Privacy Policy

Streamly ("we", "us", "our") respects your privacy. This Privacy Policy explains what data the Streamly apps for iPhone, iPad, Apple TV, Mac, Android phones and tablets, and Android TV ("the App") collect, where it goes, and the choices you have. By installing or using the App you agree to the practices described here.

If you have questions, contact us at streamlyiptvpro@gmail.com.

1. Who we are

The App is developed and operated by Aylana Studio, the studio name of Yasser Farag, an individual developer based in Egypt (Apple Developer Team ID: M7GK7B47H6).

2. What Streamly does (and does not do)

Streamly is an IPTV player. You provide your own M3U playlists or Xtream Codes portal credentials, and the App fetches and plays whatever your source serves.

Streamly does not host, distribute, encode, or sell any video content. Every stream URL is supplied by you. The App is a client; the responsibility for the content you load into it sits with you and your IPTV provider.

3. Your Streamly identifier

On first launch the App creates an anonymous account for you in Firebase Authentication. Its identifier (a random "user ID") is what your backup, purchases, analytics and crash reports are filed under. It contains no personal details. If you later sign in with Apple or Google, the same identifier becomes your account, and data filed under it becomes linked to that account.

4. Data we collect

4.1 Information you provide

• Account info (optional) — email address and display name, if you sign in with Apple or Google. Stored in Firebase Authentication. On iPhone, iPad, Apple TV and Mac your email is also attached to your analytics profile in Mixpanel (see 4.2).
• Playlists — playlist names, M3U URLs, and Xtream Codes server address, username and password. Stored on your device, and backed up to your private area of our Firestore database for every user, signed in or not, so a reinstall or a new device can restore them. Your provider password is stored there as entered.
• Favorites and watch history — the titles and IDs you favorite, and resume positions. Stored on your device. They are also synced to your private Firestore area: on Android for every user; on Apple devices for Pro subscribers.
• Purchases — subscription and lifetime purchase state. Processed by Apple (App Store), Google Play and RevenueCat.
• Premium playlist requests (iPhone, iPad, Apple TV, Mac) — when you tap "Request Access" on a curated paid playlist, the analytics event records a salted SHA-256 hash of your email, its domain (for example gmail.com), and the name of your active playlist — never the email address itself.

4.2 Information collected automatically

• Product analytics — which screens you open and features you use, playback starting, ending and failing, purchases, and settings changes. Events are tied to your Streamly user ID. Some events carry: the titles and IDs of content you open or play; your active playlist's name, server address and portal username (never the password); and, for failed streams, the stream address with its credentials removed. Processors: Google Analytics for Firebase and Mixpanel.
• Crash and error reports — crashes, non-fatal errors, recent in-app log lines ("breadcrumbs"), and the playlist name, server address and portal username involved in a failure. Tied to your Streamly user ID. Processor: Firebase Crashlytics.
• Playback diagnostics — when a stream fails, a record in your private Firestore area with the title, the full stream address (which, for Xtream playlists, contains your portal username and password), the error, the player engine, device model, operating system and network type. Used to find and fix provider and playback problems.
• Playlist diagnostics — when an Xtream Codes playlist fails to load or refresh, a record in your private Firestore area with the playlist's name, server address, username and password, and the error. Used to reproduce and fix playlist problems.
• Performance metrics — app start time, screen render time and network request timings, which may include request addresses. Processor: Firebase Performance Monitoring (not on Android TV).
• Country — to show what's trending in your country, the App asks Cloudflare which country your IP address belongs to, and sends that country code to The Movie Database (TMDB). We do not store your IP address or any location more precise than the country.
• Identifiers and device details — your Streamly user ID (also used as your RevenueCat and Mixpanel ID), the Firebase installation ID, device model, operating system, app version, language and region. Streamly does not use advertising identifiers.
• Remote configuration — feature settings delivered to your device. Processor: Firebase Remote Config.
• Push notifications (iPhone, iPad, Android phones and tablets) — when News, tips & offers is on (on Android it is on once you allow notifications; on iPhone and iPad you turn it on), the App keeps a small record in your private Firestore area so we can send you notifications: the device's push token, platform, whether it is a phone or tablet, app language and version, whether you have Pro and a playlist, whether the device is in the small group we hold back from come-back reminders, and when you last opened the App. Turning the switch off deletes the record, and so does deleting your account. Processor: Firebase Cloud Messaging.

4.3 The "Help improve Streamly" switch

You can turn data collection for improvement off any time in Menu → Privacy → Help improve Streamly. When it is off:

• Product analytics events stop (Google Analytics and Mixpanel), and your user ID is cleared from them;
• Non-fatal error reports, breadcrumbs and playback diagnostics stop;
• On Android, crash reporting and Google Analytics' automatic collection also stop, and unsent crash reports are deleted.

In the current versions (iOS, iPadOS, tvOS and macOS 1.5.2; Android 1.5.3) the switch does not stop: crash reports and Google Analytics' automatic collection on Apple devices, performance metrics, and playlist diagnostics on either platform. The next update makes the switch stop all of these. Your playlist and library backup is part of how the App works and is not affected by the switch.

We do not collect:

• Your precise location, or any location beyond the country described above;
• Your contacts, photos, calendar, or health data;
• Advertising identifiers — Streamly contains no advertising SDKs, and on Android the advertising ID permission is removed;
• What you type into search — searches run on your device;
• Voice recordings. Voice search on Apple devices uses Apple's speech recognition (on-device where supported); on Android TV it uses the system's speech recognizer, provided by Google. Streamly never receives or stores the audio.

5. How we use your data

• Operate the App — load your playlists, remember favorites, restore playback position.
• Back up and sync — restore your playlists after a reinstall, and sync your library across devices.
• Verify purchases — confirm your subscription or lifetime entitlement.
• Fix problems — crash reports and diagnostics are used to find and fix bugs and provider failures.
• Improve the App — analytics show which features are used and where things go wrong.
• Show content information — titles from your playlist are looked up on TMDB for artwork, descriptions and cast.

We do not:

• Sell your data;
• Share your data with advertisers;
• Use your data to build profiles for marketing to you.

6. Legal basis for processing (GDPR)

If you are in the EEA / UK, our legal bases are:

• Contract performance — data needed to deliver the App's core functionality (account, playlists, backup, purchases).
• Legitimate interest — crash reporting, diagnostics, performance monitoring and analytics, which you can switch off as described in 4.3.
• Consent — for any data collection that is not strictly necessary. You can withdraw consent at any time in the App's settings.

7. Who receives data

We share data only with the service providers below, each bound by its own privacy and security commitments:

• Google (Firebase) — Authentication, Firestore, Cloud Messaging, Crashlytics, Performance Monitoring, Analytics, Remote Config. firebase.google.com/support/privacy
• Mixpanel — product analytics (EU data residency). mixpanel.com/legal/privacy-policy
• RevenueCat — purchase and subscription management. revenuecat.com/privacy
• Apple — Sign in with Apple, App Store purchases and ratings, speech recognition. apple.com/legal/privacy
• Google — Google Sign-In, Google Play purchases, ratings and updates, Android TV speech recognition. policies.google.com/privacy
• The Movie Database (TMDB) — receives titles from your playlist and your country code to return artwork and details. themoviedb.org/privacy-policy
• Cloudflare — sees your IP address when the App looks up your country. cloudflare.com/privacypolicy
• YouTube — plays trailers when you choose to watch one. policies.google.com/privacy

When you cast to a Chromecast, the stream address (including any credentials in it), title and artwork are sent to your Chromecast and played with Google's media receiver. Your IPTV provider receives your requests to its own servers, as with any player.

We will only disclose data to anyone else if compelled by valid legal process.

8. International data transfers

Our service providers may process data in the United States and other countries. Where required, we rely on Standard Contractual Clauses or an equivalent approved transfer mechanism for transfers out of the EEA / UK.

9. Data retention

• On-device data — until you delete it in the App or uninstall the App.
• Your Firestore area (playlists, library, diagnostics) — until you delete your account or ask us to delete it.
• Crash reports — 90 days (Firebase default).
• Google Analytics events — 14 months.
• Mixpanel events and profiles — until you ask us to delete them, or the project's retention period ends.
• Purchase records — as long as needed for subscription management, refunds and legal obligations.

10. Your rights

Subject to applicable law (GDPR, UK GDPR, CCPA and others), you have the right to access, correct, delete and export your data, to object to or restrict processing, and to withdraw consent at any time.

• Delete Account in the App's account settings deletes your sign-in account and your playlists, favorites and history in Firestore. In the current versions it does not delete your diagnostics records; the next update deletes them too. Until then, email us and we will delete them.
• Analytics data (Google Analytics, Mixpanel) and crash reports are deleted on request.

To exercise any of these rights, email streamlyiptvpro@gmail.com with the subject "Privacy Request" and the email you signed in with, if any. We respond within 30 days.

California residents (CCPA): we do not sell or share personal information for cross-context behavioral advertising. You have the right to know, delete, and not be discriminated against for exercising your rights.

11. Children's privacy

Streamly is not directed at children under 13 (under 16 in the EEA). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact streamlyiptvpro@gmail.com and we will delete it.

12. Security

• Your Firestore area can be read and written only by your own Streamly user ID, enforced by our database security rules.
• All traffic to our service providers uses HTTPS.
• On Android the App's local database is encrypted. On Apple devices it is protected by the operating system's app sandbox and data protection, but not separately encrypted.
• Your IPTV provider credentials are stored on your device and in your private Firestore area as described in section 4. They are not shared with any other service provider, except inside stream addresses you cast or that appear in playback diagnostics.

No system is perfectly secure. If you believe your data may have been compromised, contact us immediately.

13. Unencrypted streams

Many IPTV providers still serve streams over plain HTTP, so the App allows unencrypted connections (App Transport Security exemption on Apple devices, cleartext traffic on Android). This applies only to the playlist and stream addresses you load. Streamly's own traffic (sign-in, backup, analytics, purchases) always uses HTTPS.

14. Changes to this policy

We may update this policy. Material changes will be highlighted in the App and on this page, and the "Last updated" date will change. Continued use of the App after a change constitutes acceptance.

15. Contact

Email: streamlyiptvpro@gmail.com
Developer: Aylana Studio (Yasser Farag)
Apple Developer Team ID: M7GK7B47H6