Privacy
How Playova treats your data.
Last updated: 5 November 2026
In force from: 14 September 2026
The short version
Playova stores your sources, catalogue, guide, recordings and downloads on your device. Account services process your email, device and licence information. When cross-device sync is enabled and your account is eligible, watch progress and ratings are also sent to the service. Installation reporting and sync have separate controls in settings; licence checks and connections to your provider are not disabled by those controls.
What the account holds
When you create an account, we store your email address, a password hash or external sign-in identifier, and the device and licence information needed to provide account access. Device records include a device identifier hash, name, platform and app version. The name is a generic description or model name where available and can be changed. Account events such as sign-in, linking a device or disabling a licence include the country indicated by the request and are deleted after 90 days. Purchase records include the store’s transaction identifier and payment status. If you add a passkey, we store its public key and identifier, the name you give it and the dates it was added and last used; the private key stays on your device or in your password manager.
What stays on your machine
Sources, catalogue data, the guide, recordings and downloads are stored on your device. Watch history is also stored locally; eligible accounts can sync progress and ratings as described below. On desktop and mobile, the provider password and media addresses containing credentials are encrypted in the local database. The Xtream server address and username remain readable so sources can be identified. Local encryption does not protect against someone who can run programs as you on the device. Your provider credentials are used when connecting to your provider; they do not stay exclusively on the device.
What follows you between devices
Watch progress and ratings can sync between eligible devices on the same account with Plus or a trial that includes sync. Sync sends content identifiers, position, duration, completion state, viewing and rating times, ratings, and identifiers for the profile and source. Profile and source identifiers are unsalted hashes. A source hash is derived from the Xtream server address and username, or the full M3U address; someone who already knows those values can calculate the same hash. Media files are not uploaded by sync. The sync setting controls both progress and ratings on each app. Records are kept for at most 400 days and deletion markers for 30 days. An enabled end-of-licence retention policy may shorten this period and provide advance notices.
Sending a source to a television without a code
Your phone can send a source without a code to a television signed in to the same account while that television is waiting: on Roku while its “Receive from phone” screen is open, on our other televisions while the setup code is on the screen. This transfer is not end-to-end encrypted: our service holds the provider address, username and password, or the full playlist address, encrypted with a key that also passes through it, for at most ten minutes, and deletes them as soon as the television collects them. Sending with the code shown on the television stays end-to-end encrypted; there our service only ever holds data it cannot read.
Finding the television on the same home network
When a television shows its quick setup code, our service also keeps a salted hash of the internet address it connected from, for at most ten minutes. A phone or computer of yours that connects from the same address can then list that television by its name and send a source to it without typing the code. The source stays end-to-end encrypted as with the code, and the television asks you to confirm before it uses it. The hash is deleted together with the code. Someone else behind the same internet address, for example on a shared building network, could see the waiting television’s name, but cannot read what is sent to it.
The install count
Installation reporting sends a randomly generated installation ID, platform, app version, language, system version where available, first-use time and acknowledged notice identifiers. The server adds the country indicated by the request. It uses no hardware-derived identifier. Desktop and mobile report at startup and once every 24 hours while running; TV reports at most once every 24 hours. This setting is on by default and can be turned off. When off, the app can still request notices using platform, app version and language, without an installation ID. This does not disable separate account or licence requests. Installation records are deleted after 180 days without activity.
Technical support reports
From Help → Troubleshoot you can send an optional technical report. Nothing is sent until you press “Send report”; opening Help only asks the service whether sending is open. The report goes to Playova’s separate support service, support.playova.app, and contains the platform, app version and language; the device model and system version where the app can read them; a short technical record of the last playback attempt (timings, playback events, error code, network state and whether you asked while watching); the technical identity of the video (codec and profile names, picture size, sound and subtitle formats — never titles, languages, addresses or file names); your answer to the question; the connection speed, if you measured it there; and any description and contact e-mail you choose to write. Addresses, passwords, e-mail addresses and IP addresses typed into the description are removed before sending, and your account e-mail is not added. Reports are kept in Cloudflare D1 in the European Union and deleted after 30 days; only Playova support reads them. To limit abuse, the service counts requests per minute under a keyed hash of your IP address; the count expires after two minutes and is removed at the next hourly cleanup. To have a report deleted sooner, write to [email protected] with the time and device you sent it from.
Payments
When sales are enabled, purchases are processed through the supported store: the App Store, Mac App Store, Google Play, Microsoft Store or Samsung Checkout. The store processes payment details under its own privacy policy; Playova does not receive your card details. We verify purchases with the store and keep the transaction identifiers and purchase records needed to manage the licence. Mac App Store verification also sends the app receipt and eligible hardware addresses from the Mac to our service to verify that the receipt belongs to that device; these receipts and hardware addresses are not stored or logged.
Your address is used only for sign-in links, receipts and notices about your own account; the post goes through Resend. There is no marketing list, so there is nothing to unsubscribe from.
Service providers and external connections
The website and account service run on Cloudflare. Turnstile receives your IP address for security checks during sign-in and registration. Our rate limits use a hash derived from the IP address; Cloudflare manages its own network logs under its own retention rules. Google, Apple or Microsoft sign-in provides an account identifier and email address. Apple, Google, Microsoft and Samsung verify purchases made through their stores. Your IPTV provider receives the requests and credentials needed to deliver your content. Images may be fetched from your provider or image services such as TMDB, Amazon or Google; those servers see your IP address. On desktop, TMDB, IMDb and YouTube pages opened in the reading view use their own cookies in a separate browser area. Erase everything clears that area too. When the app finds that a film is arriving too slowly to play without pauses, and only while the setting that measures connection speed is on (it is on by default), it downloads a short anonymous test file of at most 8 MiB from updates.playova.app and compares its speed with that of the film to tell whether your provider or your connection is slow. The result of this automatic check is kept for thirty minutes, or ten minutes after a failed check, and the check is not repeated while the result is kept; a check that gets no answer at all is not kept and is tried once more. When you start the connection speed test yourself, in the settings or from the question about a slow connection that appears while a film is paused, the app downloads a larger anonymous test file from updates.playova.app, repeating it if it ends early, for about ten seconds and at most 1 GiB in total; how much it downloads depends on the speed of your connection (for example about 12 MB on a 10 Mbit/s line, several hundred MB on a very fast one). It shows the speed live on a gauge and measures anew each time you start it. Neither the automatic check nor the test you start ever runs on a connection the device reports as mobile data; a TV or a computer that cannot tell what kind of connection it is on treats it as a fixed line. The app sends nothing that identifies you. Cloudflare, which serves the file, sees your IP address in its own network records under its own retention rules, and the request also appears in the operational records of Playova’s Cloudflare account for at most seven days; these records may include your IP address.
Where your data is kept
Account data is stored in Cloudflare D1. The recorded database region is Eastern Europe, without a country-specific jurisdiction setting. Playova installers and update files are served from Cloudflare R2. Films, series and channels come from your own provider; they are not hosted by Playova.
The free trial
The trial runs for fourteen days. It starts on each device on its own, and once a device is added to an account, the account's devices share the one trial that started first. So that it cannot simply be started again, a record of the device stays after the trial ends and after an account is deleted — but with nothing in it that names you: only the hash standing in for the device and the dates.
Deleting your data
On the account and data page you can, after proving who you are again, download your account data and delete your account. Deleting removes your sign-in, your devices, your viewing history, your scores, your sessions and the account itself. It does not reach the files on your own machine. What we keep on purpose: the payment records and the identifier that ties them to you — both because the payment has to be accounted for, and because that identifier is what stops a later message from the payment provider bringing the deleted account back. Deleting the account ends an earlier web subscription at the close of its paid period; it does not cancel billing through a store, which you cancel in that store. If the page is not available to you, write to [email protected].
Guest licences and recovery
A web purchase made without an account keeps a recovery e-mail address, the order details, the licence period and a hash identifying the assigned device. Recovery links and backup codes prove access; only their hashes are stored on the server. Do not put these secrets in support messages or invoices. Security actions may require an e-mail notice.