Privacy Policy

1. Who We Are

TubPlayer ("the App") is developed and published by Tubs Software ("we", "us", "our"). This privacy policy explains what data the App collects, how it is used, and the choices available to you.

2. Data We Collect

3. Playlist Credentials

Entering details directly on your TV

When you enter playlist details directly in the App, credential values are encrypted at rest on the TV using AES-256-GCM with a key protected by the Android Keystore. They are then used to connect from your TV to your IPTV provider. Preference names and other non-secret metadata may remain visible in the App's local preferences.

Optional phone setup

If you scan the setup QR code and enter details on tubplayer.com/setup.html, your server address, username, password, playlist URL, portal URL, MAC address, and any optional Stalker username/password you submit are sent over HTTPS to TubPlayer's pairing service and temporarily stored there. This allows the paired TV to collect the details.

Two pairing services are currently in use, and which one handles your details depends on the version of the App on your TV. Sessions started by current versions are handled by Cloudflare Workers and Durable Objects. Sessions started by older versions are handled by a Firebase Cloud Function and temporarily stored in Google Cloud Firestore. The setup page tells you which service is handling your session before you submit anything.

A setup session normally expires after 15 minutes. The credential payload is removed when the paired TV claims it or when an expired session is next processed. The remaining session record is then scheduled for automatic deletion — by a scheduled task on Cloudflare, or by Google Cloud Firestore's TTL system for the older service. Deletion is asynchronous and may not happen immediately. Credentials submitted through phone setup are not sent to Firebase Analytics or Crashlytics and are not intentionally written to server logs.

Log messages that might contain stream URLs are sanitised in release builds to strip credentials before being written to Logcat or Crashlytics.

4. Crash Reports & Analytics

The App uses Firebase Crashlytics (provided by Google) to collect anonymous crash reports and non-fatal error diagnostics. Crashlytics is disabled in debug builds and enabled only in release builds.

What is included in crash reports:

• Device model, Android version, and app version
• Stack traces and error codes when a crash or playback failure occurs
• Navigation context (which screen was active, which section was selected)
• Stream error details (error code, error type, server domain only — never the full URL or credentials)
• Playlist type counts (e.g. "2 Xtream, 1 M3U" — never playlist names, URLs, or credentials)

What is never included:

• Playlist credentials (server addresses, usernames, passwords)
• Stream URLs (only the server domain is logged, never the path which contains credentials)
• Content you watch, your watch history, or your favourites
• Any personally identifiable information

Crashlytics data is governed by Google's Firebase privacy policy.

Firebase Analytics:

The App also includes the Firebase Analytics SDK, which is bundled with Crashlytics and supports its diagnostics. The App itself logs no custom analytics events. The SDK does, as standard Firebase behaviour, automatically collect a limited set of anonymous app-usage signals (such as app opens and session counts) and a pseudonymous app-instance identifier. This data is used only to support app stability and diagnostics — never for advertising and never to identify you. Advertising-ID collection and ad-personalisation are explicitly turned off: the advertising-ID permission is removed from the App, and the SDK's ad-ID and ad-personalisation signals are disabled. This data is governed by Google's Firebase privacy policy.

5. Google Drive Backup (Optional)

If you choose to connect your Google account for cloud backup, the App uses Google's drive.file scope. This is the most restrictive Drive scope available — it only allows the App to access files that it has created itself.

How backup works:

• Your app data (playlists, settings, watch history, credentials) is encrypted on your device using AES-256-GCM before being uploaded
• The encrypted backup file is stored in your personal Google Drive account
• We have no access to your Google Drive or your backup files
• You can disconnect Google Drive at any time from the App's settings, and delete backup files directly from your Google Drive

If you do not enable Google Drive backup, no data is sent to Google Drive and no Google account connection is made. Local backups to your device's Downloads folder are also available and do not involve any cloud service.

6. TMDB (The Movie Database)

The App uses the TMDB API to fetch content metadata such as movie posters, plot summaries, cast information, and ratings. These requests are made directly from your device to TMDB's servers and contain only the content title being searched — no personal information, credentials, or device identifiers are included. Fetched metadata is cached locally in the App's database.

TMDB is a third-party service governed by its own privacy policy.

7. Data Stored on Your Device

App data — including playlists, channel guides, watch history, favourites, parental settings, and preferences — is stored locally on your device in a SQLite database and Android SharedPreferences. Data is transmitted when required for features you choose, including connecting to your IPTV provider, fetching TMDB metadata, diagnostics described in Section 4, Google Drive backup described in Section 5, and optional phone setup described in Section 3.

The parental control PIN, if set, is stored as a one-way SHA-256 hash. The original PIN cannot be recovered from the stored hash.

8. Third-Party Services

9. Children's Privacy

The App is not directed at children under the age of 13. We do not knowingly collect personal information from children. The App includes parental controls that allow a parent or guardian to restrict access to playlist management features using a PIN.

10. Data Retention & Deletion

All locally stored data can be deleted by:

• Removing individual playlists from the App (deletes all associated content, history, and credentials for that playlist)
• Clearing the App's data through Android Settings → Apps → TubPlayer → Clear Data
• Uninstalling the App (removes all local data)

Crashlytics data is retained by Google according to their standard retention policy (typically 90 days for crash data). We do not have the ability to associate crash reports with individual users.

For optional phone setup, the credential payload is removed when claimed or when expiry is processed. Sessions normally expire after 15 minutes. The remaining session record is scheduled for asynchronous deletion one hour after session expiry — by a scheduled task on Cloudflare, or by a Firestore TTL timestamp on the older service; actual deletion may occur later.

Google Drive backup files remain in your Google Drive until you delete them. Disconnecting Google Drive from the App does not automatically delete previously created backup files.

11. Changes to This Policy

We may update this privacy policy from time to time. The effective date at the top of this page will be updated accordingly. Continued use of the App after changes constitutes acceptance of the updated policy.

12. Contact

For questions about this privacy policy or how the App handles data, contact us at support@tubplayer.com.