Licensing and privacy in our plugins
English and Romanian are the original versions; the versions in other languages are translations provided for convenience, and if they differ, the English version prevails.
Version 2026-10-13.
Every plugin talks to https://medialab.works (this domain only) for licensing, updates and, optionally, logs. Activation and check traffic is encrypted on top of HTTPS (ephemeral ECDH key + AES-256-GCM; responses are ECDSA-signed and verified by the plugin). What each plugin sends to other services, and which apps it works with, is on its product page, under What it sends where and Client compatibility.
The licensing client (in every plugin)
| When | What is sent |
|---|---|
| Activation (when the admin enters the key) | the Emby/Jellyfin server id (server_id, the installation's internal identifier), a hardware fingerprint (hw_hash — a SHA-256 computed locally from machine-id, DMI UUID/serial if readable and the lowest physical MAC address; the raw values never leave), the product slug, plugin version, SHA-256 + size of the plugin DLL, a nonce and a timestamp; the license key is never sent in clear (only its SHA-256 as an identifier; the key feeds the encryption key derivation) |
| On server start, then every 24 h (± up to 1 h, random) | the same fields over the encrypted session (activation id instead of the key) |
| Before Update / Rollback or a protected action in the pages | a fresh check only if the last successful one is older than 1 h (the platform rate-limits on-demand checks) |
| Update / Rollback (started by the admin on the License page) | download of the package from the signed URL returned by medialab.works (verified by SHA-256 / MD5 before install), then a report: operation, from/to version, success or not, error message |
| Free trial / purchase from inside the plugin (optional) | the email the admin types, chosen plan, product slug, server_id, hw_hash, plugin version, page language; payment happens on medialab.works' Stripe Checkout page, not in the plugin; the plugin then polls (every 5 s for the first hour, then every minute while the link is valid) whether the license was claimed |
| Deactivation | a deactivate request on the encrypted session |
| Log export | only when the admin clicks "Send log" or has enabled automatic sending (AutoSendLogs, off by default). Only the lines of the current server log that contain the plugin's name are sent (at most ~2000 lines, gzipped, 2 MB max) plus an optional note. With AutoSendLogs on: once a day after the check; for plugins that patch the Emby web client (Registration, Quick Connect, MediaLab TV, and Smart Skip and Share Links when their optional patch is on) also once per Emby version when the patch could not be re-applied after an Emby update. |
QR code on the License page: the payment-link QR code is generated locally, in the page, with nothing extra sent, by every Emby plugin at the latest from the versions published on 14 October 2026 (MediaLab TV from 1.2.1), and on Jellyfin by Headend from 1.0.4, MediaLab TV from 1.2.1, Rosub from 1.1.3, AISub from 0.1.3, Smart Skip from 0.1.2, Transcode Doctor from 0.1.3 and Library Doctor from 0.1.6; the other Jellyfin plugins get it in their next version. In older versions, while a trial or purchase started from the plugin waits for payment, the admin's browser loads the QR image from the third-party service api.qrserver.com, passing it the payment link (the URL of medialab.works' Stripe Checkout page). Nothing else is sent; if you don't buy from inside the plugin, this service is never contacted.
Stored locally: license state in <plugin data folder>/license/license.json (key, activation id, session secret, signed license, last check, AutoSendLogs preference).
Never sent by the licensing client: data about the server's users, titles, libraries, client IP addresses, passwords, other services' API keys. The log (only with consent) may contain whatever the plugin writes to the log (e.g. user names or titles, depending on the product).
Jellyfin: update/rollback go through Jellyfin's installer (zip + MD5) from the medialab.works plugin repository; after a rollback, Jellyfin's automatic update for that plugin is turned off until the next Update on the License page. The public Jellyfin catalog always offers the newest version: with a lifetime license whose update window has ended, a newer version installed by Jellyfin's automatic plugin updates stops with "version not licensed" until you roll back or buy an update pass (see the FAQ).
Without a valid license (or after the grace period) the plugin falls back to limited mode; it sends nothing extra.
The personal data we keep on our side (account, licenses, server ids, IP addresses seen by the license server) and your rights are described in the Privacy policy.
Supported server versions
- Emby: 4.10.1.0 or newer (Emby packages are published with
min_emby = 4.10.1.0; tested on Emby 4.10.1). - Jellyfin: 12.x (targetAbi 12.2.0.0, .NET 10), tested on Jellyfin 12.2 and on the medialab Server fork (12.2-ml). Jellyfin 10.x is not supported. Jellyfin plugins ship under GPL-3.0 with source.
Compatibility legend
The Client compatibility section of each product page uses these marks:
- ✅ verified (end-to-end or on-device test)
- 🟢 server-side, client-independent (by design, no client-specific test)
- ➖ not applicable
- ❔ not tested