1. Data Controller

Company: IPTV Pro Stream Player

Location: Spain (European Union)

Contact email: iptvprostreamplayer@gmail.com

Website: https://iptvprostreamplayer.com

Data Protection Officer (DPO): Currently we do not have a legal obligation to designate a Data Protection Officer (DPO), but you can contact us directly at the email above.

2. Introduction

At IPTV Pro Stream Player we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what data we collect, why we collect it, how we use it, and what your rights are.

Important: This application is an IPTV player that DOES NOT provide content. Users must configure their own IPTV playlists from external providers.

This policy complies with the General Data Protection Regulation (GDPR) and applicable data protection laws in the European Union.

3. Data We Collect

3.1 Technical Data (Without Consent - Legitimate Interest)

To ensure the stability and security of the application, we collect minimal technical data when critical errors (crashes) occur:

• Application version
• Android version
• Device type (Android TV or mobile)
• Device manufacturer and model
• Error information (stack trace)

Legal basis: Legitimate interest (Art. 6.1.f GDPR) - Necessary to ensure the stability and security of the application.

Recipients: Firebase Crashlytics (Google LLC)

Retention period: Data is retained for the period defined by Firebase Crashlytics (typically 90 days).

3.2 IPTV Configuration Data (WITH Consent)

IMPORTANT: We only collect this data if you explicitly accept data analysis through the consent dialog when starting the application.

If you accept, we collect:

• IPTV server URL (encrypted with AES-256)
• IPTV server username (encrypted with AES-256)
• IPTV account type (Xtream Codes or M3U)
• Anonymous user ID (randomly generated, not linked to your identity)

Why do we use this data?

• To investigate and resolve issues specific to IPTV providers
• To improve compatibility with different servers
• To diagnose connection or playback errors
• To analyze app usage to improve user experience

How do we protect this data?

• URL and username are sent encrypted with AES-256-GCM
• Algorithm: AES-256-GCM (Advanced Encryption Standard, Galois/Counter mode)
• Key size: 256 bits (maximum security)
• Only we have the decryption key
• Analytics services (Firebase, Amplitude) only see encrypted data
• We do not share decrypted data with third parties
• Each encryption uses a unique and random IV (initialization vector)

Legal basis: Consent (Art. 6.1.a GDPR)

Recipients:

• Firebase Analytics (Google LLC)
• Firebase Crashlytics (Google LLC)
• Amplitude Analytics (Amplitude Inc.)

Retention period:

• Firebase: 14 months (configurable)
• Amplitude: 10 years (according to their terms, but you can request deletion)

3.3 Behavioral Data (WITH Consent)

If you accept data analysis, we also collect:

• Screens visited (Home, Settings, Player, etc.)
• Usage events (playback started, playback error, etc.)
• Session duration
• Application language
• Player settings (aspect ratio, etc.)

Legal basis: Consent (Art. 6.1.a GDPR)

Recipients: Firebase Analytics, Amplitude Analytics

3.4 Data Stored Locally

The following data is stored only on your device and NOT sent to external servers:

• Your IPTV account settings (URL, username, password)
• Favorites
• Playback history ("Continue watching")
• Category settings (hide/show, sorting)
• Parental control PIN
• Application preferences

Security note: Currently this data is stored unencrypted. We recommend using parental controls and device security to protect access to the application.

4. Cloud Synchronization (Signed-In Users)

If you choose to create an account and sign in, your data will be synchronized to our cloud servers to enable access from multiple devices.

4.1 Authentication Providers

We offer sign-in through the following third-party authentication providers:

• Google Sign-In (Google LLC, United States)
• Apple Sign-In (Apple Inc., United States)

When you sign in, we receive only your basic profile information (name, email, profile picture) from these providers. We do not receive or store your Google or Apple password.

For more information about how these providers handle your data:

• Google Privacy Policy: https://policies.google.com/privacy
• Apple Privacy Policy: https://www.apple.com/legal/privacy/

4.2 Data Synchronized to Cloud

When signed in, the following data is stored on Firebase (Google Cloud) servers:

4.3 IPTV Credentials Security

Your IPTV server credentials (URL, username, and password) are encrypted on your device using AES-256-GCM encryption before being transmitted to our servers. This means:

• Our servers store only encrypted data
• Only the app on your devices can decrypt your credentials
• Neither we nor any third party can read your IPTV passwords

4.4 Legal Basis for Cloud Sync

The legal basis for processing your synchronized data is Contract (GDPR Article 6.1.b). Cloud synchronization is a service you explicitly request by choosing to sign in. Without storing this data, we cannot provide the synchronization service.

4.5 Data Retention for Cloud Data

• Active accounts: Data retained indefinitely while account is active
• Deleted accounts: All data permanently deleted within 30 days
• Inactive accounts: Data retained for 2 years after last sign-in, then deleted

4.6 Users Without an Account

If you choose not to sign in:

• Your playlists and settings remain only on your device
• No data is sent to our cloud servers
• You can use all app features locally
• Data is deleted when you uninstall the app

4.7 Managing Your Cloud Data

You can manage your synchronized data at any time:

• Sign out: Disconnect your account and return to local-only mode
• Delete account: Remove all your data from our servers permanently (Settings → Account → Delete Account)
• Export data: Request a copy of your data by contacting iptvprostreamplayer@gmail.com

5. Consent

5.1 When We Request Consent

When starting the application for the first time, we show you a consent dialog that explains:

• What data we collect
• Why we use it
• With whom we share it
• How you can withdraw consent

5.2 How to Withdraw Consent

You can withdraw your consent at any time without affecting the lawfulness of previous processing:

1. Go to Settings → Privacy and Data
2. Disable the "Allow data analysis" switch
3. From that moment, no more behavioral or configuration data will be sent to analytics services

Note: Data already collected before withdrawing consent will be retained for the indicated period, unless you request its deletion (see section 7.3).

6. With Whom We Share Your Data

6.1 Data Processors

We use the following third-party services that act as data processors:

Firebase (Google LLC)

• Services: Analytics, Crashlytics
• Location: United States (transfer with standard contractual clauses)
• Privacy policy: https://firebase.google.com/support/privacy
• Certification: Privacy Shield (although invalidated, Google uses standard contractual clauses)

Amplitude Analytics (Amplitude Inc.)

• Service: Analytics
• Location: United States
• Privacy policy: https://amplitude.com/privacy
• Certification: SOC 2 Type II

Authentication Services

• Google Sign-In (Google LLC) - for account authentication
• Apple Sign-In (Apple Inc.) - for account authentication

6.2 International Transfers

Your data may be transferred outside the European Economic Area (EEA) to the United States. These transfers are protected by:

• Standard Contractual Clauses approved by the European Commission
• Additional security measures (data encryption in transit and at rest)

6.3 We DO NOT Share with Third Parties for Marketing

We DO NOT sell, rent or share your personal data with third parties for marketing or advertising purposes.

7. Your Rights under GDPR

As a user in the European Union, you have the following rights:

7.1 Right of Access (Art. 15 GDPR)

You can request a copy of the personal data we hold about you.

How to exercise it: Send an email to iptvprostreamplayer@gmail.com with subject "Access Request - GDPR"

Response time: 30 days (1 month according to GDPR Art. 12.3)

Identity verification: For security reasons, we will need to verify your identity before providing your data.

Data format: We will send you a JSON file with all your personal data, including technical data, IPTV configuration (decrypted), and analytics information.

7.2 Right to Rectification (Art. 16 GDPR)

You can request that we correct incorrect or incomplete personal data.

How to exercise it: Send an email to iptvprostreamplayer@gmail.com with subject "Data Rectification Request - GDPR" indicating which data is incorrect and what the correct value should be

Response time: 30 days (1 month according to GDPR Art. 12.3)

Note: Some data (like IPTV configuration) automatically updates when you change it in the app settings.

7.3 Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR)

You can request the deletion of your personal data.

How to exercise it: Send an email to iptvprostreamplayer@gmail.com with subject "Data Deletion Request - GDPR"

Response time: 30 days (1 month according to GDPR Art. 12.3)

Identity verification: For security reasons, we will need to verify your identity before processing your deletion request. We may ask you to provide information such as your playlist name, IPTV server URL (domain), or username.

Important: We will delete your data from our systems and request its deletion from processors (Firebase, Amplitude). However, backup copies may be retained for an additional period according to the processors' retention policies. Crashlytics data will be anonymized within 90 days according to Google's policies.

7.4 Right to Data Portability (Art. 20 GDPR)

You can request to receive your personal data in a structured, commonly used and machine-readable format (JSON).

How to exercise it: Send an email to iptvprostreamplayer@gmail.com with subject "Data Portability Request - GDPR"

Export format: JSON (structured format that can be used in other IPTV applications)

Response time: 30 days (1 month according to GDPR Art. 12.3)

Identity verification: For security reasons, we will need to verify your identity before providing your data.

7.5 Right to Object (Art. 21 GDPR)

You can object to the processing of your personal data based on legitimate interest.

How to exercise it: Send an email to iptvprostreamplayer@gmail.com with subject "Objection to Data Processing - GDPR" indicating which processing you object to

Response time: 30 days (1 month according to GDPR Art. 12.3)

Note: For objection to analytics, you can also disable it directly in the app (see section 7.6 below).

7.6 Right to Withdraw Consent (Art. 7.3 GDPR)

You can withdraw your consent for data analysis at any time without affecting the lawfulness of previous processing.

How to exercise it: Go to Settings → Privacy and Data and disable the "Allow data analysis" toggle

Effect: No more behavioral or configuration data will be sent to analytics services from that moment forward. Data already collected will be retained for the indicated period unless you request deletion (see section 7.3).

7.7 Right to Lodge a Complaint

If you believe we have not properly addressed your rights, you can lodge a complaint with the data protection authority in your country:

• Spain: Spanish Data Protection Agency (AEPD) - www.aepd.es
• Other EU countries: Full list at https://edpb.europa.eu/about-edpb/board/members_en

8. Data Security

8.1 Technical Measures

We implement security measures to protect your data:

• Encryption in transit: HTTPS/TLS for all communications
• Encryption of sensitive data: AES-256 for URL and username before sending
• Secure authentication: Authenticated connections with Firebase
• Data minimization: We only collect what is strictly necessary

8.2 Organizational Measures

• Limited access: Only authorized personnel access the data
• Periodic reviews: We audit compliance with this policy
• Training: Our team is trained in data protection

8.3 Limitations

Important: Data stored locally on your device (IPTV credentials, favorites, etc.) is NOT encrypted. We recommend:

• Using your device's screen lock
• Activating the app's parental controls
• Not sharing your device with unauthorized persons

9. Data Retention

9.1 Data in Analytics Services

• Firebase Analytics: 14 months (by default)
• Firebase Crashlytics: 90 days
• Amplitude: 10 years (according to their terms)

Note: You can request early deletion by submitting a request (see section 7.3).

9.2 Local Data

Data stored on your device is retained until:

• You uninstall the application
• You clear the app data from Android Settings
• You use the "Delete list" function in the app

10. Children's Privacy

This application is NOT directed at children under 16 years of age.

If you are a parent/guardian and discover that your child has provided personal data without your consent, contact us at iptvprostreamplayer@gmail.com so we can delete it.

We recommend using the application's parental controls to restrict access to inappropriate content.

11. Links to Other Websites

Our Service may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

12. Changes to This Privacy Policy

We may update this Privacy Policy occasionally to reflect:

• Changes in our data practices
• Changes in legislation
• Security improvements

We will notify you of changes through:

• A notice in the application
• Updating the "Last updated" date above

Important changes (that affect your rights) will require your renewed consent.

13. Contact

13.1 Privacy Inquiries and GDPR Requests

Email: iptvprostreamplayer@gmail.com

For general privacy inquiries:

• Subject: "Privacy Inquiry - IPTV Pro Stream Player"
• Response time: 30 business days

For GDPR rights requests (Access, Deletion, Portability, Rectification, Objection):

• Subject: Use specific subjects mentioned in section 6 above (e.g., "Access Request - GDPR", "Data Deletion Request - GDPR", etc.)
• Response time: Maximum 1 month (30 days) according to GDPR Art. 12.3
• Identity verification: We will need to verify your identity before processing your request for security reasons

Note: To withdraw your consent for data analysis, you can do it directly in the app: Settings → Privacy and Data → Disable "Allow data analysis" toggle. No email required.

14. Legal Bases - Summary

15. Additional Information for Google Play Data Safety

This section summarizes information for the "Data Safety" section of Google Play:

Data Collected:

Without Consent (Crashes):

• Diagnostic information (crashlytics)

With Consent:

• App configuration (encrypted IPTV URL, encrypted username)
• App interactions (screens visited, events)
• Device information (Android version, type)

Data Use:

• Data analysis
• App functionality
• Bug fixes

Sharing:

• Yes, with data processors (Firebase, Amplitude)
• No, with third parties for marketing

Encryption:

• Data is encrypted in transit (HTTPS)
• URL and username are encrypted before sending (AES-256)

Deletion:

• Users can request data deletion

16. Frequently Asked Questions (FAQ)

Do you collect my IPTV server password?

NO. We NEVER collect IPTV server passwords. Only the URL and username (encrypted), and only if you accept data analysis.

Can you see what content I play?

NO. We do not collect information about what programs, movies or channels you play. Only generic events like "playback started" or "playback error".

Can I use the app without accepting data analysis?

YES. You can refuse consent and use all app functionalities. Only minimal technical data will be sent in case of critical crashes (to ensure stability).

How can I exercise my GDPR rights (access, deletion, etc.)?

It depends on the right:

• To withdraw consent for analytics: You can do this directly in the app by going to Settings → Privacy and Data and disabling the "Allow data analysis" toggle. No email required.
• For all other rights (Access, Deletion, Portability, Rectification, Objection): Send an email to iptvprostreamplayer@gmail.com with the appropriate subject line (see section 7 for specific subjects). We will verify your identity and respond within 30 days as required by GDPR.

What does it mean that data is "encrypted"?

It means that before sending your URL and username to analytics services, we encrypt them with a strong algorithm (AES-256). Analytics services only see an incomprehensible string. Only we have the key to decrypt them when investigating reported issues.

Do you sell my data?

NO. We never sell, rent or share your data with third parties for marketing or advertising.

Is local data encrypted?

Currently NO. Data stored on your device (IPTV credentials, favorites, etc.) is saved unencrypted. We are working on adding local encryption in future versions. Meanwhile, protect your device with a PIN/password and use the app's parental controls.