Privacy Policy

1. Information we collect

Account details such as your email address, password setup status, and sign-in timestamps.
Device details such as device identifiers, device name, app version, platform, and linked-device status. For each device signed in to your account we also record the most recent IP address and an approximate location (city/country) derived from it, to enforce the per-account device limit and to detect account sharing. This applies to an iPhone or iPad signed in to your account too. On iPhone and iPad the device identifier is a random ID the app creates and keeps on that device (it is not Apple’s advertising identifier), and the device name we receive is only the kind of device, such as “iPhone” or “iPad”.
Playlist or provider details you choose to store in your account portal or cloud-linked setup. When cloud sync or cloud backup is enabled, this also includes saved favourites, viewing history, reminders, profile settings and catalogue customisations. The Google Play version supports these features too; the limits on remote service checks below do not disable the cloud features you choose to use.
Billing details such as plan, customer ID, subscription status, transaction status, and payment-provider references. For purchases made in the iPhone or iPad app this means Apple transaction references, described in “App Store purchases” below.
The country of your connection when you buy directly from us. When you start a purchase that is paid through Stripe, we record the country your internet connection came from, as a two-letter country code (for example “DE”). We do not store your IP address for this. The code is saved with the payment record held by Stripe. We keep it because tax law requires us to keep evidence of a customer’s country for VAT, and that legal obligation is our lawful basis.
Operational and security data such as rate-limit records, request status, and basic logs needed to keep the service running.
Account linked product milestones: the first reported times you finish configuring a TV service with channels, reach active playback (including a playing guide preview or radio), are shown a plan price in the app, open a checkout link for your account, and continue from that page to payment, plus the app version you were using during your free trial. Newer versions of the app also record when your free trial ended and the first time you see your trial countdown or a notice that your trial has ended. These are single first time records, not a viewing history. See “Product milestones” below.
If you opt in, diagnostic data such as crash and error reports, app version, and device model (see “Diagnostic data” below). This is off by default, and it is part of the TV app only: the iPhone and iPad app sends no diagnostic reports to us.
If you join beta updates in the app, the linked device’s update channel, app build and enrollment time. Beta reports also include the device/build context shown in the report form. Provider credentials, account tokens and full stream URLs are excluded.
On selected public information pages that carry advertising, Google may process advertising data such as your IP address, browser or device information, consent choices, and ad interactions. Advertising is not shown inside the TV app, inside the iPhone and iPad app, or on the privacy policy, admin, account, checkout, sign-in, device-pairing, or other non-content utility pages.

2. How we use information

To create and secure accounts.
To pair your phone with your TV and link devices to the same account.
To store playlists or cloud-synced settings that you ask us to keep.
To process premium billing, confirm entitlements, and prevent fraud or abuse.
To limit how many devices an account can stream on, and to detect and prevent account sharing.
To diagnose service problems, improve product reliability, and enforce our terms.
To understand where account holders encounter difficulties between setup, playback and choosing a plan.
To operate the opt-in beta programme, publish known issues and match reports to builds.
To fund the free website and app through advertising on public content pages.

3. Third parties

If you open an affiliate’s link to TiviGlass, your browser keeps that affiliate’s code for 30 days so the discount can be applied when you buy. It is kept in your browser’s own storage, not in a cookie sent to us, and holds only the code, the affiliate’s label for where they posted the link and the date. Clearing your browser’s site data removes it. We count how many times each affiliate’s link is opened, by day and by that label; the count records nothing about who opened it. If you use the code at checkout, the affiliate sees an anonymous referral record, not your name or email address.

If you apply to the affiliate programme (called the partner programme before 10 November 2026), we store your TiviGlass account ID, separate business contact email, application, country, preferred payout currency, VAT number if you give one, review decisions and referral records. Affiliate dashboards show anonymous referral references rather than customers’ names or email addresses. Financial records include commission calculations, refunds, payout approvals and exchange-rate details. Stripe collects bank and verification information through its hosted forms; those bank details are not stored in the affiliate application.

TiviGlass may use third-party providers to operate core parts of the service, including hosting, authentication, storage, and payment processing. Those providers may process information on our behalf only as needed to deliver the relevant function. Today they are: Cloudflare (hosting, storage, the website assistant’s AI model and email), Supabase (accounts and the database), Stripe, Google and Apple (payments), TMDB (film and show details), OpenSubtitles and SubDL (subtitle search, only when you search or turn automatic search on), TheSportsDB (sports fixtures), Discord (only if you link your Discord account) and Anthropic (an AI model that runs some support sessions you start and answers some of the messages you send us).

The TV app contains no advertising, analytics or tracking code from other companies, and does not read your device’s advertising ID.

Optional Trakt watch history. Trakt is part of Premium and needs a TiviGlass account. If you connect Trakt for a profile, your TVs send Trakt the identifiers of the films and episodes that profile watches, with playback progress and any watched or unwatched changes you make, and bring matching watched history and resume progress back from Trakt. Only films and episodes with an IMDb or TMDB number are sent, never live channels or recordings. Your TVs talk to Trakt directly, so Trakt also receives your IP address.

The connection belongs to the profile on your TiviGlass account, so you connect once and every TV signed in as that profile uses it. To make that work, our server keeps that profile’s Trakt sign-in tokens, encrypted and tied to your account and that profile, and passes them only to your own signed-in TVs. Our server never contacts Trakt and never sees what your TVs send to Trakt. The tokens aren’t part of cloud sync or backups, and our support staff can’t see or use them. Download my data lists which profiles are connected, as which Trakt user and since when, but never the tokens. If your plan no longer includes Premium, nothing is sent to Trakt and the connection is kept for when you upgrade. Android Private Session pauses these updates.

You can disconnect a profile on any TV, in Movies & shows settings, or on your account page. Disconnecting stops it on every TV. Deleting the profile or your account removes the connection too; signing out everywhere doesn’t. None of these delete history already held by Trakt. Disconnecting on a TV also asks Trakt to end that sign-in. Our server can’t contact Trakt, so disconnecting on your account page or deleting the profile or account can’t end it there: to be sure, remove TiviGlass under Connected apps in your Trakt settings. Manage your Trakt history and its visibility in Trakt.

Payment information is handled by the disclosed payment provider at checkout: Stripe for purchases on our website, Google for purchases in the Google Play version of the app, and Apple for purchases in the iPhone and iPad app. For a purchase paid through Stripe, we also send Stripe the two-letter country code of your connection, which it holds with the payment record as VAT evidence (see section 1); we do not send your IP address for this. TiviGlass does not claim to own or license third-party IPTV services, playlists, or streams that you choose to connect.

When our account creation, password reset or TV sign-in pages check that you are a person, they use Cloudflare Turnstile. It runs a short automatic check in your browser and sends Cloudflare technical signals such as your IP address, browser details and the address of our website. It does not read what you type. Cloudflare processes this for us to stop automated abuse, and may also use it to improve Turnstile, as described in the Turnstile Privacy Addendum.

Third-party advertising is currently disabled on our website.

4. Content-source responsibility

If you store playlist or provider details in TiviGlass, you remain responsible for making sure those sources are lawful and authorized. This policy does not change that responsibility, and TiviGlass does not provide or endorse unauthorized content sources.

5. Retention

Different records are kept for different lengths of time. The list below describes what the service actually does, rather than only what we intend.

Account, device, and playlist records are kept for as long as your account exists. Deleting your account removes your profile, your plan and entitlement record, your device list (including the last IP address and approximate city recorded against each device), your saved playlists and the provider credentials stored with them, your cloud-synced settings and any cloud backup, your saved channel names and other catalogue customisations, and your support tickets.
Product milestone records, including the app version you used during your free trial, are linked to your account and kept while it exists. They are deleted with the account.
For a recurring plan purchased directly through Stripe, account deletion requests cancellation of that Stripe subscription. For a subscription purchased through Google Play, manage cancellation in Google Play before deleting your TiviGlass account; account deletion must not be treated as confirmation that Google Play billing has stopped. The same applies to a subscription bought in the iPhone or iPad app: deleting your TiviGlass account, or deleting the app, does not cancel it. Cancel it with Apple first (see “App Store purchases” below).
Sign-in tokens are short-lived. Once a token has been replaced by a newer one, a daily cleanup deletes it after 48 hours.
Remote support sessions expire on their own and cannot be held open indefinitely. A pairing code is valid for one hour, a paired session closes after 20 minutes without operator activity, and no session lasts longer than two hours in total.
Payment and invoice records are kept after an account is deleted, because tax and accounting law requires us to keep them. TiviGlass does not store your full payment card details; payments are handled by Stripe for direct purchases, Google Play for Play purchases, or Apple for App Store purchases. For an App Store purchase, Apple keeps the payment and receipt records, and deleting your TiviGlass account removes our own record of that purchase.
The two-letter country code recorded when you start a purchase paid through Stripe (section 1) is kept with that payment record for 10 years, the period EU VAT record rules require, including after an account is deleted.
A small anti-abuse record of free-trial claims outlives the account that made it. That is deliberate: without it, deleting an account would reset the one-trial-per-person limit. It holds no readable email address or device identifier, only one-way hashes of them, together with the country and IP address the claim came from.
Crash and error reports, if you switch them on, are not linked to your account, your playlists, or your hardware. They are grouped by a random identifier created on the device, which changes if you reinstall or clear the app's data, and credentials and other sensitive text are removed on the device before anything is sent. We keep them while they remain useful for diagnosing the fault they describe.

Where a record is no longer needed for the purpose it was collected for, we delete it or reduce it to a form that no longer identifies you.

Local backup files and storage access

When you browse for a TiviMate backup in the Android app, its built-in browser can show folders and backup files on your TV and connected drives. Storage permission is requested only when you choose to allow access. Older Android versions use file-read permission; the app downloaded from TiviGlass uses Android’s All files access on Android 11 and newer. This grants access to shared files beyond a single backup. The browser uses it to list folders and read the backup you select; it does not change your source files or browse other apps’ private Android/data and Android/obb folders.

Folder paths and file names shown while browsing are held in memory until the browser closes. The browser does not save or upload a browsing history. Services and customisations you subsequently confirm for import follow the account, cloud sync and backup behaviour described in this policy. You can revoke storage access in Android’s app settings. The Google Play version uses the system file picker on Android 10 and newer and does not request All files access.

VOD discovery and optional community rankings

Personal watch counts stay on this device within the active profile. They count qualifying playback in the built-in player and are removed locally on account sign-out or profile deletion. Recommendations use recent viewing locally to select a seed title. Discovery requests may send public TMDB IDs, or catalogue title names and years when resolving popularity metadata, through our cached metadata service to TMDB. Provider credentials and stream URLs are not included.

Sharing viewing counts is off by default for each profile on each device. If you enable it under Movies or Shows → Sort → Most watched on TiviGlass, known watched movie or series TMDB IDs are linked to your signed-in account for deduplication. At most one contribution per account/title/day and 30 titles per account/day are accepted. Only aggregate rankings for titles with at least five contributing accounts are displayed. Contributions are kept within a 30-day daily retention window and deleted with your account. Turning sharing off stops future contributions; existing contributions expire on that schedule.

6. Security

We use reasonable technical and organizational measures to protect service data, but no system is perfectly secure. You should also protect your device, account password, and access to email inboxes used for sign-in.

7. Your choices

You can stop using the service at any time.
You can remove playlists from the account portal that you no longer want stored there.
You can manage direct purchases through Stripe, Google Play purchases through Google Play, and App Store purchases through your Apple Account. Use the payment provider through which you bought your plan to cancel an auto-renewing subscription.
You can delete your TiviGlass account in the app using Delete your TiviGlass account in the account settings (on iPhone and iPad: Settings, Account & plan, Delete your TiviGlass account, then confirm twice), or sign in at tiviglass.com/account and use its account deletion control. If you cannot access your account, contact admin@obsidaby.com for help requesting deletion. The retention section above explains which records are retained.
You can turn diagnostic reporting on or off at any time in the TV app under Settings, Privacy & security, Send crash reports. On the same page you can switch off Remote technical checks (section 10), start a Private session so the app keeps no new watch history or searches, and clear your recent searches.
Where advertising choices apply, you can accept, reject, or manage purposes and vendors in the privacy message shown on an ad-supported page, and reopen those choices from its privacy options control. Browser controls can also remove stored advertising data.

8. Website advertising

Third-party advertising is currently disabled. Our website does not load advertising scripts or request advertising consent while ads are paused.

9. Diagnostic data (opt-in)

In the TiviGlass app you can choose to help improve the product by sending diagnostic reports. This is off by default and only happens if you turn it on, either at first launch or in Settings, Privacy & security.

This section describes the TV app. The iPhone and iPad app has no diagnostic reporting of its own and sends us no crash or error reports. If you have chosen in your iPhone or iPad settings to share analytics with app developers, Apple may pass us crash reports it has collected; Apple decides what those contain, and they are not linked to your TiviGlass account.

When enabled, a report may include:

Crash information — the technical error and where it occurred in the app.
App error events such as playback or network failures, and error lines from the app’s own device log. Playback errors name no channel or title. A web address in an error line keeps its server name and path but loses any login, token or key in it.
A playback and performance summary, sent at most once a week after at least 10 minutes of sampled playback or app resource measurements since the last report. It is numbers only: how many times playback started and how long the picture took to appear, how long video played, how often it failed to start or stopped to buffer, how many video frames were shown or dropped, how long the picture ran below its expected frame rate, how much of the viewing overlapped with the app updating in the background, and which type of decoder and player was in use. It is sent with the device and app details listed below, including counts of how the app last closed (for example a crash or the app stopping responding), memory use, and which video types the app has switched to software decoding. It names no channel, programme, title or provider, and it carries no error events. It is sent only while diagnostics are switched on.
A short technical record each time a video fails to play or the app switches to another copy of a channel, sent with the next report: when it happened (to the minute), which player and what kind of video (live TV, a film, an episode, catch-up or a recording), the kind of error and how it ended, the state of the connection at the time (for example whether the TV was offline, on Wi-Fi or a VPN), the type of video, sound and decoder, which recovery steps the app tried, how the device was coping (memory, temperature, background work), and what you did next (retried, changed channel, left or nothing). A switch record says why the app switched, whether the copy is on another of your services or accounts, how long it took to start and whether it kept playing. These records name no channel, programme, title, service or provider, carry no address, login or channel number, and are deleted from the TV if you turn diagnostics off before they are sent.
Sampled processor and memory use by the app, and graphics rendering times on devices that support them, grouped by whether the app was in front and held a video decoder. These measurements contain no names of anything you watch. They stop and unsent measurements are deleted when you turn diagnostics off. Graphics timing measures the app's interface frames, not the whole device's GPU usage.
Your app version and build, device model and manufacturer, and Android/OS version.
How much data the app is storing on this device — the size of its own database, how many playlists are saved, and how many channels, movies, shows and guide entries are cached. These are sizes and counts only: no playlist, provider, channel or title is named.
A random, app-generated identifier used only to group reports from the same install.

Reports are redacted on your device before they are sent: they do not include your account, usernames, passwords, tokens or keys, or the names of channels and titles you watch. The random identifier is not linked to your account and resets if you clear the app’s data or reinstall. You can turn diagnostics off at any time in Settings, Privacy & security.

A diagnostic report is sent without your device’s Android device identifier and without the app’s sync device identifier. Other requests the app makes to us, such as signing in, checking your plan and checking for updates, do carry the Android device identifier whether or not diagnostics are switched on. That is how we tell one TV from another and how we can act on a device when something is wrong with it. It is not used to build a profile of you.

10. Remote service checks

Separately from the opt-in reporting above, we may run technical health checks on a device signed in to your TiviGlass account, to find and fix faults across the devices we support. These checks are run by our staff and are recorded against the staff member who started them. This is done on the basis of our legitimate interest in keeping the service working.

A check reads the same technical information the app already holds about itself, such as:

App version and build, device model, OS version, and available memory and storage.
Whether your TV guide, channel list and recordings look healthy, and how many of each you have.
Recent playback, network and app errors, and which video and audio formats your device can decode.
Whether your provider connection is reachable, and how fast it responded.

These checks only read information — they never change a setting, alter your playlists, or control what is on screen. They are designed so you cannot tell one is happening: nothing is displayed, and any check that could interrupt what you are watching is postponed until the device is idle. The results are redacted on your device before they are sent and never include your provider username or password, your account password, or any token or key.

From the version of the app released with this policy, a check cannot read your watch history, favourites, watchlist or reminders, your recordings and timers, your channel, film or show line-ups or group names, your locked or hidden channels, your TV services’ names, or the title of what is playing. Those are switched off in the app itself, so a request for them is refused on the device. A check can read the server name of your TV service (never its login) and error logs; the app removes logins from them, and playback errors name no channel or title. Older versions of the app read more, as described in earlier versions of this policy, until they update.

Checks only run while the app is open and signed in. You can switch them off on each TV under Settings, Privacy & security, Remote technical checks, and a Private session pauses them while it is on. You can also ask us to exclude your devices at admin@obsidaby.com. A support session you start yourself is unaffected, because you are present and have agreed to it.

The iPhone and iPad app does not take part in remote service checks or support sessions.

11. Approximate location

UK broadcasters produce regional versions of some channels — your local BBC One or ITV1, with your own news and opt-outs. So that the app can offer you the right one rather than another part of the country's, it asks our servers for an approximate location. This is done on the basis of our legitimate interest in showing you the correct regional channel.

The approximate location comes from your internet connection's IP address, which every website you visit can already see. Our network provider turns it into a rough country, region and city — never a street, an address or a precise position. The app does not use your device's GPS and does not ask for location permission.

The app can ask for microphone access on some TVs, and only when you press Speak to search or Speak a setting. Your voice goes to your TV's own speech service (for example Google's on Google TV) to be turned into text, the same way it would from the TV's remote; TiviGlass keeps no recording and no transcript, and never listens unless you press the microphone.

We do not store it. The location is worked out when your device asks and is not written to your account or kept as a history; your device remembers only which TV region it settled on, and that stays on the device. If your connection appears to be outside the UK — which is what happens on a VPN — the app simply applies no regional preference.

That applies to the regional channel lookup only. Section 1 describes the records that do keep a country taken from your connection: the city and country held against each signed-in device, and the two-letter country code recorded when you start a purchase paid through Stripe.

The country of your connection also decides which currency our prices are shown and charged in when you buy directly from us: US dollars, euros, Canadian dollars or Australian dollars in the countries that use them, and pounds sterling everywhere else. Once an account has paid through Stripe, it keeps the currency it paid in, wherever you connect from later. The country is worked out for each request and is not stored for this; the currency you paid in is part of your payment record.

The iPhone and iPad app does not ask our servers for a location, does not use location services, and does not ask for microphone access. The city and country recorded against each signed-in device for the device limit (section 1) apply to it as they do to a TV.

12. Product milestones

When you are signed in, we record single first time product milestones for your account: the first reported times you finish configuring a TV service with channels, reach active playback (including a playing guide preview or radio), are shown a plan price in the app, open a checkout link for your account, and continue from that page to payment, plus the app version you used while on a free trial. Newer versions of the app also record when your free trial ended and the first time you see your trial countdown or a notice that your trial has ended. The app reports its own milestones with its normal account check in, and the checkout steps are recorded by our website when you open and use a checkout link. We combine these with account trial and purchase records to understand which parts of getting started need improvement. We do not use them to decide your price or access to the service.

These measurements do not include programme titles, channel names, provider details, playlist contents, viewing duration or a log of repeated activity. Activity while signed out is not attributed to the next account that signs in. A later report from another device can correct a timestamp to an earlier occurrence; it does not create an activity history.

Our lawful basis is our legitimate interest in understanding and improving setup, playback and plan selection. This account-linked measurement is separate from optional anonymous diagnostic reports and does not use that diagnostic toggle. You can object to this use of your information by contacting us through Help and support.

The iPhone and iPad app does not report product milestones.

13. The iPhone and iPad app

The iPhone and iPad app talks to our servers only while you are signed in to a TiviGlass account. When you are, it sends:

Your sign-in details when you sign in, and the sign-in tokens that keep you signed in. Accounts are created on our website, not in the app.
Its device details when it checks in with your account: the random device ID described in section 1, the kind of device (iPhone or iPad), the platform (“ios”) and the app version and build. Our servers record the IP address and approximate city and country of that request against the device, as they do for a TV.
Changes you make to the TV services, viewer profiles and devices saved in your account.
When cloud sync is active on your account, changes to the library it shares with your TVs, such as favourites, watch progress and viewing history, reminders and catalogue customisations.
If you manage recordings on one of your TVs from the app, and that TV has allowed it, your commands and the recording you play pass through our servers between the two devices. A recording is passed through in small pieces while you watch it and is not stored on our servers.
For App Store purchases, the transaction details described below.

The TV service logins saved in your account are sent to the app so it can play them, and are kept in the device’s keychain. The app connects directly to the TV services you add; that traffic, including any login you type in, goes to your provider and not through our servers. It may ask for local network access, only so it can reach a TV service you added by a local address.

The app contains no advertising, no third-party analytics or tracking software, and no advertising identifier, and it does not track you across other companies’ apps or websites. Programme reminders are notifications scheduled on the device itself; we do not send push notifications to it. It includes VLC’s open-source playback engine, which runs on the device and is used only to play the streams you open.

14. App Store purchases

In the iPhone and iPad app you can buy Essentials (a one-time purchase), Premium Yearly (an auto-renewing yearly subscription) or Premium Lifetime (a one-time purchase) through Apple’s App Store. Apple takes the payment and charges it to your Apple Account. We never see your card or bank details, and Apple does not give us your name or your Apple Account email address.

So that the plan lands on the right TiviGlass account, the app asks Apple to attach your TiviGlass account’s ID (a random identifier, not your email address) to the purchase. After you buy, the app sends us the Apple transaction number, and our servers ask Apple directly whether the purchase is genuine and still active. For each purchase we keep:

the Apple transaction ID and original transaction ID;
the account ID attached to the purchase, and the TiviGlass account it belongs to;
which plan it bought and whether it was made in Apple’s live store or its test store;
its status: when it was bought, and for the yearly subscription its expiry or renewal date, any billing grace period and whether it is set to renew;
when we last checked it with Apple.

Our record of the purchase does not hold the price you paid. We check active purchases with Apple from time to time, and when Apple tells us a purchase has changed, so that a renewal, a cancellation or a refund is reflected on your account. We use this information only to give you the plan you bought, to stop one purchase being claimed by another account, and to keep your account correct. Our lawful basis is performing our contract with you.

Deleting your TiviGlass account removes these records. It does not cancel an App Store subscription: cancel it on your iPhone or iPad in Settings, under your name, then Subscriptions, or from Manage App Store subscriptions in the app (Settings, Account & plan, App Store plans & purchases). Apple’s handling of your payment and Apple Account is covered by Apple’s privacy policy.

15. Changes to this policy

We may update this policy as the service changes. The effective date at the top of this page identifies the current published version.

Purchase journey measurements

We count plan views, checkout steps, recovery attempts and activation by platform and purchase route to find payment problems. These first-party counts contain no card information, email, account or device identifier, checkout URL or persistent visitor identifier. Counts are retained for up to 35 days. Website measurements respect Do Not Track and Global Privacy Control. Client observations are kept separate from provider-confirmed completion counts.