An app often needs a credential: an API token, a password, a private dashboard URL. Handing that to a screen is handing it to a computer standing in a public space, sometimes one you do not own.
Where an app runs is decided by that, not by how capable the hardware is.
A ScreenlyOS device can hold a secret
Secrets are encrypted to the individual device, using a public key that device published when it was paired. A player with no key gets no secrets at all.
The playlist a ScreenlyOS device receives therefore carries a secrets section only that device can decrypt. The plaintext exists nowhere else: not in the playlist as it travels, not in another device’s copy, not in the dashboard.
Decryption happens on the device and the key never leaves it. On a Player Max that key lives in a Trusted Platform Module, a chip that holds it in hardware and will not surrender it even to someone with the device open on a bench. On other ScreenlyOS hardware it is a device-specific certificate on disk.
Two properties follow, and they are the point:
A secret encrypted for one device cannot be decrypted on another. Stealing a player does not get you the fleet.
Nobody can read a secret back, including you. They are write-only once saved. See Settings and secrets.
That is possible because ScreenlyOS is ours end to end. The operating system is locked down, there is no shell to drop to, and no way to run something alongside the player that watches what it does.
A browser cannot
Screenly Anywhere runs as a web application on an operating system we do not control: an Android box, a smart display, a laptop somebody also uses for other things.
In that environment, anything the page holds is reachable. Developer tools show the source, the storage and every request it makes. Another app on the device may be able to read what the browser stores. The person who owns the device is, quite reasonably, an administrator of it.
So a credential delivered there is a credential disclosed. Not because Anywhere is badly built, but because a browser tab is not a place a secret can be kept from the person at the keyboard.
What we do instead
The playlist an Anywhere screen receives contains no secrets at all. There is no encrypted section, because there is nothing safe to put in one.
Instead, the app runs on our infrastructure, where the credential can be used without being exposed, and the screen is sent an image of the result.
The screen shows the right thing and it stays current. What it never receives is the token that produced it.
What this buys beyond the secret
Rendering on our side moves the whole execution out of the device, which tightens more than credential handling.
The app has no access to the device’s local network. It cannot reach anything on the network the screen sits on, which matters when that screen is in a customer’s building or on a network you do not own.
It has no access to the device’s filesystem or to anything else running on it.
Requests come from our infrastructure, not from the screen. An API restricted by IP address allows us, once, rather than every screen’s changing address.
That is a stricter isolation boundary than running locally, not a weaker one.
The trade, stated honestly
A screenshot is a picture. It refreshes on an interval rather than updating continuously, so anything that animates, or reacts to the moment rather than to the data, will not do so.
For the content this affects, dashboards, calendars, news, menu boards, the difference is invisible: they are pictures of data that changes every few minutes anyway.
For an app built around motion, run it on ScreenlyOS.
The same reasoning elsewhere
Web pages on Anywhere can be rendered either way, and the same logic applies to the choice. See Displaying a web page.
Client certificates are ScreenlyOS only for exactly this reason: the certificate is the device’s identity, and an identity a browser tab could export is not an identity. See Authenticated pages.
Tailscale is ScreenlyOS only on the same grounds. Joining your private network is a capability you grant a device you trust. See Reaching your private network.
Choosing with this in mind
If an app carries a credential that matters, put it on ScreenlyOS. You get local execution and a hardware-backed secret in the same decision.
If the content is public, or the app reads from something you are content to have rendered centrally, Anywhere is a perfectly good answer and costs you nothing you will notice.