Privacy Policy

Who is responsible

Xplayer is made and sold by Mohamed Azzam, based in Georgia (the country). He is responsible for the personal data described on this page. Ask any question about privacy at [email protected] or through our contact form.

What stays on your TV

The app saves these in its own storage on the TV. They are not sent to us. Uninstalling the app deletes them.

• The servers you add: their names and addresses, your user name on each, and the sign-in token each server gives the app. Passwords you type for Jellyfin or Emby go to that server once and are not saved.
• Your settings, such as subtitle style, colour-button choices and Home rows.
• An install identifier the app makes at random the first time it runs.
• On LG and Samsung store versions: your TV code and, once paid, your Plus licence, so Plus keeps working offline.
• The Diagnostics screen's log. It is kept in memory only, with sign-in tokens removed, and is never sent anywhere.

What leaves your TV, and where it goes

Your own media servers

Xplayer connects straight to the Plex, Jellyfin and Emby servers you add. It sends what a TV app needs to sign in, browse and play: your sign-in for that server, requests for libraries, artwork and video, and your playback position, so the server can resume where you stopped and mark what you have watched. With each request it sends the app's name and version, your TV's model, a device name such as "LG webOS TV", and a device identifier made from the app's random install identifier. These servers belong to you or to whoever shared them with you. We have no access to them.

When you ask the app to find Jellyfin or Emby servers, it asks each address on your home network (the same range as the TV's own address) whether a server answers on port 8096. That search stays inside your home network.

Plex

To sign in to Plex, the TV shows a code and you approve it on Plex's own site, plex.tv/link. The app then contacts Plex (plex.tv) to finish signing in, read your Plex user name, list your servers, find a server again if its address changes, and keep the sign-in fresh. These requests carry the app's name and version, your TV's model and platform, and the app's random install identifier. If Plex can reach your server only through its relay, the video passes through Plex's relay servers. Plex handles this under Plex's privacy policy.

Online subtitle search

When you search for subtitles online, the TV asks your Plex server. Your Plex server looks them up with its subtitle provider (such as OpenSubtitles) and saves the one you pick to that title. The TV never contacts the subtitle provider itself.

Xplayer Plus on LG and Samsung TVs: our license server

The TV code is six letters and digits, shown as for example K7Q2-9F. The TV makes it from a one-way hash of its device ID, so the code cannot be turned back into the device ID. If the TV cannot read its device ID, the code is made from the app's random install identifier instead.

The TV asks first: the first time you open Get Plus, it explains how the code is made and reads the device ID only after you press OK. Until then the app reads no device ID at all.

To check whether Plus has been paid, the TV sends only that code to our license server (every 5 seconds while the Get Plus screen is open). Once the code is paid, the server answers with a signed licence that the TV checks and saves. The QR code on the Get Plus screen opens a page on the same server on your phone, with the code in the address.

The license server runs on Cloudflare. Like any web server, it sees the IP address of each request, and limits how often one address can ask, to stop people from guessing codes. Our server does not store IP addresses; Cloudflare processes them to deliver the service under Cloudflare's privacy policy.

Buying Plus with Creem (LG and Samsung)

When you tap Buy on your phone, you go to a checkout run by Creem (Armitage Labs OÜ, Estonia). Creem sells Plus to you as merchant of record: it takes your payment details, email address and billing country to charge you and handle tax, under Creem's privacy notice. We never see your card details.

When the payment goes through, Creem tells our license server. The server then keeps one record per paid TV code:

• the TV code and that it is paid;
• your email address and the Creem order number;
• Creem's event ID and the time of payment.

We keep this so support can find your purchase, restore Plus, move it to a new TV and handle refunds. A code unlocked by support, or for a store's app reviewer, is saved with a short note saying so and nothing about the person.

Buying Plus on Google Play or the Amazon Appstore

On Android TV, Google TV and Fire TV, Plus is bought through Google Play or the Amazon Appstore. The store handles the payment and your account under its own privacy policy, and tells the app whether Plus is owned on your account. These versions do not use our license server or a TV code.

This website

• No cookies, no analytics and no ads. The fonts and images are served from this site.
• Your theme and language choices are saved in your browser's local storage. They are never sent anywhere.
• The contact form sends what you type (your name, email or phone number, topic, TV and message), plus the page language and address, to FormSubmit, which emails it to us. We use it only to answer you.
• The company that hosts these pages keeps standard access logs (IP address, page, browser and time) to deliver and protect the site.
• Links to app stores, Plex, Creem or Wikimedia take you to their sites, with their own privacy policies.

What we never do

We do not sell personal data, share it for advertising, build profiles or track you across apps or websites. Xplayer contains no analytics, advertising or crash-reporting code.

Why we may use it

Where data protection law such as the GDPR applies, these are our legal grounds:

• Delivering Plus and supporting your purchase (license record, support emails): to perform our contract with you.
• Limiting requests to the license server and keeping access logs: our legitimate interest in keeping the service working and safe.
• Answering messages you send: our legitimate interest in replying to you, at your request.
• Keeping order records for as long as tax and accounting law requires: a legal obligation.

How long we keep it

• License records: for as long as the Plus licence exists, so Plus can come back after a reinstall. If you ask, we delete your email address and keep only the TV code and that it is paid, so your TV keeps Plus.
• Emails and contact messages: as long as needed to help you, and deleted when you ask, unless the law requires us to keep them.

Your rights

You can ask us for a copy of the data we hold about you, and ask us to correct it, delete it, limit how we use it, or object to its use. Write to [email protected] or use our contact form, with the email address you paid with or your TV code so we can find your record. We answer within 30 days.

You can also complain to a data protection authority: in Georgia, the Personal Data Protection Service; in the EU, the authority in your country.

Where the data is processed

Plex, Google, Cloudflare, Creem, FormSubmit and the web host may process data in countries other than yours, including the United States and the European Union. Each does so under its own safeguards and privacy policy.

Children

Xplayer is not aimed at children, has no accounts or profiles, and we do not knowingly collect children's data. Plus is meant to be bought by an adult.

Changes to this policy

If what the app or the website sends changes, we update this page and the date at the top before the change ships.