Privacy Policy
Oriel IPTV is an Android TV media player. The app provides no content of its own: you add your own IPTV or M3U sources. This policy explains what data the app keeps, where it is kept, and how to ask us to delete it.
1. Data kept on your device
- Sources: M3U links and Xtream account details (server, username, password). They are stored on the device, encrypted with AES-256-GCM under a key held in the Android Keystore.
- Usage data: favourites, watch list, watch progress, settings, audio and subtitle preferences, and hidden channels.
- Parental PIN: only a salted hash is stored, never the PIN itself. It is never sent off the device.
- Image cache: channel and title artwork is cached on the device so screens load faster.
2. Google sign-in
Signing in is optional. If you sign in with Google, Firebase Authentication processes your name, email address, profile picture link and account identifier (uid).
If you sign in on the TV with a QR code, the sign-in page on your phone or computer passes your Google ID token to the TV through orieliptv.download. The token is kept for at most five minutes and deleted as soon as the TV takes it. It carries your account identity only. It holds no password and no source details.
3. Cloud sync
If you sign in and set a sync password, watch progress, favourites, lists, settings and source details are sent to Google Cloud Firestore. This data is encrypted on your device with a key derived from your sync password, so the server cannot read its content. Data is stored under your account identifier.
4. Analytics
The app uses Google Analytics for Firebase (Firebase Analytics). It collects general usage events such as sessions, app opens and app updates, together with device model, operating system and app version, approximate location at country level, and an app instance identifier. This data does not include source addresses, passwords, your PIN, watched content or personal identifiers, and it is not used for advertising. For details see the Google Privacy Policy.
5. Third parties and network connections
- The app connects directly to the source servers you add. Their privacy policies apply to them.
- Google Firebase (authentication, sync and analytics) and the Google account picker are used.
- Voice search uses the Android speech recognition service. Audio is passed to that system service and is governed by its policy.
- No advertising or crash-reporting SDKs are used.
6. Deleting your data
- On the device: remove your sources and sign out in the app, or uninstall the app. App data is then removed from the device.
- Cloud and analytics data: full account deletion inside the app is not available yet. To ask us to delete your cloud data or analytics data, email berkbayri@gmail.com from the address on your Google account. We will act within 30 days.
7. Children
The app includes a parental lock for adult content. It is not designed to collect information from children under 13, and we do not knowingly collect such data.
8. Changes
If this policy changes, the new version is published on this page with a new date.