Privacy Policy — XStream TV – IPTV Player

Last updated: 26 September 2026

XStream TV (package com.XStreamTV.iptv) is a player for IPTV services you already subscribe to. It is not a content provider, and it comes with no channels, films or subscriptions of its own.

This policy explains exactly what the app keeps on your device, what it sends anywhere, and what we store. It describes the app's real behaviour, not a general template.

The short version

• We have no user accounts. You never sign in to us, and we have no way to recognise you.
• Your IPTV login never reaches us. Your provider's address, username and password are stored on your device and sent only to your provider, exactly as they would be by any other player.
• We collect no advertising or analytics data. There are no ad networks, no analytics SDKs, no tracking identifiers, and no advertising ID in this app.
• Four features send anything at all, all described in full below: one is automatic and sends only your provider's category names; one runs only when you report a title; one is optional, off by default, and asks first; and subtitle searches ask a subtitle service for the title you want subtitles for.
• We never store your IP address, device ID, install ID or account.
• Premium is sold by Google Play. You pay inside Google Play; we never see your card or bank details, and nothing about your purchase is sent to us.

What stays on your device

All of this is held in the app's private storage and never leaves your device unless you export a backup yourself:

• Your playlists: provider address, username and password for Xtream Codes sources, or the URL or file location for M3U sources.
• The catalog synced from your provider: channels, films, series, categories and the programme guide.
• Your favourites, custom groups, hidden and locked items, and channel ordering.
• Watch history, resume positions and watch-time statistics.
• Your settings, including recent searches.
• Your parental PIN and your playlist-lock PIN, each stored as a salted hash — the PINs themselves are never written down anywhere, and both are deliberately excluded from backups so an exported file can't be used to recover them.
• Titles you have reported as sensitive or not sensitive, so the app remembers your choice.
• Films and episodes you download for offline viewing, and the subtitle files the app fetches for you. Both stay in the app's own storage, are not part of any backup, and are removed with the app.
• If you choose to add them: your own OpenSubtitles username and password, and your own SubDL key. They are sent only to those services, and are excluded from backups.
• Whether your Google account has Premium, as Google Play last said, so Premium also works offline. It is excluded from backups.

Backups you create with Settings → Backup & Restore are ordinary files saved where you choose. We never receive them.

What the app sends, and where

Nothing in this app sends your viewing history, your playlist address, your provider credentials, or anything that identifies you or your device. The one time a title you are interested in leaves the device is when you ask for subtitles for it — and then it goes to the subtitle service, not to us.

Adult-category filtering (automatic)

To keep pornographic sections out of the app, we have to know which of your provider's categories are adult. Most are obvious from the name, and those are recognised on your device with no network request at all. The rest — sections named in other languages, or with euphemisms — are checked against our service.

• Only category names are sent. These are the section headings your provider publishes, which are identical for every subscriber of that provider. They say nothing about you or what you watch.
• No identifier accompanies them. No account, no device or install ID, no playlist address.
• We do not store your IP address, and we do not log requests.
• It happens once per name, not once per sync. Every answer is cached on your device permanently, so a refresh that brings back the same categories sends nothing. The only thing that ever reaches the network is a category name new to your device.
• What we keep: a shared table of category name → adult or not adult, so the same name is never judged twice for anyone. There is nothing in that table about who asked. We use a language model (Cloudflare Workers AI) to make that judgement; the model is given category names only.

This feature cannot be turned off, because it is what keeps adult material out of an app rated for general audiences. Whether sensitive sections are shown on your device is up to you — Settings → Parental Control → Hide sensitive content — and that setting does not change what is sent.

Sensitive-content reports (only when you report)

Long-press a channel, film or series and choose Report… to mark it as sensitive (18+) or as not sensitive. Your choice applies on your device straight away.

• What is sent: the title's name, whether it is a channel, film or series, and your answer. Nothing else — no account, no device or install ID, no playlist address.
• What we keep: a count per title of how many reports said "sensitive" and how many said "not sensitive". Nothing records who reported. We do not store your IP address.
• When it affects others: only once enough separate reports agree (currently eight). Until then, a report changes nothing for anyone else.
• Once per title: the app remembers that you reported a title and does not offer to report it again.

Title sharing (optional, off by default)

If you agree to it, the app sends a one-time list of the titles in your catalog — channel, film, series and category names, plus a release year where one exists.

• We ask first, once, and the answer is remembered. "Not now" means no.
• Titles only. No viewing history, no favourites, no credentials, no identifiers. Anything the adult filter catches is excluded, and so is everything in an adult category.
• Once per device, ever. It does not repeat on a playlist refresh.
• What accompanies it: the time it arrived, your device's language, whether it is a phone or a TV, the app version, a per-upload random ID (not a device or install ID), and the size of your catalog. No IP address and no country are stored — nothing that indicates where you are.
• Where it goes: a private Google Drive folder belonging to the developer.
• Turn it off any time: Settings → Help improve recommendations. Turning it off stops any future upload.

We use this to see which titles are common across providers, so the app can match trailers and artwork better and build better recommendations. It is never sold, never shared with advertisers, and never used to build a profile of a person — it could not be, since nothing in it identifies anyone.

Subtitles (only when you ask, or when you download)

Subtitles come from two free services, OpenSubtitles and SubDL, which the app contacts directly from your device — they never pass through us.

• When: only when you choose "Find subtitles online" in the player, or download a film or episode while Save subtitles with downloads is on.
• What is sent: the title's name, its release year and TMDB id if your provider supplies them, the season and episode for a series, and the language you want. Nothing about you, your provider or your viewing history.
• Your own accounts (optional): if you sign in with a free OpenSubtitles account or add a free SubDL key, those details are kept on your device and sent only to that service, to use your own daily allowance.
• What they keep: OpenSubtitles and SubDL have their own privacy policies. Like any website, they see the network connection the request arrives on.
• What is kept on your device: the subtitle file you chose, so that title never needs fetching again and works offline.

Downloads

Films and episodes you download are fetched from your provider, exactly as when you stream them, and saved in the app's own storage on your device. Nothing about them is sent anywhere else.

Purchases (Premium)

Premium is bought and paid for entirely inside Google Play's own screens, under Google's terms and privacy policy. The app never sees your payment details, and never sends anything about a purchase to us — we have no server that could receive it.

• When the app starts, it asks Google Play, through the Play Store app on your device, which plans are on sale and whether your Google account owns one.
• The answer is kept on your device so Premium works offline. It is never part of a backup.
• Cancelling the yearly plan, refunds and receipts are all handled by Google Play.

What we never collect

• Your name, email address, phone number or postal address
• Your IP address (as stored data)
• Any advertising ID, device ID or install ID
• Your IPTV username or password
• What you watch, when you watch it, or for how long
• Your precise location
• Your contacts, photos, files, microphone or camera

The app requests no runtime permission for any of these, because it does not use them.

Permissions the app asks for

Third parties

• Cloudflare — hosts the two services above. Cloudflare processes the network connection itself, as it does for any website; our code does not record or store the IP address.
• Cloudflare Workers AI — the language model that judges whether a category name is adult. It receives category names and nothing else.
• Google Drive — where shared titles are stored, in a private folder belonging to the developer. Nobody else has access.
• Wikidata — a public, free knowledge base, queried by TMDB id for ratings and release years of trending titles.
• Google Play — sells Premium and takes the payment, under Google's own terms and privacy policy.
• OpenSubtitles and SubDL — free subtitle services the app asks for subtitles, directly from your device, only as described above. Their own privacy policies apply to what they receive.
• Your IPTV provider — has their own terms and privacy practices, which we neither control nor see. Your relationship with them is yours.

We do not sell data to anyone, and we have no advertising partners.

Keeping and deleting data

On your device: removing a playlist deletes everything synced with it, including its downloads. Delete all downloads in Settings removes every downloaded file. Settings → Reset all settings returns the app to defaults. Uninstalling removes everything the app stored.

Category verdicts on our side: a category name and a yes/no answer, kept indefinitely because it is provider taxonomy, not personal data. There is nothing to link it to you.

Reports on our side: a title name with two counts, kept indefinitely. Nothing in it identifies who reported, so an individual report cannot be found or removed; your own choice can be changed on your device by reporting the title the other way.

Shared titles: if you agreed to title sharing, that upload contains no identifier of any kind, which has an honest consequence — we cannot find "your" upload to delete it, because nothing marks it as yours. What we can tell you is that it contains only catalog titles and cannot be traced back to you or your device. If you would like the feature disabled, turn it off in Settings; it will never send again.

Children

This app is not directed at children. It is a player for a service an adult subscribes to, and the catalogs it displays are supplied entirely by that provider. We do not knowingly collect anything from children. Adult categories are filtered out by default, and parental controls with a PIN are available in Settings.

Security

Everything sent by the app travels over HTTPS. Your provider credentials stay in the app's private storage, which other apps on the device cannot read. Your parental PIN is stored only as a salted hash, and so is the separate PIN that protects locked playlists.

Changes to this policy

If the app starts doing something this policy does not describe, the policy is updated before that version is released, and the date at the top changes with it.

Contact

Questions about this policy, or about anything above:

[YOUR CONTACT EMAIL]