Households

Profiles and parental controls

Give everyone on the couch their own profile, lock the grown-up ones with a PIN, and cap what a kids profile can see.

4 min read

One account can hold up to 6 profiles: separate watch histories, watchlists, and recommendations for everyone in the household, behind one sign-in. Profiles are not extra accounts; they share the account's libraries and permissions, and they follow you to every device, including app.tofa.tv.

What a profile keeps to itself#

Each profile has its own Continue Watching, watched marks, watchlist, "not interested" choices, playback preferences, and avatar. Switching profiles switches all of it at once.

Everything about access stays on the account: which libraries you can see, admin rights, and quality caps are set per person by the server admin, not per profile.

Every account starts with a primary profile named after the account. It can't be deleted; it is the one that carries the household keys (more on that below).

Creating and editing profiles#

Open Settings, then Profiles. Add a profile, pick a name, and choose an avatar: your initials on a color, or one of the preset characters. Each profile can also toggle Save watch history off, useful for a guest profile that shouldn't leave tracks in Continue Watching.

People you share your server with get their own profiles too, managed from their own account. Profiles are always private to the account that owns them; not even the server admin can see or edit another account's profiles.

Kids profiles#

A kids profile changes two things, and it helps to know they are separate:

The content cap is the real control. Every profile can carry a content rating limit, using the familiar US movie and TV ladder (G, PG, PG-13, TV-Y through TV-MA, and so on). The limit is enforced by the server on every surface: browse, search, home rows, artwork, playback, requests, downloads, everything. It is not a hidden menu; restricted titles simply don't exist for that profile.

Kids mode simplifies the app. Marking a profile as a kids profile strips the interface down to Home, Browse, and Search, and removes settings, history, and admin entirely. A kids profile always has a rating cap; if you don't pick one it defaults to TV-PG.

A title with no rating is blocked, not allowed

When a profile has a rating cap, a title whose rating we don't know is treated as restricted. That is the safe direction, but it means an obscure title can vanish for capped profiles until an admin sets a rating on its edit page.

Profile PINs#

Any profile can have a 4-digit PIN. It does two jobs:

On any profile, the PIN locks the profile on the "Who's watching?" screen, so the kids can't open your profile and wade through your Continue Watching.
On the primary profile, the PIN also locks profile management for the whole account. Creating, editing, or deleting profiles, and changing any PIN, then requires it. This is what makes a kids cap actually stick: without a PIN on the primary, a clever kid can just edit their own profile.

When you unlock a profile to watch, you can choose to remember the unlock on that device so your own TV doesn't ask every evening. Management always asks. Changing or removing a PIN signs out every remembered device immediately, and repeated wrong guesses make the keypad wait longer between attempts.

PINs are stored only as salted hashes, and they are a household boundary, not account security. For the account itself, see Protect your account.

Older TV apps and a locked primary profile

Apple TV and Android TV builds released before profiles existed can't enter a PIN. If you lock your primary profile, those old builds stop loading content for the whole account until they're updated.

Switching profiles#

The app asks "Who's watching?" when it opens, unless the account has a single profile, in which case it skips straight in. Mid-session, open the avatar menu and choose Switch profile. Switching never asks for the account password, only a PIN where one is set.

Notes for admins#

Admin rights belong to the account and are available from the primary profile. A kids profile hides the admin area as part of its simplified chrome, but the enforced boundary is the rating cap, which the server applies regardless of what the app shows.
Deleting a profile permanently deletes its watch history. The primary profile can't be deleted.
Profiles, their histories, and their watchlists sync through your account, so they appear on app.tofa.tv and on every device you sign in to.

Still stuck? Getting help & feedback covers what to send us.