Last updated: 9 October 2026
IPTelvza (“the app”, “we”) is an application that plays IPTV streams you supply yourself, available on iPhone, iPad, Mac and Apple TV (iOS, iPadOS, macOS and tvOS).
The controller of your personal data, within the meaning of Article 4 GDPR, is
Amine Chennaoui, publisher of the app — the name under which IPTelvza is
published on the App Store.
For any question about this policy or your data:
support@iptelvza.com.
Almost all of the app runs locally on your device. Some data is processed solely to make the app work (“App Functionality”), and never for advertising or tracking.
| Data | Why | Where |
|---|---|---|
| Email address | To create and secure your optional account (sign-in, multi-device sync, “Sign in with Apple”). | Our authentication provider (Supabase). |
| Account identifier | To attach your preferences to your account for syncing. | Supabase. |
| Usage data: favourites, watch history (which item of your source, where you stopped, when), settings, reminders, profiles, custom or hidden categories, and the name you give each source (without its address or your credentials) | So you can find them again and sync them across your devices if you are signed in. | On the device, and — if signed in — in your account space. Your recent searches stay on the device. |
| Purchase data: your access level (free, PRO, lifetime PRO) and its expiry date; the notices Apple sends us about purchases made from your account (event type, product, dates, transaction identifiers — never your name, your email or your payment method); your choice for “Refund assistance” | To unlock the PRO features of the web console for your account, and to take a refund or its reversal into account. Only if you turned on Settings ▸ Subscription ▸ “Refund assistance” (off by default): to answer Apple when you ask it for a refund (service delivered or not, share of a lifetime purchase consumed). | Supabase, in your account space. The purchase itself is handled by Apple; we never see your payment method. A purchase made while signed out is tied to an identifier specific to the device, not to an account. |
| Your IPTV source credentials (URL, username, password / Xtream key) | To connect to your provider and play the streams. | On the device, in its secure keychain (Apple Keychain). They only pass through our servers when a source is sent to another device on your account, and always end-to-end encrypted for that specific device: either from the web console (encrypted in your browser), or from one of your devices to another that does not have that source yet (its name, its address and your username). Your Xtream password never travels from one device to another: you type it on the new device; only an M3U playlist added by address travels whole, since its credentials are part of the address. Nothing is installed without your consent, asked on the receiving device. Our servers see nothing but ciphertext, which they cannot read, plus a one-way fingerprint of each source (computed without the password), used only to know which device is missing it. The envelope is erased as soon as the device has installed or refused it, and stops being installable after 30 days. You can turn these transfers off in Settings ▸ Account ▸ Remote setup. |
| Remote configuration (web console): the name and identifier of each device signed in to your account, its encryption public key, the date it last checked in, and the message you attach to a proposal (280 characters at most, plain text, never clickable). | To let you prepare a source or settings from a browser for a device on your own account, and to tell you what it did with them. | Supabase, in your account space. A public key is meant to be published; the private key that opens the envelopes never leaves the device’s keychain. A proposal nobody has collected stops being installable after 30 days, and you can withdraw it at any time from the console. |
If you do not use an account, none of this data leaves your device (apart from the strictly necessary requests described in section 3).
Legal bases. This processing relies on the performance of the service you request (account and sync — Art. 6(1)(b) GDPR), on your consent for the optional features you turn on yourself (Trakt link, casting to a television — Art. 6(1)(a)), and on our legitimate interest in running and securing the app (Art. 6(1)(f)).
| Service | Role | Data sent |
|---|---|---|
| Supabase | Authentication and account sync. | Email, identifier, your preferences (favourites, history, …), the names of your sources and your purchase data (section 2). No other data from your IPTV source in the clear: a source sent from the web console, or offered by another of your devices, passes through end-to-end encrypted, unreadable by Supabase and by us, and erased as soon as the device has installed or refused it. |
| TheTVDB | Artwork, synopses and metadata for movies and shows. | Title queries used to fetch artwork. Metadata provided by TheTVDB.com. |
| Trakt (optional) | If you connect it: watchlists and history. | Only if you deliberately link a Trakt account (OAuth). |
| Google Cast SDK | Casting to a television (Chromecast). AirPlay is handled by Apple’s operating system and does not go through this SDK. | Device discovery on your local network — it only starts when you open a player, not when the app launches. When you start casting, the stream address is sent to the receiver: with most Xtream providers that address contains your username and password, because that is how the provider authenticates playback — without them the television could not play. That is the only data sent to the receiver: no title, no artwork, no account identifier. Google receives diagnostics from its Cast module: built into the app on iPhone, iPad and Mac (it does not exist on Apple TV), this module sends Google, on its own, diagnostic data (reliability and performance of the module) and, when you use its cast button or mini controller, data about your interactions with those controls. Google declares this data as not linked to your identity and not used for tracking; we have turned off the module's “Analytics” logging, which would add a device identifier, and we receive none of this data. You can turn casting off entirely (Chromecast and AirPlay) in Settings ▸ Playback ▸ “Allow casting”. |
| Your IPTV provider | To deliver the streams YOU configured. | Your credentials go straight from your device to the server you entered. Posters and logos whose address your source publishes are downloaded straight from that address — often TMDB’s image server (image.tmdb.org), which then sees your IP address, as with any image on the web. The app does not query TMDB’s service itself. |
The offline-download and recording features only save streams from your own source, on your device. These files are never sent to us. You are responsible for respecting the rights attached to the content you play, download or record through your subscription.
Local data stays on your device until you delete it (in the app, or by uninstalling the app). If you have an account, you can delete it directly in Settings → Account → Delete account: this removes your authentication account, the associated preference data and the purchase history tied to the account: the notices Apple sends us about your purchases (subscription, renewal, refund) and our refund log.
The devices registered for remote configuration, and the proposals addressed to them, go with the account. You can also remove a device, or withdraw a pending proposal, at any time from the web console.
Once a proposal has been installed, refused or has expired, its encrypted content is erased straight away; all that remains is a record of what happened (the date, and the outcome), so the console can show it to you. That record is erased 30 days later, automatically.
Depending on your jurisdiction (GDPR, CCPA, and others), you have rights of access, rectification, erasure, restriction, objection and portability. Most can be exercised directly in the app; for anything else, write to support@iptelvza.com — we answer within the one-month period set by the GDPR. You may also lodge a complaint with the competent supervisory authority (in France, the CNIL).
IPTelvza is not directed at children and does not knowingly collect children’s data. A parental “Kids” mode with a PIN and a category allow-list is provided for parents; adult content is hidden by default.
Your IPTV source credentials are stored in the device’s secure keychain (Apple Keychain). Exchanges with our providers use HTTPS. Connections to your IPTV provider use whichever protocol (http/https) that provider requires; that choice is yours.
A source prepared from the web console is sealed in your browser (ECDH P-256, then HKDF-SHA256, then AES-256-GCM) for the public key of the target device. A source offered by another of your devices is sealed the same way, on that device, for the public key of the target device. We hold no private key and therefore cannot open those envelopes. And nothing installs by itself: the device shows what is being proposed, and the person in front of the screen accepts or refuses.
We may update this policy; the date at the top of the page shows the latest revision.