Legal

Privacy Policy

Last updated: October 27, 2026 · Policy version 2026-10-22

Controller

My TV Player is operated by QUANSIGHT CONSULTING SARL. Privacy and data-protection inquiries: .

Data we collect

Account: email, display name, hashed password, OAuth identifiers if you use social sign-in.
Playlists: M3U URLs, uploaded files, provider logins (server address, username and password; the username and password are encrypted), parsed channel metadata, EPG URLs.
Usage: favorites, custom, pinned and hidden groups, channel overrides, reminders, sport preferences, profiles (name, picture, kid settings and a hashed PIN), and what each profile watches and where it stopped (watch history). Watch history is on by default; turn it off or clear it in the app under Settings > Privacy, or on the website under Account > Privacy.
Devices: platform label, hashed device fingerprint, the masked public IP address of the device's last check-in, the masked local network address the app reports, and the approximate place (city or region, and country) of that check-in. We use them for your device list and for security alerts.
Sign-in sessions: the masked public IP address each sign-in session was started from, to protect your account.
Billing: your plan and the purchase record the store sends us when you buy: the store (Google Play, the App Store, the Microsoft Store or the Amazon Appstore), the product, the purchase and renewal dates and the store's order reference, and for an Amazon Appstore purchase, your Amazon user ID. We use it to give you your plan. The store takes the payment and holds your payment details; we never see your card details.
Technical: app version, OS, crash and error reports (sent by default; opt out in the app under Settings > Privacy).

Data we do not collect

We do not use what you watch for advertising, and we never share it with anyone.
We do not sell or rent personal data, there are no ads.
We do not load third-party tracking pixels on the website unless you choose "Accept all" in the cookie banner.
We never host, record, store or transcode your video streams on our servers.

Crash reports and telemetry

The native apps send crash and error telemetry so we can find and fix stability problems. Telemetry is enabled by default.

What is sent: crash reports, error diagnostics, app version and OS information, session counts, and sampled performance timings.
Why: to keep the apps stable and improve quality. Telemetry is never used for advertising or profiling.
Where it goes: Sentry, our error monitoring processor, using EU-hosted ingestion.
Never included: playlists, viewing activity, credentials, or other personal content.
Retention: reports are kept under Sentry's standard retention policy, then deleted.

You can opt out at any time in the app under Settings > Privacy > Send crash reports.

Legal bases (GDPR)

Contract providing the service you signed up for.
Legitimate interest fraud prevention, abuse detection, product security, crash/error telemetry (enabled by default with an in-app opt-out), and watch history with the personalized rows ranked from it (both on by default, turn them off in Settings > Privacy).
Consent marketing emails, and analytics and advertising cookies on the website (all off by default).

Where data lives

Application data is stored in our PostgreSQL database on servers we run ourselves in France. Files kept on our side (profile pictures and CloudSync playlist uploads) use our own S3-compatible storage on the same servers. Database backups are kept 30 days.

Data transmission and security

The data described above (your account, profiles, settings and synced data, purchase confirmations exchanged with the app stores, and crash reports when they are enabled) travels between your apps or this website and our services only over encrypted HTTPS connections. Provider usernames and passwords are also stored encrypted on our servers.

The IPTV provider you add (a provider login, an M3U playlist or a portal) is chosen and configured by you, and we do not control its servers. Our apps connect to that provider directly from your device, using the address and login details you entered and whichever protocol the provider supports. Many providers support only unencrypted HTTP, and some present invalid security certificates, which our apps accept for provider connections only. Your provider login details and stream requests may therefore travel unencrypted between your device and the provider. When you add or refresh a provider login, our servers may also contact the provider at the address you entered, in the same way, to check the login and the account status; they never download your channels or streams. We never send your provider login details to third parties.

IP addresses and location

We save IP addresses only in masked form. For an IPv4 address the last part is removed (a /24 network); for an IPv6 address only the first 48 bits are kept (a /48 network). We keep the masked public address of each device's last check-in and of each sign-in session, and the masked local network address the app reports.

The approximate place (city or region, and country) comes from Cloudflare, our network provider, which works it out from each request on its way to our servers. We make no lookup with any other service, and no address leaves our servers for this.

Consent records (when you accept the Terms or this policy) and our administration audit records keep a one-way hash of the masked address, never the address itself. Our device security history keeps a keyed one-way hash of the full address, never the address itself.

Our server request logs keep the full IP address for 7 days, only to investigate security problems and abuse. Then they are deleted.

Retention

How long we keep each kind of data:

Account data: while your account exists. When you ask to delete your account, it is erased after a 7-day grace period in which you can cancel; copies in our backups are gone within 30 days after that.
Free trial records (your email and a one-way hash of the device fingerprint): 24 months, or until your account is erased.
Devices, with their masked addresses and approximate place: while the device is on your account. A removed device is purged 90 days after removal.
Device security history (device changes, with a keyed one-way hash of the full IP address): 400 days.
Sign-in sessions, with their masked address: a session lasts up to 30 days. Its record is deleted 7 days after it expires, or 30 days after it is revoked, for example when you sign out.
Consent records, with the hash of the masked address: while your account exists. They are deleted with it.
Administration audit records, with the same hash: 3 years.
Server request logs, with the full IP address: 7 days.
Purchase records: up to 7 years, for legal accounting and tax obligations, also after your account is deleted.
Continue-watching rows: deleted with the profile, or when you clear history or opt out.

When your account is erased, everything above is deleted with it, except purchase records, administration audit records and server request logs, which are kept until their period above ends, or longer when the law requires us to keep data for a pending legal claim.

Cookies & local storage

Without your consent we set only strictly necessary cookies: the HttpOnly refresh token and CSRF protection for sign-in, and the NEXT_LOCALE cookie that remembers your language. Analytics and advertising cookies are set only if you choose "Accept all" in the cookie banner. Until then, or if you choose "Essential only", Google Analytics sets no cookies and sends Google only cookieless measurement pings (pages viewed and sign-ups). If you accept, Google Analytics may set its _ga cookies to measure visits, and we load the Meta (Facebook) pixel, which sets its _fbp cookie, to measure whether our ads lead to sign-ups. These scripts run on every page of this site, including the console, and Google and Meta may process this data in the United States. Your choice is saved in your browser. You can change or withdraw it at any time with the link at the bottom of every page of this site, also found in the account menu of the console. A withdrawal takes effect at once: Google Analytics returns to cookieless measurement, the Meta pixel stops sending data, and we delete the _ga and _fbp cookies they set on our domain. Theme preference uses localStorage key mtp.theme. The console also stores a few items in your browser: the profile you last picked, a random ID that lets the Devices page recognize this browser, your optional username, profile pictures you upload from this browser, your recent actions in the "Search or jump to" menu, whether you hid the "Set up your household" card on Home, the last "What's new" entry you saw, and settings saved by older versions, which are moved to your account. Until you close the tab, it also keeps a note that a language change was saved and, after a CloudSync upload, the key that protects your uploaded playlists. Privacy toggles sync to your account server-side.

Processors

Google (Google Play), Apple (App Store), Microsoft (Microsoft Store) and Amazon (Amazon Appstore) sell plans bought in their stores as their own controllers, under their own privacy policies; what we exchange with them is limited to checking the purchase.
Amazon (Amazon Appstore), for plans bought in the Fire TV app: to check a purchase, our server sends Amazon's Receipt Verification Service the purchase's receipt ID and the Amazon user ID the app reports, and Amazon answers with the product bought, its purchase, renewal and cancellation dates and whether it renews. Amazon also tells us when such a purchase changes, for example when it renews or is canceled, through Amazon Web Services' notification service (Amazon SNS); each notice names only the receipt ID and the Amazon user ID. We never send Amazon your email address or other account details.
Cloudflare, our network provider: it carries traffic between you and our websites and services, and gives us the approximate place of each request (city or region, and country).
Sentry, crash and error monitoring for the native apps (EU-hosted ingestion).
Postmark, our transactional email provider (United States): account verification, password resets, and security and subscription alerts.
Microsoft (Windows Push Notification Services), to deliver the reminders and alerts you turn on to the Microsoft Store apps: we send the notification text and the device's push address.
Google, Microsoft and Apple, optional sign-in (limited profile data).
Telegram, only if you link the optional notification bot; reminder text is delivered through Telegram.

Your rights

Access, rectify, export, or delete your data from Account > Privacy or by emailing . Update your display name on Account anytime. To change your sign-in email, use Account > Change email, we verify the new address before swapping it. We respond within 30 days. You may lodge a complaint with your local supervisory authority.

Children

The service is not directed at children under 16. Kid profiles are controlled by the account owner with parental PINs, we do not knowingly collect data from minors without guardian consent.

International transfers

Primary storage is in the EU. Crash and error telemetry goes to Sentry with EU data residency.

Cloudflare, Inc., based in the United States, is our network provider: every request to our websites and services passes through it, so it processes your IP address. Transfers to the United States rely on the EU-US Data Privacy Framework, under which Cloudflare is certified. The European Commission adopted its adequacy decision for this framework on 10 July 2023, and the EU General Court upheld it in September 2025. As a fallback, they also rely on the Commission's Standard Contractual Clauses.

Postmark (email), Microsoft (push notifications) and the sign-in providers Google, Microsoft and Apple may process data in the United States, under Standard Contractual Clauses and their data processing terms.

Google, Apple, Microsoft and Amazon process payments for plans bought in their stores as their own controllers, under their own terms.

Changes

We will post material changes here and email account owners 14 days before they take effect.