IPTV Deck Privacy Policy

1. Who we are

IPTV Deck (“the App”) is made by Zbigniew Szepczyński Software (“ZS Software”, “we”, “us”), a business run by Zbigniew Szepczyński at ul. Kobierzyńska 8/120, 30-363 Kraków, Poland. We are the controller of the personal data described in this policy. For anything related to your privacy, write to mistyksu@gmail.com.

This policy covers the App on phones, tablets, TVs and computers, and the online services behind it: your account, sync, Premium, pairing your devices and the web panel (section 3.6).

2. In short

• Your channel catalog, TV guide, recordings, downloads and caches stay on your device. We never receive them. When you sign out, the App deletes your account's data from the device (your playlists, history, profiles, settings and saved sign-ins); recordings and downloads stay unless you choose to delete them.
• Your device talks to your IPTV provider directly. Playlists, guides and streams do not pass through our servers.
• If you sign in, your setup syncs through our cloud so it follows you to your other devices. Section 3 lists exactly what that includes and who can read it.
• We do not show ads, do not sell or rent your data, do not use advertising identifiers and do not track you across other apps or websites.

3. What we store and why

3.1 On every installation, signed in or not

• Free trial record: a device identifier (the Android ID on Android, the identifier for vendor on Apple devices) and the date your free trial started, so that the trial cannot be restarted by reinstalling the App.
• Security checks: the App proves to our servers that it is a genuine copy with Firebase App Check (Google Play Integrity on Android, App Attest or DeviceCheck on Apple devices). Versions without these checks, such as Fire TV, Windows and LG TVs, get their token from our own service. To stop automated abuse, that service and the free trial on computers keep a one-way hash of your IP address together with a request counter.
• Server logs: when the App contacts our servers, they record the time, your IP address and the device type (user agent). We keep these logs for 30 days and use them for security and to look into problems you report to us.
• Diagnostics: see section 3.4.

3.2 When you sign in

• Your account: email address, your name if your sign-in provider shares it, the sign-in method (Google, Apple, or email and password) and an account ID. If you sign in with email and password, the password is stored by Firebase Authentication in hashed form and we never see it.
• Synced data, kept under your account so it follows you to your other devices. You can switch off each category in Settings → Account & sync. Switching a category off on a device stops that device from sending and receiving it; what is already in your account stays for your other devices until you delete it or delete your account.
  • Playlists: name, type and list of categories; for Xtream playlists the server address and username; for M3U playlists the playlist address; for MAC portals the portal address (the MAC address itself is never part of synced data); for Jellyfin and Emby servers the server address and username; for a Plex server its identifier and the name of your Plex account; alternative servers and a custom user agent if you set them. Many providers put your username and password inside the M3U address. The address is synced as a whole, so we can read it unless end-to-end encryption is on.
  • Favorites, watchlist, continue watching and watch history (with playback positions and what you have watched), recently watched channels, custom groups, hidden, renamed, reordered and locked channels and categories, the guide you picked for a channel and its time shift, programme reminders, the list of recordings on each of your devices and the recordings you schedule in the account panel (title, channel name, time, status, size, the profile it belongs to and the free space for recordings; the recorded files themselves stay on the device), the teams and competitions you follow in Sports and App settings, including the settings of each device.
  • Profiles: name, avatar, a hash of the profile PIN (not the PIN itself) and which playlists each profile may open.
  • A small record of where your synced data is kept, a fingerprint of your encryption key if you use one, and revision numbers that keep your devices in step. It contains none of your content and cannot decrypt anything.
• Passwords kept in your account: with “Keep my passwords in my account” on, we keep your provider passwords, the passwords of your Jellyfin and Emby accounts, the sign-in token of your Plex account, the MAC addresses of your portals, your TMDB, Trakt and OpenSubtitles sign-ins and your Google Gemini key, so your other devices can use them after you sign in. Each profile has its own Trakt account and its own TMDB sign-in, and each of them is kept this way. They are encrypted on our servers with a key we hold, which means we are technically able to read them. We use them only to fill them in on your own devices and never to connect to your provider or any other service. The setting starts switched on for accounts created from 21 September 2026, and switched off for accounts created earlier. Turning it off deletes the stored copies. With it off, passwords stay on the device where you typed them, in the system's secure storage (Android Keystore, the Keychain on Apple devices, the protected storage of Windows or macOS; on LG TVs, the App's local storage). On Android, the passwords and sign-ins on a device and the key it uses to pair with your other devices are kept in the Keystore. Only on a device whose Keystore refuses to store them are they kept in the App's private storage instead, which other apps cannot read but which is not protected by the device's security hardware; they move back to the Keystore as soon as it works again.
• Your devices: to apply the number of devices Premium allows and to let your devices work together, we keep a list of the devices on your account with each device's name or model, whether it is a phone or a TV, its platform and when it was last seen. For TVs we also keep the local network address and, if you set up waking the TV from your phone, the hardware (MAC) address of its network card. The list also holds a public key used to pass passwords and sign-ins between your own devices so that only they can read them, what a TV is playing right now (channel or title, logo and position) so your phone can show and control it, and the latest command sent to it (for example a channel to play, text to search or a remote key). Each device also reports its App version, which players and settings it supports, the state of its playlists and whether it can keep an encryption key safely, for the web panel. We keep a log of the latest changes to the list and, for 24 hours, the IDs of devices you removed. When you sign out on a device, it leaves the list together with everything it reported, without the 24-hour wait. If the list cannot be reached at that moment, the device's entry stays with only its App details and the time it signed out.
• Pairing a device with a QR code or a code shown on the TV creates a temporary record: the code, the two devices' public keys, the device type, your account ID and the data exchanged, encrypted so that only the two devices can read it. When you send a search from your phone to the TV, the record holds the search text. A pairing stops working 15 minutes after it is created, and we delete expired records periodically.
• Premium status: a copy of your Premium entitlements and, where the App uses a free trial tied to your account (for example on computers), the start of that trial.
• Sports: to show matches and scores, the App sends our servers the day, the sport and the teams and competitions you follow. To find which of your channels shows a match, it also sends the channel names, titles and descriptions of the guide programmes on air around kick-off. They are processed automatically to match them to the event and are not stored; we keep only the result. Match data reaches the App through our servers, and nothing about you is sent to the sources of that data.

3.3 Purchases

• Purchases in the App Store, Mac App Store or Google Play are processed by Apple or Google. RevenueCat receives the purchase receipts and keeps your purchase status linked to your account ID, so we can unlock Premium on your devices.
• On an iPhone or iPad, the App asks Apple's AdServices framework for an attribution token and RevenueCat sends it to Apple to learn whether the App was installed from an Apple Ads ad in the App Store and, if so, from which campaign and search term. We use this only to see whether our App Store ads pay for themselves. The token is not an advertising identifier and does not let us or RevenueCat recognise you in other apps or websites.
• Purchases on our website and in the web panel, used for example by the Fire TV and Windows versions, are processed by Stripe through RevenueCat. Stripe handles your card details; we receive the purchase record (product, price, date, country and email address) that we need for accounting.
• We never see or store your payment card details.

3.4 Diagnostics

The App sends crash reports and diagnostic logs to Sentry, stored in the European Union (Germany), so we can find and fix problems. They contain your account ID and email address when you are signed in, the device model, the system and App version, and a technical description of what went wrong and of how videos played (for example the player used, waiting and buffering times, the video format and resolution and the number of frames shown), which can include the names of channels or categories and the name of your provider's server. Usernames, passwords, tokens and MAC addresses are removed from addresses before a report is sent. Sentry also sees the IP address of the connection and may use it to estimate your country. Reports are kept for up to 90 days.

3.5 Services your device contacts directly

• Your IPTV provider: the App downloads playlists, guides and streams straight from the servers you add. Your provider sees your IP address and your login with them, under its own terms.
• Your own media server (Jellyfin, Emby or Plex): the App reads your libraries and plays files straight from the server you add. It tells the server what the profile linked to it plays and how far it got and what it marks as watched, and on Jellyfin and Emby also its favorites and likes; it reads the same from the server, so the App and the server’s other apps stay in step. What the server reports as watched or paused becomes part of your continue watching and watch history in the App and, when you are signed in, syncs like the rest of it (section 3.2). For Plex the App also contacts plex.tv to sign you in with a code and to find the addresses of your server; plex.tv sees your IP address and your Plex account, under its own terms. When a profile signs in with its own user of a Jellyfin or Emby server, that sign-in stays on the device and is never sent to us.
• TMDB (optional, with your own TMDB key or account): titles you open are looked up to show posters and details. Results are cached on your device only.
• OpenSubtitles (optional, with your own OpenSubtitles account): your subtitle searches and downloads. Downloaded files are kept only on your device.
• Google Gemini (optional, with your own Gemini API key): when you turn on Live subtitles (Android and the desktop apps), the App cuts the sound of the programme you are watching into short pieces of 3 to 5 seconds and, every few seconds, sends each piece as a small audio file straight from your device to Google Gemini with your own key, to get translated subtitle lines. Translating a subtitle file sends Gemini its text and the title of the film, and generating subtitles from a downloaded film sends the audio of that file. Nothing passes through our servers and we store neither the audio nor the text. Sending stops when you turn the feature off or close the player. Google processes what it receives under its own terms for your key and sees your IP address. With “Keep my passwords in my account” on, the key is kept in your account like your other sign-ins (section 3.2).
• Trakt (optional, when you connect your Trakt account): the App sends Trakt the films and episodes the connected profile plays, with how far you got, what you mark as watched or unwatched, and the watchlist, favorites and ratings you change on a title page. On your request it also sends the titles you finished in the App earlier. From Trakt it reads what you watched and where you paused in other apps, your watchlist, favorites and ratings, and the details and scores of titles you open or browse. What Trakt reports as watched or paused becomes part of your continue watching and watch history in the App and, when you are signed in, syncs like the rest of it (section 3.2). With “Keep my passwords in my account” on, the Trakt sign-in of each profile is kept in your account (section 3.2), so your other devices connect by themselves. With it off, it stays on the device that connected it and is never sent to us.
• TheIntroDB (theintrodb.org, a free community database of intro and credits timestamps): when you play an episode of a series or a film, the App asks TheIntroDB when the end credits begin, so it can show the next-episode card or the Finish card at that moment. The request contains the TMDB ID of the series or the film, for an episode the season and episode numbers, and the length of the video (so TheIntroDB can pick the matching cut), and nothing else about you: no account, email or other personal data. TheIntroDB receives the request from your device, so it sees your IP address and which episode or film is being looked up. Nothing is sent when you watch live TV. The answer is cached on your device. If TheIntroDB has no entry, the App estimates the moment from the length of the video, and what it learns about when you start the next episode early stays on your device and is not synced. Separately, the App may send us the anonymous report described in section 3.8; nothing from it goes to TheIntroDB.
• Google Drive (optional, Android): if you choose it as sync storage, your synced data goes to a private app folder in your own Drive instead of our cloud, and we never receive a copy. Your account, device list and passwords kept in your account stay with us.
• Chromecast and AirPlay: when you cast, the stream address is sent to your cast device, which plays it directly. A Chromecast also loads our player page from our website.
• App updates: the App checks for and downloads updates from Expo, and the Fire TV and Windows versions also from GitHub. They see your IP address and App version.

3.6 The web panel and IPTV Deck Connector

• The web panel is a website where you manage the data from section 3.2 with the same account. It keeps nothing new about you on our servers, uses no analytics or tracking cookies, and holds an end-to-end encryption key only while the tab is open.
• IPTV Deck Connector is an optional browser extension that downloads your playlists and guides straight from your provider into your browser. They never reach us.

3.7 Questions you ask in Help

When you ask a question under Help in the App, in the web panel or in our online manual, the text of the question goes to our Cloud Function. It asks TypeSafe (api.typesafe.ai), an AI service, which pages of the manual fit the question, and then sends the question with the text of those pages to Anthropic (api.anthropic.com), whose AI model Claude writes a short answer from them. TypeSafe and Anthropic receive the question and parts of the manual, and nothing about your account or device; under Anthropic's commercial terms the question is not used to train its models. When you are signed in, your account ID is used only to count how many questions you ask and is not kept with the question. When the manual has no clear answer, we keep the text of the question, without your account, device or IP address, for 90 days, to see what the manual is missing. A follow-up question is sent together with the earlier questions and answers of the same conversation, at most the last six, only to answer it. The conversation is kept on your device (in the online manual, in the browser tab) and is not stored by us. Under an answer you can mark it helpful or not helpful with a thumb. We keep that rating anonymously, only the topic of the answer and the thumb you chose, without your account, device or IP address, for 180 days, to improve the manual. Talk to a person sends us the email address you give for our reply, your note, the last messages of the conversation (at most six questions with their answers), the platform and app version, the language of your browser or device and, when you are signed in to the App, your account ID. It goes to our support inbox in our Firebase project (Cloud Firestore), is kept for 180 days and is used only to answer you. When you are not signed in, your device (in the online manual, your browser) first solves a small computing puzzle that shows our server the question comes from a person using the App or the manual and not from an automated script. It is computed on your device, and nothing about it is stored. If a daily limit of questions per account is switched on, we keep a count of the questions each account asks per day, which is deleted after two days. Please do not type passwords, card numbers or other personal details into a question.

3.8 When the end credits begin

So that the next-episode card and the Finish card appear when the end credits really begin, for everyone who watches the same film or episode, the App tells us where viewers actually stop watching. When, in the last minutes of a film or an episode, you press Finish the film or Play now on the Up next card, skip to the end or leave the player, the App sends our Cloud Function three things and nothing else: the TMDB ID of the film, or of the series together with the season and episode numbers; the length of the video file, rounded to 10 seconds; and how many seconds before the end of the file that moment came. The report contains no account, email address or device identifier, nothing about your playlist, your provider or the stream address, and nothing about anything else you watch. It is sent without your sign-in token even when you are signed in, and we do not store your IP address with it; like every request to our servers, it appears in the server logs we keep for 30 days (section 3.1).

The reports are stored in Cloud Firestore like our other data, grouped by title and by video length, and we keep only the last 25 positions for each title and length: every new one replaces the oldest. From them we work out where the end credits begin and offer that point to every copy of the App, which fetches it without signing in, through Firebase Hosting. This data is not passed to TheIntroDB or anyone else.

The reports are on by default. You can turn them off with Help improve Up next timing in Settings → Playback on phones and tablets, in Settings → Player on TVs and in the desktop App, or in the settings of the web panel (iptvdeck.zssoftware.eu).

4. Legal bases

If you are in the European Union, the European Economic Area or the United Kingdom, we rely on these legal bases under the GDPR:

• Performing our contract with you (Art. 6(1)(b)): your account, sync, passwords kept in your account, the device list, pairing, the web panel and Premium.
• Our legitimate interests (Art. 6(1)(f)): keeping our services secure and stopping abuse (the free trial record, request counters, App Check and server logs), finding and fixing bugs (diagnostics), answering your support requests, and improving the service by showing the next-episode and Finish cards at the right moment (the end-credits reports in section 3.8, which you can turn off in the App or the web panel). You can object to this processing at any time by writing to us.
• Legal obligations (Art. 6(1)(c)): keeping purchase records as tax and accounting law requires.

5. Who processes your data

These service providers process data for us under their data processing terms:

• Google: Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Logging, App Check, Secret Manager and Firebase Hosting (the web panel). Firestore data is stored in the European Union; Cloud Functions run in the United States.
• Sentry: diagnostics, stored in the European Union.
• RevenueCat: purchase status. Stripe: website payments.
• Expo: App updates. GitHub: updates of the Fire TV and Windows versions.
• Netlify: our website, including the Chromecast player page.
• TypeSafe: finds the pages of the manual that fit a question asked in Help.
• Anthropic: writes the answer to a question asked in Help, from those pages of the manual.

Apple, Google Play, Google and Apple sign-in, TMDB, OpenSubtitles, Trakt, TheIntroDB, Google Gemini and your IPTV provider are independent services with their own privacy policies. We do not sell or rent your personal data to anyone.

6. International transfers

Some of these providers process data in the United States. These transfers rely on the EU-US Data Privacy Framework or on the European Commission's Standard Contractual Clauses included in the providers' data processing terms.

7. How long we keep data

• Account and synced data: until you delete them or delete your account.
• Passwords kept in your account: until you turn the setting off, remove the playlist, disconnect the service or delete your account.
• Device list: while the device is on your account; signing out on a device removes it. Removed devices are remembered for 24 hours, and the change log holds only the latest entries.
• Pairing records: they stop working after 15 minutes, and expired records are deleted periodically.
• Free trial record and request counters: as long as they are needed to prevent abuse of the free trial and of our services.
• Server logs: 30 days. Diagnostics: up to 90 days.
• Help questions without a clear answer: 90 days.
• Daily count of Help questions per account, when a daily limit is switched on: 2 days.
• Help ratings (thumbs up or down): 180 days.
• Messages sent with Talk to a person: 180 days.
• End-credits reports: only the last 25 positions for each title and video length; each new report replaces the oldest.
• Purchase records: as long as tax and accounting law requires.
• Backups: our database backups are kept for up to 14 weeks, so data you delete disappears from them within that time.

8. Your rights and choices

• Delete your account in the App on a phone or tablet (Settings → Account → Delete account), in the web panel (Account → Delete account) or by writing to us; here is how account deletion works. It deletes your account, synced data, passwords kept in your account, device list and Premium status from our cloud. RevenueCat and Stripe keep purchase records as described above; write to us if you want your RevenueCat record removed.
• Choose what syncs in Settings → Account & sync on each device, turn on end-to-end encryption, or turn off “Keep my passwords in my account”.
• Turn off end-credits reports with “Help improve Up next timing” in the App's settings or in the web panel (section 3.8).
• Under the GDPR you have the right to access your data, have it corrected or deleted, restrict or object to its processing, and receive the data you gave us in a portable format. Write to us at the address below and we will answer within one month.
• You can complain to a data protection authority. In Poland this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. You can also turn to the authority in the country where you live.

9. Security

Every connection to our servers is encrypted (HTTPS/TLS), and security rules let a signed-in user reach only their own data. Passwords kept in your account are encrypted with AES-256-GCM using a key held in Google Secret Manager, and only our server code can decrypt them. No method of storage or transmission is 100% secure.

End-to-end encryption (optional) encrypts your synced data on your device with XChaCha20-Poly1305 before it is uploaded. The key never leaves your devices: it is shown to you once as a recovery code and kept in the system's secure storage, marked so that it is not copied to iCloud or other backups. The key is never kept outside that storage: on a device that cannot keep it safely, such as an Android device whose Keystore refuses to store it, end-to-end encryption cannot be turned on or used, and the App says so.

This has a consequence we want to state plainly: we cannot read that data, reset the key or recover the data for you. If you lose the recovery code and no longer have a device holding the key, the data in the cloud stays unreadable for you and for us. In the App you can start over from a device that still has its local copy. End-to-end encryption does not cover passwords kept in your account, which use our key as described above.

10. Children

The App is not directed to children. Kids profiles let a parent limit what a child sees; the account itself belongs to the adult. We do not knowingly collect data from children. If you believe a child has created an account, write to us and we will delete it.

11. Changes to this policy

We update this policy when the App changes what it collects. The date at the top shows the current version, and we describe significant changes in the App's release notes.

12. Contact

Privacy questions and requests:

Email: mistyksu@gmail.com

Controller: Zbigniew Szepczyński Software, ul. Kobierzyńska 8/120, 30-363 Kraków, Poland