# Boxee.TV Helps Its Self To Your Viewing Habits

[Boxee](https://www.boxee.tv/) is an application for streaming video from the
Internet and from machines on your local network. I run it on my <abbr
title="Home Theatre Personal Computer">HTPC</abbr>. I recently noticed some
strange <abbr title="Hyper Text Transfer Protocol">HTTP</abbr> traffic
originating from my HTPC. Whenever you attempt to watch a programme with Boxee,
a HTTP POST request is made to http://app.boxee.tv/action/add containing <abbr
title="Extensible Markup Language">XML</abbr> in the POSTed data, of the
following format:

```html
<message type="watch">
  <timestamp>1306583038</timestamp>
  <object type="tv_show">
    <boxee_id>[Numerical ID Scrubbed]</boxee_id>
    <episode>2</episode>
    <func_ref>new</func_ref>
    <name>Tis Better to Have Loved and Flossed</name>
    <season>1</season>
    <show_id>891118</show_id>
    <show_name>Breaking In</show_name>
    <thumb>http://boxee-proxy.appspot.com/400x0x85/?url=http%3A%2F%2Fthetvdb.com%2Fbanners%2Fepisodes%2F206751%2F4033031.jpg</thumb>
  </object>
</message>
```

I'm not 100% comfortable with them having a list of everything I watch, and the
date/time that I watch it. I emailed [privacy@boxee.tv](mailto:privacy@boxee.tv)
three weeks ago to ask them how they store this data and why they're collecting
it. They ignored me and didn't reply. Not the sort of behaviour you'd expect
from a company that should be concerned with their users privacy. Their [privacy
policy](https://www.boxee.tv/privacy) doesn't state that they collect this data.

As a temporary fix, I have modified my networks transparent web proxy to block
requests to http://app.boxee.tv/action/add and I haven't noticed any negative
impact or loss of functionality in Boxee.

One of the things Boxee does is scan your media and fetch thumbnail images. This
also potentially leaks the content of your library, but is unavoidable if you
want to fetch images. They don't provide an option to disable this. I would like
Boxee to come out and state that they simply don't log requests for thumbnail
images, or that it at least is anonymised and purged on a very regular basis. I
doubt this is the case though.

I think I'm going to give [XBMC](https://xbmc.org/) another try. I don't need
any of the social features of Boxee, and I rarely use it to watch anything other
than videos on my <abbr title="Network Attached Storage">NAS</abbr> anyway. I'm
glad I built my own HTPC now, rather than buying a [Boxee
Box](https://www.boxee.tv/box).