to do.