Privacy is not an afterthought;
it is a core feature.

We explain why we need data — not just what we collect.

• The app works fully without any account with us. If you never sign in, we receive none of your personal data.
• A cloud account is optional: if you sign in with Apple or Google, your profiles, favourites, watch progress, settings and (for profiles you sync) your IPTV credentials are stored on our servers.
• Your IPTV credentials stay in your device's secure storage; with sync on, they are additionally stored on our servers encrypted (AES-256-GCM).
• We show ads — personalized if you allow it, non-personalized if you do not. Premium subscriptions remove them entirely.
• You can delete your cloud account and everything in it from inside the app, at any time.

Data controller and contact

The app is provided by the Hany IPTV Player team ("we", "us"). We are the data controller for the cloud account described in section 4. For any privacy question you can reach us at [email protected].

Information the app handles locally

The app processes the following information locally on your device so that it can function:

• Service connection details you enter: the Xtream Codes server URL, username and password of your own IPTV subscription.
• Catalogue data retrieved from your provider (channels, movies, series, programme guide) so it can be shown quickly and offline.
• Your activity within the app: watch progress, favourites, downloaded items, profiles and your preferences (language, playback, subtitles, parental lock).

Sync between your own devices — entirely optional

The app can keep your own data in sync across your own devices. This is entirely optional and off until you sign in; every feature of the app works without it.

Signing in: you can use Sign in with Apple or Google. We never see your Apple or Google password. From the provider we receive a stable identifier for your account, your email address, and — only on the first sign-in — your display name. If you use Apple's Hide My Email, we only ever receive and store the relay address Apple generates. One cloud account can hold both an Apple and a Google identity; linking a second one is always a deliberate action taken in Settings.

What is stored on our servers while you are signed in:

• Your account record: the provider identifier, email address, and display name if the provider supplied one.
• Your IPTV profiles (their names and settings), favourites, watch progress, subtitle preferences and app settings.
• Your IPTV credentials for the profiles that are synced — stored encrypted, see section 6.
• Your devices: a device name, platform and the time each device last synced, so you can see and revoke them.
• Your Premium status: the app verifies your purchase with Google Play or the App Store and stores the result so Premium follows you across your devices.

What we do not collect

• Nothing at all, unless you choose to sign in — the app is fully usable with no account.
• No personalized ads unless you allow them: you decide in the App Tracking Transparency prompt on iOS, in the consent form in Europe, and in your device settings anywhere (see section 13).
• No first-party analytics: we do not measure how you use the app.
• No location collected by us. (The ad SDK may derive an approximate, IP-based location — see section 13.)
• No payment details: purchases are processed entirely by Google Play or the App Store.
• No selling or sharing of personal data with data brokers or advertisers — ever.

Your IPTV credentials

The username and password you enter for your IPTV service are stored on your device in the platform's dedicated secure store — the Android Keystore or the iOS Keychain. They are never written to logs and never placed in ordinary app storage. They are used to build the requests the app sends directly to your provider.

If you enable the optional cloud account, the credentials of the profiles you sync are also stored on our servers so the same profile can open on your other devices. They are protected with envelope encryption: each profile's secret is encrypted with AES-256-GCM under its own data key, and that key is itself encrypted with a master key that is kept outside the database. Someone who obtained a copy of the database alone could not read them. If you never sign in, your credentials never leave your device.

Your IPTV provider (third party)

When you play or download content, the app connects directly from your device to the IPTV service you configured. That provider is an independent third party that we do not control. Their servers will receive the network requests necessary to stream content (which may include your IP address and the credentials you supplied to them). The handling of that data is governed by your provider's own privacy policy and terms, not this one.

On-device storage and downloads

Cached catalogue data, images, watch history, favourites and settings are stored in the app's private storage on your device. Downloads are written to app-private storage that other apps cannot read, and are never uploaded anywhere — downloaded video files are not part of cloud sync. You can delete individual downloads, clear cached data, or remove all app data at any time.

Device permissions

• Network / internet — required to reach your IPTV provider.
• Storage — used only for the app's own private cache and your downloads.
• Notifications — optional, used to show download progress. You can decline; downloads still work.
• Biometric / device credential — optional, only if you enable the parental content lock. Verification is performed by the operating system; we never receive your biometric data. Your parental PIN is stored only as a salted hash in secure storage.

Children

The app is a general-audience media player and is not directed at children under 13. Because the available content comes entirely from the service you connect, the app includes an optional parental content lock (PIN, optional biometric, and an automatic adult-content filter that is on by default) so a responsible adult can restrict access. We do not knowingly collect any personal data from children.

Retention and deletion

You control your data.

Under the EU General Data Protection Regulation and Türkiye's Law No. 6698 (KVKK), you have rights to access, rectify, erase, restrict and port your personal data, and to object to processing. If you never signed in, we hold no personal data about you and you can exercise these rights directly on your device. If you use the optional cloud account, you can view your synced data in the app, correct it by editing it, and erase all of it with the in-app deletion described in section 11. For any request we cannot serve in the app — including a copy of your data — contact us at [email protected] and we will respond. You may also lodge a complaint with your local data protection authority.

Advertising and in-app purchases

The free version of the app shows ads served by Google AdMob. Whether those ads are personalized is your decision. On iOS the App Tracking Transparency prompt is shown; if you decline, ads still appear, they are simply not personalized. On Android the app may use the advertising ID, and you can turn that off at any time in your device settings (Settings → Privacy → Ads). Where required by law, Google's consent flow (UMP) is shown, and a persistent Privacy options entry in the app's settings lets you change your mind at any time. The Google Mobile Ads SDK processes limited data (such as coarse device information, an approximate IP-based location, the advertising ID, and diagnostics) to deliver ads, prevent fraud and measure performance; this is governed by Google's privacy policy.

Premium removes all ads and the daily download limit. It is available as a monthly or yearly subscription, or as a one-time lifetime purchase. Payment is processed by Google Play or the App Store — we never receive your payment details. Subscriptions renew automatically until cancelled; you can cancel at any time in your store account settings. These purchases remove the in-app advertising experience and download limit only; they are not an IPTV subscription.

Changes

We may update this policy as the app evolves. Material changes will be reflected here with a new "last updated" date. Continued use of the app after an update means you accept the revised policy.

Contact

Questions about this policy or your privacy: [email protected]