Privacy policy

Last updated: 14 October 2026

1. Who we are

iAm Player is published by Steeven Danieau, an independent developer based in France (see the Legal notice), who is the controller of your data. This policy covers the app (phone, tablet, Android TV and Windows) and this website. iAm Player is a player: it provides no content.

For any question or request about your data: support@iamplayer.app.

2. Data we collect

• Account: your email address and your password, stored as a hash from which it cannot be recovered. If you sign in with Google, your Google ID and your email address.
• Sign-ins: for each signed-in device, the app version and the platform (Android, Android TV, Windows…); the device name when you sign in with a QR code; the IP address and browser used when you ask to reset your password.
• Profiles: the name and avatar of each profile, its parental control PIN and its settings.
• Your sources: the link of your M3U playlists, or the server, username and password of your Xtream accounts (password encrypted), and the link of their TV guide. To build your catalogue, our server connects to your provider with this information and keeps what it returns: names of channels, films and series, categories, and the playback links of M3U playlists.
• Activity: favourites, history, playback positions, watched episodes, hidden categories and their order, TV guide reminders. This data is sent to our server when syncing between devices is part of your plan; otherwise it stays on the device. Catalogue searches are sent to our server to get the results.
• Purchases: the product bought (monthly, yearly or lifetime), its status and its dates. Payment is handled by Google Play, or on Windows by RevenueCat's payment page: we never receive your bank details.
• Analytics and diagnostics: the app uses Firebase (Google). Firebase Analytics receives the screens viewed and usage events (start-up, playback, errors, channel changes…), the device model and its system version, an installation ID, the advertising ID on Android and an approximate location derived from the IP address; no account identifier is attached to them. Firebase Crashlytics receives crash reports (the app's technical state, device, installation ID), from which the links and credentials of your sources are removed before sending. Firebase Remote Config receives the country, language and system version to adjust the app's settings.
• Server logs: IP address, date, requested address (sensitive parameters are masked) and app version, for security and diagnostics.

We do not collect your contacts, your photos or your precise location. Voice search goes through your device's speech recognition: the app only receives the text. The app shows no ads.

3. Why, and on what legal basis

• Providing the service (account, profiles, sources, catalogue, sync, purchases): performance of our contract with you.
• Securing accounts (sessions, new device sign-in alert, password reset, logs): legitimate interest.
• Measuring usage and fixing crashes: legitimate interest in improving the app's stability. You can object by writing to us.
• Keeping purchase accounts: legal obligation.

The only emails we send are about your account (password reset, new device sign-in): no marketing.

4. Service providers and third-party services

• Oracle Cloud hosts our server and database in France (Paris region).
• Infomaniak (Switzerland) sends our emails.
• Google provides Firebase (Analytics, Crashlytics, Remote Config), Sign in with Google and Google Play payments.
• RevenueCat (United States) manages subscriptions: it receives your account ID and your purchases.
• To show title pages, the app also contacts directly TMDB (title information and posters), TheIntroDB (skipping intros and credits: it receives the TMDB ID of the title playing), YouTube (trailers) and the provider of your sources. These services see your IP address and apply their own privacy policy.

We do not sell your data and do not share it for advertising. Transfers outside the European Union (Google and RevenueCat in the United States) are covered by the safeguards the GDPR provides (standard contractual clauses or the EU-US Data Privacy Framework); Switzerland benefits from an adequacy decision.

5. How long we keep data

• Account, profiles, sources and synced activity: as long as your account exists. They are deleted with it.
• Deleted source: its link and credentials are erased at once; titles already imported stay linked to your account, to resume playback, until the account is deleted.
• Sessions: valid for 7 days, then erased at the next sign-in or with the account.
• QR code sign-in and adding a source from a phone: 24 hours.
• Password reset requests: until the account is deleted.
• Purchase history: for the legal retention period of accounting records (10 years), including after the account is deleted. RevenueCat also keeps the history linked to your account ID; we ask for its deletion on request.
• Server logs: 90 days at most.
• Database backups: renewed with each server update; the five most recent are kept.
• Firebase: 90 days for crash reports, 14 months at most for detailed analytics data.

6. Security

All exchanges with our server are encrypted (HTTPS). Account passwords are hashed, those of your sources encrypted. The credentials of your sources are masked in our administration tool and removed from logs and error reports. Access to the server is restricted.

7. Your rights

You can access your data, correct it, erase it, restrict its use, get it in a common format (portability) and object to its processing, including analytics. Write to us at support@iamplayer.app: we reply within one month.

To delete your account and its data: Settings › Account › Delete my account in the app, or the Account deletion page. To delete only part of it, remove a source, a favourite or your history in the app.

Deleting your account does not cancel a Google Play subscription: cancel it in Google Play.

You can also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

8. Children

iAm Player is not intended for children under 13.

9. This website

This website sets no cookies and does not measure its audience. It stores in your browser (local storage) the theme and language you choose. Its fonts are loaded from Google Fonts, which sees your IP address.

10. Changes

The date of the last update is shown at the top of this page. We announce significant changes in the app or on this website.