Who we are
XTREMIO IPTV PLAYER (the "app") and the website xtremio.live are operated by the XTREMIO team. Questions about this policy: our contact page.
XTREMIO IPTV PLAYER is a media player. It does not provide, host or sell any channels, films or series: it only plays the playlists you add from your own provider.
What we collect
Device information, when the app is opened on your TV:
- a device identifier shown in the app as a MAC address. It is derived from your TV's network address, it is not that address;
- a 6-digit Device Key that we issue, used to manage your device on the website;
- a device secret derived from your TV's unique identifier (DUID). We keep only a one-way hash of it, used to make sure that only your TV can use its record;
- the TV platform and app version, the date the app was first opened, the date and IP address of its last contact with our server.
Playlists you add: their name and type, and the connection details you enter (server address, username and password, M3U link, EPG link, portal address). Usernames, passwords and links are stored encrypted.
Activation and payments: the plan, its dates, the payment status, amount and the transaction reference returned by PayPal. Payments are processed by PayPal: we never receive or store your card or bank details.
Messages you send through the contact form: your name, the email address or phone number you give, your device MAC if you add it, the topic, your message, the language of the page and your IP address.
Reseller accounts: name, email address and a hashed password.
Your settings, favourites, profiles and watch history are stored on the TV itself and are not sent to us.
How we use it
- to provide the service you ask for: register your TV, give it its free trial, send it your playlists and activate it after payment;
- to prevent fraud and abuse and keep the service secure (for example rate limits, and blocking devices that are misused);
- to answer your messages;
- to keep the payment records that the law requires.
Within the European Union, these uses rely on the performance of our contract with you, on our legitimate interest in a secure service, and on legal obligations for payment records.
We do not sell personal data and we do not use it for advertising. The app contains no advertising and no tracking or analytics SDK.
Cookies
The website uses only cookies that are strictly necessary: one that remembers the language you choose, and a session cookie while you are signed in (device management, reseller or admin area). There are no advertising or analytics cookies.
Services we rely on
- PayPal processes payments (PayPal privacy statement).
- Cloudflare carries and protects the website traffic, and processes IP addresses for that purpose (Cloudflare privacy policy).
- Our servers are hosted in the European Union (Germany).
- To show posters and artwork, the app requests them directly from The Movie Database (TMDB), which receives your TV's IP address (TMDB privacy policy).
- Your playlist provider: the app connects to the provider you configure. For portal (MAC) playlists and M3U links, our server reads the channel list from your provider on your behalf. Video streams go directly from your provider to your TV and never pass through our servers. Your provider's own policy applies to what it does.
Some of these services may process data outside the European Union, under their own legal safeguards.
How long we keep it
- devices and their playlists: while the device is in use, and at most 12 months after its last contact with our server; earlier if you ask us to delete them;
- payment records: for the period required by accounting and tax law;
- contact messages: at most 12 months;
- backups: replaced within 14 days.
Your rights
You can ask to access, correct or delete your data, to object to its use, or to receive a copy of it. You can delete your playlists yourself at any time on the Manage page of the website. To delete your device record, contact us with your MAC address and Device Key.
If you are in the European Union, you can also complain to your data protection authority.
Security
All traffic to the website is encrypted (HTTPS), playlist credentials are encrypted at rest, passwords and device secrets are stored only as hashes, and access to the servers is restricted.
Children
XTREMIO IPTV PLAYER is not directed to children under 16, and we do not knowingly collect their personal data.
Changes to this policy
We will update the date at the top of this page when the policy changes, and announce significant changes on the website.
Contact
the XTREMIO team: our contact page.