Privacy Policy - TiviMax IPTV Player

1. Introduction

Welcome to TiviMax IPTV Player ("Application", "we", "us", "our", or "Company"). We are committed to protecting your privacy. This Privacy Policy explains our data practices and how we handle information collected through our mobile application.

Please read this Privacy Policy carefully. By accessing or using TiviMax IPTV Player, you acknowledge that you have read, understood, and agree to be bound by all the provisions of this Privacy Policy.

2. Information We Collect

2.1 User-Provided Information

IPTV Server Credentials: When you log in, we collect your IPTV server URL and login credentials. These credentials are stored locally on your device only and are never transmitted to our servers.
Parental Control Settings: If you enable parental controls, we store your PIN hash (using SHA-256 encryption) and content restrictions locally on your device.

2.2 Automatically Collected Information

Firebase Analytics: We use Google Firebase Analytics to collect anonymized usage data, including:
- App sessions and session duration
- Features used and user interactions (e.g., which categories you browse, whether you use favorites)
- Device type (mobile or TV form factor)
- App version and Android OS version
- Crash reports and performance metrics
- Screen/page views
- Geographic location (country-level, based on IP)
Firebase Crashlytics: We use Firebase Crashlytics to collect crash reports and error diagnostics to improve app stability. No personally identifiable information or IPTV credentials are included in crash reports.
Firebase Remote Config: We use Firebase Remote Config to manage app configuration, including:
- Enabling/disabling ad serving
- Managing app update notifications
- Feature flags and gates
Device Information: We collect:
- Device model and manufacturer
- OS version and device form factor (phone vs Android TV)
- Device language and regional settings
In-App Review System: When you use the in-app review feature, Google Play's overlay collects interaction data. On TV devices, we show our own review dialog instead (no data sent to Google Play in this case).

2.3 Information from Third Parties

RevenueCat (In-App Purchases): When you purchase a premium subscription, RevenueCat processes your purchase. We receive anonymized subscription status and entitlements information to manage your account.
Google Play Store: Purchase information is handled by Google Play and RevenueCat.

3. How We Use Your Information

App Functionality: Local storage (ObjectBox database) maintains your favorites, watch history, and preferences.
Analytics & Improvement: We use analytics to understand user behavior and improve app features and performance.
Error Tracking: Crash reports help us identify and fix bugs to provide a stable experience.
Premium Services: Your subscription status enables premium features (ad removal, parental profiles, etc.).
Advertising: We serve targeted ads to free users via Google AdMob (non-personalized ads to comply with privacy regulations).

4. Data Storage & Security

4.1 Local Storage

All the following data is stored locally on your device using ObjectBox, a secure local database. This data is never uploaded to our servers and remains completely under your control:

IPTV Credentials: Server URL, username, and password (encrypted at rest)
Favorites: Your marked favorite Live TV channels, movies, and series
Watch History: Titles and content you've watched, including progress/resume points
Categories & Content: Local cache of Live TV, Movies, and Series categories and metadata from your IPTV provider
Parental Control Settings: PIN hash (SHA-256), kid profile status, and whitelisted category IDs
Player Preferences: Your choice of player (ExoPlayer or VLC), playback settings
EPG Data: Electronic Program Guide (channel schedules) synced from your IPTV provider

4.2 Encryption

Parental control PINs are stored as SHA-256 hashes (not reversible)
All network communications use industry-standard HTTPS encryption where applicable
IPTV stream connections use the protocol specified by your server

4.3 Data Security Measures

We employ best practices for data security and privacy protection
However, no method of transmission or storage is 100% secure
We recommend using strong passwords for your IPTV server accounts

5. Third-Party Services

5.1 Firebase (Google)

We use Firebase services for:

Analytics: Usage tracking and feature analytics
Crashlytics: Error and crash reporting
Remote Config: Configuration management

Google's privacy practices are detailed in their Privacy Policy.

5.2 Google AdMob

Free users see ads served by Google AdMob. AdMob may collect certain device and usage information. We serve non-personalized ads to comply with privacy regulations. Premium users see no ads.

Even for non-personalized ads, Google AdMob and Google Play Services access your device's Advertising ID (a resettable identifier) and related device identifiers for purposes such as frequency capping, ad measurement, and fraud prevention. You can reset or delete your Advertising ID at any time via Android Settings → Privacy → Ads.

Google's advertising privacy practices can be found in their Privacy Policy.

5.3 RevenueCat

RevenueCat handles in-app purchase processing and subscription management. They collect transaction and subscription data. See RevenueCat's Privacy Policy.

5.4 IPTV Providers

When you connect to an IPTV server, you are connecting directly to a third-party server controlled by your IPTV provider, not our servers. We do not control or monitor these connections. Your use of IPTV services is subject to your provider's terms.

5.5 International Data Transfers

The third-party services we use (Firebase, Google AdMob, and RevenueCat) are operated by companies based in the United States and may process data on servers located outside your country of residence, including outside the European Economic Area (EEA). Where data is transferred internationally, these providers rely on safeguards such as the EU Standard Contractual Clauses and applicable data protection frameworks to protect your information. By using the Application, you understand that your anonymized usage and diagnostic data may be transferred to and processed in these jurisdictions.

6. Children's Privacy

TiviMax IPTV Player includes parental control features designed to help restrict content access for children. Parents/guardians can set a PIN and whitelist age-appropriate content categories.

Our services are not intended for children under 13 without parental consent. If we discover we've collected information from children under 13 without parental consent, we will take steps to delete such information.

In the European Economic Area and the United Kingdom, the age of digital consent may be higher (up to 16, depending on the country). Where a higher age applies, users below that age must have consent provided or authorized by a parent or guardian.

7. Your Privacy Rights

7.1 Access & Control

All your personal data is stored locally on your device
You have complete control over your data and can delete it anytime by uninstalling the app or clearing app data
You can disable analytics in app settings (where available)

7.2 GDPR & Data Subject Rights (if applicable)

If you are located in the European Economic Area, you have rights under GDPR including:

Right to access your data
Right to rectification of inaccurate data
Right to erasure ("right to be forgotten")
Right to restrict processing
Right to data portability
Right to object to processing

To exercise these rights, contact us at the email address below.

7.3 Legal Basis for Processing (GDPR)

Where GDPR applies, we process your information under the following legal bases:

Consent: For analytics and advertising, which you may grant or withdraw. In the EEA/UK, a consent prompt is presented before non-essential analytics and ads are enabled.
Legitimate interests: For crash reporting, app stability, security, and fraud prevention, balanced against your rights and interests.
Performance of a contract: For processing premium subscriptions and delivering the features you request.

7.4 California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information is collected, to request access to or deletion of it, and to opt out of the "sale" or "sharing" of personal information. We do not sell your personal information. Because we serve only non-personalized ads and store your personal data locally on your device, we do not share personal information for cross-context behavioral advertising. To exercise your California rights, contact us at the email address below. We will not discriminate against you for exercising these rights.

8. Data Retention & Deletion

8.1 Automatic Retention

Local App Data: Retained on your device until you uninstall the app or clear app data through Settings
Firebase Analytics: Google typically retains data for 60 days; older data is aggregated
Crash Reports: Retained for up to 90 days for debugging purposes
Server Logs: We do not maintain server-side logs of your streaming activity or personal data

8.2 User-Initiated Deletion

Logout: Logging out clears your IPTV credentials from the app
Clear App Data: Using Android Settings → Apps → TiviMax → Storage → Clear Data will delete all locally stored data
Uninstall: Completely removing the app will delete all local data associated with it
Parental Controls Reset: Logging out resets all parental control settings to defaults

8.3 Third-Party Data Retention

Google Play Store: Purchase history may be retained per Google Play's policies
RevenueCat: Subscription data is retained per RevenueCat's privacy policy
Your IPTV Provider: Server logs and access patterns may be retained by your IPTV provider

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or other factors. We will notify users of material changes by updating the "Last Updated" date at the top of this policy. Your continued use of the app after changes constitutes acceptance of the updated Privacy Policy.

10. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us at:

Company: Axovate Labs
Email: axovatelabs@gmail.com
Address: Axovate Labs, Dhaka, Bangladesh