By Klaus Jakobsen, developer of A Decent Remote The category has a reputation, and it is mostly deserved. But the thing people worry about and the thing that actually costs them are rarely the same thing.
The worry is usually the permission prompt. That turns out to be the narrow part. The real problems in this category are commercial: a weekly charge designed to read as small, and an advertising SDK you agreed to without noticing.
What does Local Network permission actually grant?
It lets an app talk to devices on the Wi-Fi you are connected to. That is the whole scope.
It does not grant access to your files, your photos, your messages, your other apps, your browsing history, or anything at all beyond your own network. iOS treats those as separate permissions, and an app that never asks for them never gets them.
There is a second safeguard that almost nobody knows about, and it is worth knowing because it is checkable. Since iOS 14, an app cannot simply go looking for whatever it likes on your network. It has to declare in advance, inside the app itself, which service types it is allowed to browse for, and iOS enforces that list. An app that did not declare a service type cannot discover it, no matter what its code tries.
For A Decent Remote that declared list is fifteen entries long and every one of them is a TV protocol: Chromecast, Android TV, AirPlay, LG, Samsung, Sony, Roku, Hisense, Apple TV. There is nothing else in it, because there is nothing else the app is permitted to look for.
The honest limit of that safeguard: the declaration constrains automatic discovery, not every possible connection. An app with Local Network permission can still open a connection to an address on your network if it already knows the address. So the declaration is a real constraint on what an app can go hunting for, not a cage. Anyone telling you the permission is either “totally safe” or “spyware” is skipping this distinction.
Why does the app need it at all?
Because that is the entire mechanism.
Your TV is a device on your network with an address, listening on a port, speaking a protocol its manufacturer designed. A remote app finds it and sends it commands. There is no cloud service in the middle for most brands, and no account. The phone talks to the TV directly, over your own Wi-Fi, and the traffic never leaves your house.
That is also why these apps fail the moment the phone is on a different network from the TV, which is the single most common support question in the category. Guest Wi-Fi, a 5 GHz and 2.4 GHz split, or a phone that quietly stayed on cellular will each produce the same empty device list. That is a network problem, not a broken app.
What does the pairing PIN prove?
That whoever is pairing can see the TV screen.
It is a physical-presence check. The TV displays a number, you type it into the phone, and the TV now knows the person holding that phone is in the room. It stops a neighbour on the same network, or a guest, from quietly pairing with your set.
What it is not is a guarantee about everything that follows. Different brands protect the session that comes after very differently: some encrypt it properly, some authenticate once and then trust the connection. Brands that use a simple allow prompt on screen rather than a PIN are proving the same presence in a lighter way.
This is worth understanding for a practical reason: an app cannot pair a TV from another room, and any app promising setup with no interaction at the TV is either wrong or talking about a brand that genuinely needs none.
Is “works with all TVs” true?
No, and it is the single most reliable warning sign on a listing.
Every manufacturer built its own control protocol. Supporting a brand means implementing that brand’s protocol, testing it, and keeping up when the manufacturer changes it between model years. An app supports the brands somebody actually did that work for. There is no universal standard underneath that makes the rest come free.
Three things no app can do, whatever the listing says:
- Control a TV that has no network control. Most sets made before roughly 2012 accept only infrared. There is nothing to connect to.
- Send infrared from an iPhone. No iPhone has ever had an IR blaster. This is a hardware fact, and it is why an old TV needs a different answer entirely.
- Reach a TV on a different network. See above.
So a listing that names brands, model years and their quirks is telling you it has done the work. A listing that says “all TVs” is telling you it would rather you did not ask.
How is a free remote app paid for?
This is where the actual money goes, and it is the part worth more attention than the permission prompt.
We read the App Store listings of the ten biggest universal remote apps on 6 September 2026:
| How it is paid for | How many of the ten |
|---|---|
| Sells a subscription | 10 of 10 |
| Sells a weekly plan specifically | 9 of 10 |
| Declares advertising on its App Store listing | 7 of 10 |
A weekly plan is the thing to look at twice, because a weekly number is designed to read as small. At $6.99 a week you are paying $363 a year for a remote control. The full price comparison puts all ten side by side, with the plan each one shows you first.
How do I check an app before I pay?
Four things, all visible on the App Store listing before you install, and none of them takes more than a minute.
- Tap the In-App Purchases list. This is the real price, not the “Get” button. If there is a weekly plan, multiply it by 52 and see whether you still want it.
- Look for a declared advertising disclosure. Seven of the ten biggest have one.
- Read the privacy label, specifically “Data Used to Track You”. Tracking means linking your activity to data from other companies’ apps and websites. An app that does none of this shows nothing in that section, and on iOS it also never shows you a “allow tracking” prompt.
- Read the description for brand names. Specific brands, protocols and honest exceptions mean somebody did the work. “All TVs” means nobody wants to be pinned down.
What does A Decent Remote do?
Since this page is asking you to be sceptical, here is the same audit applied to us. All of it is checkable rather than promised.
Permissions: one. Local Network. No camera, no microphone, no photos, no contacts, no GPS location. Those are not requested, so they cannot be granted. There is also no App Tracking Transparency prompt, because there is nothing tracking you across other companies’ apps.
What we do collect, plainly: analytics about how the app is used, your TV’s brand, model and operating system, app and phone information, and a random per-install identifier. Crash and connection diagnostics can include private network addresses when something fails. For a small number of purchase diagnostics, the public IP is used to derive a country and city. Analytics never include what you type on the remote keyboard or what you watch. All of that is written out in full in the privacy policy, which is worth reading rather than taking our word for.
What is not there: no accounts, no ads at any point, no selling or sharing data with advertisers, no cross-app tracking, no weekly plan.
What it cannot do: it cannot control a TV with no network control, it cannot send infrared, and it cannot reach a TV your phone is not on the same network as. Nobody’s app can.
If you want to test the claim rather than read about it, A Decent Remote scans and lists what it finds on your network: Samsung, LG, Sony, Roku, Fire TV, Apple TV, Vizio, Hisense, Philips, Panasonic, Toshiba, Android TV, Google TV and Chromecast. If your TV is not in that list, it will tell you so instead of taking your money first.
