DRAFT — requires legal review
This text must not be published before legal review. Fields in
[brackets]and items marked[to be confirmed]must be completed or confirmed. Other languages:privacy.tr.md(default),privacy.de.md(keep content in sync).
AI IPTV Privacy Policy
Version: 3 (draft) · Effective date: [date] · URL: https://aiiptv.app/en/privacy
1. Controller
The controller for the AI IPTV app (the "App") is [Developer name / legal name], [address] ("we"). Privacy and data protection requests: privacy@aiiptv.app · General support: support@aiiptv.app · Web: https://aiiptv.app
This notice is provided under the Turkish Personal Data Protection Law No. 6698 ("KVKK", Art. 10) and Regulation (EU) 2016/679 ("GDPR", Art. 13).
2. What the App does and does not do
AI IPTV is only a player. It does not provide any content, channels, movies, series or playlists; it does not sell streaming subscriptions or streaming services; and we are not affiliated with any streaming provider. The App only plays the playlist or provider account that you add yourself (Xtream Codes / M3U).
The App has none of the following:
- ads or advertising ID
- passwords (you sign in with a one-time code sent to your e-mail)
- card or payment details (payments are made only through Google Play; your card details never reach us)
- location permission
3. Data that stays on your device
The following data is stored on your device and never sent to our servers:
- Provider details: server address, username, password, M3U link and stream URLs.
- Channel list, movie and series catalog, electronic program guide (EPG).
- Profile PIN (stored in a non-reversible form)
[to be confirmed: the PIN is not sent with sync]. - Your recordings (DVR files) and reminders.
If you turn on "Sync my provider details across my devices", these details are encrypted on your device before sending and are not stored in plain text on the server (default: off).
Data synced with your account: profile names and avatars, favorites, ratings, watch history and resume positions, app settings. They are stored on our server, linked to your account, so they are the same on all your devices (section 6).
When you watch, your device connects directly to your provider; this traffic does not pass through our server. Your provider sees your IP address and requests; its own privacy policy applies to that processing.
4. Personal data we process, purposes and legal bases
| # | Category | Data | Purpose | Legal basis |
|---|---|---|---|---|
| A | Device registration | Random device ID generated by the App, creation and last-seen time | Protect server endpoints against abuse (token, rate limiting) and operate the service | Legitimate interest: KVKK Art. 5(2)(f), GDPR Art. 6(1)(f) |
| B | Shared learning events (optional) | Random install ID (installId), profile key (non-reversible HMAC of install and profile IDs), app version, platform, language; viewing events by content ID (impressions, clicks, watch time and completion summary, pause/seek counts, ratings, favorites, history edits); a hash of search queries | Country charts, "people who liked what you liked" recommendations, improving the recommendation model | Explicit consent: KVKK Art. 5(1), GDPR Art. 6(1)(a) |
| C | Technical diagnostics (optional) | Install ID, session ID, app and build version, device model and manufacturer, OS version, RAM, CPU core count, codec support, free storage; crash, error, memory, startup time, player and recording results | Find and fix crashes and performance problems | Explicit consent: KVKK Art. 5(1), GDPR Art. 6(1)(a) |
| D | Support upload (one-time, started by you) | Data in C + masked recent app logs + support code | Investigate the problem you reported | Explicit consent: KVKK Art. 5(1), GDPR Art. 6(1)(a) |
| E | Recommendation and metadata requests | Your recent interactions (content ID and score); canonical ID, title, year and TMDB ID of items in your catalog | Return recommendation candidates, similar titles and content information. Interactions are not stored, only processed to build the response. Catalog titles are added to a shared content information cache without being linked to you | Legitimate interest: KVKK Art. 5(2)(f), GDPR Art. 6(1)(f) |
| F | AI features ("AI Mode") | See section 5 | Natural-language search, recommendation captions, interpreting a viewing profile summary | Legitimate interest: KVKK Art. 5(2)(f), GDPR Art. 6(1)(f) [to be confirmed: whether free-text search needs consent] |
| G | Account | E-mail address, account ID (random), language, creation date; session and refresh tokens; list of devices linked to the account (device ID, platform, last use) | Sign-up and sign-in (with an e-mail code), access across devices, account management, transactional e-mails (sign-in code) | Performance of a contract: GDPR Art. 6(1)(b), KVKK Art. 5(2)(c) |
| H | Sync data | Profiles (name, avatar), favorites, ratings, watch history and positions, settings; optional encrypted provider details | Keeping your data the same on all your devices | GDPR Art. 6(1)(b), KVKK Art. 5(2)(c) |
| I | Subscription and purchases | Google Play purchase token, product and plan (monthly/yearly), subscription state and period dates, auto-renew state, trial start/end; a non-reversible digest of the account ID used to link the purchase (obfuscatedAccountId) | Verifying the subscription and managing access | GDPR Art. 6(1)(b) and (c), KVKK Art. 5(2)(c) and (ç) |
| J | Abuse prevention | On Android, an HMAC of a device key (derived on the device from the device ID and the app signature; the raw value is never sent); trial record: an HMAC of the canonical e-mail; Google Play Integrity verdict (device and app integrity); sign-in code attempts; IP address (only at request time for rate limits and new-trial limits, not stored); suspicious-event records | Preventing repeated free trials, subscription sharing and account takeover | Legitimate interest: GDPR Art. 6(1)(f), KVKK Art. 5(2)(f) |
In our current server configuration, data in B, C and D is not stored on the server. When you send it with your consent, our server validates the request (consent, schema, privacy checks) and discards it without writing it anywhere or keeping it in memory; only counters of how many events arrived, with no identifiers, are kept. If we start storing this data on the server, we will update this policy beforehand and ask for your consent again.
Kids profiles never send category B data under any circumstances, and consent is not requested for them.
Never sent: provider details and address, stream URLs, profile name, PIN, channel lists, e-mail, phone number, advertising ID, Android ID, IMEI and MAC address. URLs, tokens, e-mail addresses, IP addresses and content IDs in diagnostics are masked or removed on the device before sending. Our server rejects requests containing fields or values that look like URLs, e-mail addresses, IP addresses or credentials.
IP address: Our server uses your IP address at request time only for rate limiting (and, where country lookup is enabled, to determine your country with a local GeoIP database, without contacting an external service). The IP address is never written to disk, access logs or databases.
Pseudonymous data: Data in B and C is not linked to your name, e-mail or provider account. Because it is linked to random identifiers, it is legally pseudonymous (not anonymous) personal data and is covered by this policy.
Giving and withdrawing consent: Consent for B is asked separately for each profile and is not pre-selected. Consent for C is a separate option and is not pre-selected. You can withdraw consent at any time in Settings > Privacy and Settings > Diagnostics. When you withdraw, data waiting to be sent is deleted from the device immediately. Refusing or withdrawing consent does not affect the App's core features.
Automated decision-making: Recommendations are mostly calculated on your device. Recommendations and AI outputs are not decisions that produce legal effects or similarly significantly affect you (GDPR Art. 22).
5. AI processing (Google Vertex AI Gemini)
For AI features we use Gemini models on Google Cloud Vertex AI. Google acts as our service provider (processor) on our behalf and on our instructions.
What is sent to the AI service:
- Content information enrichment (on the server, in the background): anonymous catalog metadata only: content type, title, original title, year, language, genres, cast/director names, plot summaries and keywords from open sources such as TMDB and Wikipedia. To identify a title correctly the model may research it with Google Search. Who has which content, device/install/profile IDs, provider details and stream URLs are not sent; URLs in texts are removed before sending.
- Recommendation captions: the recommended title and its genres, and the reason for the recommendation (for example "because you watched X", including that related title). No identifiers.
- Profile summary interpretation: an anonymous, aggregated viewing summary calculated on your device (numbers such as genre shares, time-of-day distribution, live/series ratios; no list of watched titles and no identifiers).
- Natural-language search (AI Mode, when you use it): the search phrase you type (up to 200 characters) and an anonymous summary of your catalog (available genres, languages, content types, year range). Do not type personal information into the search box; phrases that look like URLs, e-mail addresses, IP addresses or credentials are rejected on the server and not forwarded to the AI service.
Your device token, device/install/profile IDs and IP address are not forwarded to Google with these requests; the requests are not stored on our server and their contents are not logged. Whether Google uses this data for model training, and how long it retains it, is governed by the Google Cloud terms of service and data processing addendum [to be confirmed: Vertex AI data use/caching and abuse-monitoring retention]. AI output may be inaccurate.
6. Account, sync, subscription and abuse prevention
- Account: You enter your e-mail address and receive a 6-digit one-time code (valid for 10 minutes). There is no password. Codes are stored on the server only as a hash. Sign-in e-mails are sent through our e-mail service provider (Resend).
- Payment: Subscriptions are purchased only through Google Play. Your payment and card details are processed by Google and never reach us. We only verify the purchase and subscription status with Google Play and receive status notifications from Google (renewal, cancellation, refund). Google's own privacy policy applies to Google Play payment processing.
- Free trial: The first 7 days are free and no card is required. The trial is given once per person. To enforce this, a keyed, non-reversible digest (HMAC) of the canonical form of your e-mail address (lower case; for Gmail without dots and
+tags) is kept for 24 months, even if you delete your account. Reason: otherwise the trial could be repeated indefinitely by deleting and re-creating an account with the same e-mail (legitimate interest; your e-mail address itself is not kept). On Android, the device key HMAC is kept for 12 months and prevents repeated trials from the same device with different accounts. - Play Integrity: On Android, the Google Play Integrity API checks the integrity of the device and the app during sign-in. Google performs the check; we only receive the verdict (for example "meets device integrity").
- Device and playback limits: Up to 5 registered devices and 2 simultaneous streams per account. For this, a "playback in progress" signal without any content information is sent about once a minute during playback
[to be confirmed: signal contents]. - Account deletion: You can delete your account in the App (Settings > Account > Delete account) or at https://aiiptv.app/account/delete**. Your account, sessions and sync data are deleted. Deleting your account does not cancel your Google Play subscription**; cancel it separately in Google Play.
7. Retention
| Data | Period |
|---|---|
| Device registration (A) | Deleted automatically 90 days after last seen (the device registers again if it comes back) |
| Revoked (blocked) device registration | Deleted automatically 365 days after the last attempt (to prevent abuse) |
| Account (G) and sync data (H) | Until the account is deleted; on deletion, sessions and sync data are deleted immediately [to be confirmed: deletion period for long-inactive accounts] |
| Sign-in codes | 10 minutes (invalid once used or after 5 wrong attempts) |
| Subscription and purchase records (I) | For the life of the account; after deletion only as long as required by law [to be confirmed: period] |
| Device key HMAC (J) | 12 months |
| Trial record: canonical e-mail HMAC (J) | 24 months; kept even if the account is deleted (for the reason above) |
| Abuse event records (J) | [to be confirmed: period] |
| Shared learning events (B), technical diagnostics (C), support uploads (D) | Not stored on the server (received, validated, discarded without being written) |
| Recommendation requests (E) and AI requests (F) | Not stored on our server; processed only to build the response |
| Content information cache (title, year, genre, synopsis; cannot be linked to a person) | For the life of the service |
| Consent and withdrawal records (profile key, state, text version, date) | As proof [to be confirmed: period; no automatic deletion yet] |
| Erasure request records | Counts and date only (which IDs were erased is not stored) [to be confirmed: period] |
| Database backups / disk snapshots | Up to 30 days / 3 days; deleted records disappear from backups after that |
Erasure requests: An erasure request sent from the App or by e-mail is processed on the server immediately: the consent record of the affected profile keys is marked "no consent / erased". In the current configuration there is no other behavioral data linked to your profile on the server. [to be confirmed: also deleting the device registration immediately on request]
8. Recipients and international transfers
We do not sell data and do not share it with ad networks. Data is processed only by these service providers on our behalf and on our instructions:
| Recipient | Role | Location | Data |
|---|---|---|---|
| Google Cloud (Google LLC) | Server hosting (Compute Engine), secret management, backups | USA, us-east1 (South Carolina) | A–J in section 4 (B–D processed without being stored) |
| Google Cloud Vertex AI (Google LLC) | AI processing (Gemini) | Google's global infrastructure (global endpoint, including the USA) | Only the data listed in section 5 |
| Google Play (Google LLC / Google Ireland Ltd.) | Subscription sales and payment processing (Google acts as an independent controller for this); subscription verification via the Play Developer API; Play Integrity | Google's infrastructure | Purchase token, digest of the account ID, Play Integrity request |
| Resend (Resend, Inc.) | Sending sign-in code e-mails | USA [to be confirmed: data processing agreement and SCCs] | E-mail address, e-mail containing the code |
International transfer: Our servers are outside Türkiye and the European Union, in the United States.
- Users in Türkiye (KVKK Art. 9): the transfer relies on a standard contract as an appropriate safeguard under KVKK Art. 9
[to be confirmed: signing the Board's standard contract with Google / suitability of Google's terms, and notifying the Board within 5 business days of signature]. - Users in the EU/EEA (GDPR Art. 44 et seq.): the transfer relies on the EU Standard Contractual Clauses (SCCs) incorporated in the Google Cloud data processing addendum
[to be confirmed: whether to also rely on the EU-US Data Privacy Framework (DPF) certification].
Third-party content sources (directly from your device):
- TMDB (The Movie Database): Posters, images and content information come from TMDB. Images are downloaded by your device directly from TMDB's content delivery network (
image.tmdb.org), so TMDB sees your IP address and standard request information. TMDB's privacy policy applies: https://www.themoviedb.org/privacy-policy. "This product uses the TMDB API but is not endorsed or certified by TMDB." - Your streaming provider: Channel, EPG, logo and stream requests go directly to the provider you entered. We have no relationship with your provider.
- Google Play: The App is distributed and updated through Google Play. Data collected by Google (for example download statistics, Android vitals) is subject to Google's own policy.
We may disclose information to competent authorities and courts where required by law.
9. Security
- Communication between the App and our server (
https://aiiptv.app/api) is encrypted with TLS (HTTPS). - Server access is restricted by a firewall; secrets are kept in a separate key management service.
- Raw IP addresses are not stored, identifiers are random, and diagnostics are masked before sending.
10. Children
The App is not directed to children under 13; it is designed for adults who hold their own provider subscription. The "kids profile" is a feature that lets parents restrict content and access. Kids profiles never send usage data under any circumstances. If you believe we process data of a child under 13, contact privacy@aiiptv.app and we will delete it.
11. Your rights
Under KVKK Art. 11 you have the right to learn whether your personal data is processed, request information about it, learn the purpose and whether it is used accordingly, know the third parties in Türkiye or abroad it is transferred to, request correction, request deletion or destruction under KVKK Art. 7 and notification of these actions to recipients, object to a result against you arising exclusively from automated analysis, and claim compensation for damage caused by unlawful processing.
Under GDPR Art. 15–22 you have the rights of access, rectification, erasure, restriction of processing, data portability, objection, and not to be subject to automated decision-making. You can withdraw consent at any time; this does not affect the lawfulness of processing before withdrawal (GDPR Art. 7(3)).
In the App:
- Settings > Privacy: turn shared learning on or off per profile.
- Settings > Diagnostics: turn diagnostics on or off, view recent logs stored on the device.
- Settings > Account > Delete account (or https://aiiptv.app/account/delete): deletes your account and sync data. Cancel your Google Play subscription separately in Google Play.
- Settings > Privacy > Reset my data: renews the install ID, deletes pending data and this device's recommendation history, and sends an erasure request to the server
[effective once the client integration is complete — to be confirmed].
Requests: e-mail privacy@aiiptv.app or write to [address]. For requests about your account, write from your account's e-mail address; for data not linked to an account (device registration), include the install ID or support code shown in the App [to be confirmed: shown in Settings]. We reply free of charge within 30 days. If you are not satisfied, you can complain to the Turkish Personal Data Protection Authority (KVKK Board) or, in the EU, to your local data protection supervisory authority.
12. Changes
We may update this policy. We will notify you in the App and at https://aiiptv.app/en/privacy about material changes. If a change affects consent-based processing, we will ask for your consent again (consent texts are versioned).
13. Contact
[Developer name / legal name] · [address] · privacy@aiiptv.app (privacy) · support@aiiptv.app (support) · https://aiiptv.app