Please report security problems privately through GitHub: Security → Report a vulnerability on this repository, rather than in a public issue.

MosaicPlayer plays local files and URLs with mpv (web pages through yt-dlp, if installed). It only goes online for those URLs and when you choose Help → Check for updates. It doesn't collect or send any data.