Privacy Policy

1. Scope and who we are

This policy describes how Wavento ("we", "us") handles information in connection with the Zaptik: IPTV Player Android application ("Zaptik", or the "app"). It covers the app only. It does not cover the websites, panels, or streaming providers you choose to connect the app to, each of which has its own policy and its own operator.

Zaptik is a player. It does not host, supply, index, recommend, or link to any channel, playlist, film, or other media. Nothing is preloaded. You bring a source you already have the right to use — an M3U address, an M3U file on your device, or an Xtream account — and the app parses it, organises it, and plays it.

2. No account, no sign-in

The app has no registration, no login, and no user profile with us. We do not ask for your name, your email address, or your phone number, and there is no screen in the app that would let you give them to us. Because there is no account, there is also nothing on our side that identifies you as a person.

Any username and password you enter belongs to your own IPTV provider — see section 7.

3. What stays on your device

The following is written to your device's private app storage, which other apps cannot read. None of it is transmitted to Wavento:

Sources you add

M3U addresses, M3U files you import, and Xtream panel addresses, usernames, and passwords.

The catalogue parsed from those sources

Channel, film, and series names, categories, logo addresses, and stream addresses, together with programme guide (EPG) data when your source provides it.

Your personalisation

Favourites, recently viewed items, and the position you stopped at in a film or episode, so you can resume it.

Your settings

Preferences such as sort order, video scaling, the selected source, and whether you have accepted the in-app content disclaimer.

A media cache

Up to roughly 1 GB of recently streamed video and image data, kept so playback resumes quickly and re-buffers less. It is discarded oldest-first once it reaches that size.

Credentials are stored so that the app can reconnect to your provider without asking you to type them again on every launch. They are held in the app's private storage and are transmitted only to the provider address you entered yourself.

4. What leaves your device

Exactly two kinds of network traffic leave the app, and they go to two different places:

• Requests to your own source. To list and play your channels, the app contacts the address you supplied. That provider necessarily sees your IP address, your credentials if the source is an Xtream account, and what you request from them. This traffic goes to them, not to us, and we never see it.
• Google Analytics for Firebase, and Firebase Crashlytics. The app includes Google's analytics library and its crash reporting library. They send usage, device and crash information to Google, where we can see it in aggregate. Both are described in section 5.
• Advertising, where it is shown. The app may display advertising supplied by third-party networks, and may offer optional in-app purchases. Section 6 says what that involves.

To be explicit about what the app does not do, because these are the things people reasonably worry about in a player of this kind:

• It does not send your playlists, channel lists, or the addresses of what you watch to Wavento.
• It does not send your Xtream username or password to Wavento or to any party other than the provider you entered them for.
• It does not sell or share personal information for advertising purposes.

5. Analytics and crash reports

Zaptik includes Google Analytics for Firebase, provided by Google. It is active in the version published on Google Play, and it starts with the app. We use it to understand how many people use the app, which features they reach, and on what devices and Android versions, so that we can decide what to fix and what to build next.

The library collects a standard set of information automatically. It includes:

• a randomly generated app instance identifier, which identifies an installation rather than a person;
• device and software information — device model, operating system version, screen characteristics, and app version;
• an approximate region or country, derived by Google from the IP address of the request;
• usage events such as first open, session start, screens opened, and app updates, with the times they occurred.

Crash reports

The app also includes Firebase Crashlytics. When the app stops unexpectedly it sends Google a report of what went wrong: the stack trace, the device model and Android version, the app version, and the state of the app at the moment it failed. It is what tells us a fault exists at all, and where.

Crash reporting is off in the builds we use for development and testing, so our own crashes never mix with yours.

Google processes this data as our service provider and under its own terms. You can read how Google handles data at policies.google.com/privacy, and about Firebase specifically at firebase.google.com/support/privacy.

6. Advertising and purchases

The app may display advertising supplied by third-party advertising networks, and may offer optional in-app purchases. Where advertising is shown, the network may receive your advertising ID, your IP address and the general location derived from it, device and app information, and a record of the advertisements you were shown and interacted with. The network acts on its own behalf for those purposes, under its own privacy policy.

You can reset or delete your advertising ID, and limit ad personalisation, in your device settings under Google · Ads. Any in-app purchase is processed by Google Play; we never see your payment details.

We do not use analytics or crash information for advertising or profiling, and we do not sell personal information.

7. Your provider and other third parties

The single most important thing to understand about this app is that the content comes from somebody else. When you add a source, you are asking the app to talk to a server we have no relationship with, no control over, and no visibility into.

That operator decides what it logs, how long it keeps it, and who it shares it with. Your agreement about privacy for that traffic is with them. Before entering credentials, satisfy yourself that you trust the operator and that you are entitled to use the service.

Aside from Google and the advertising networks described in section 6, we do not integrate attribution SDKs, social login providers, or data brokers.

8. Permissions and why

Internet access

Required to reach the source you added and to stream from it.

Foreground service (media playback)

Lets playback continue, with a media notification, when you leave the app or switch off the screen. It is used only while something is playing.

Notifications

Used for the playback notification with its transport controls. Declining it does not stop the app from working; you simply lose those controls outside the app.

The app does not request access to your contacts, your camera, your microphone, your precise location, or your photo library.

9. Retention and deletion

Data described in section 3 stays on your device until you remove it. You can delete a source from within the app, which removes it and the catalogue and favourites belonging to it. Clearing the app's storage in Android Settings, or uninstalling the app, removes all of it at once, including the media cache.

Analytics data is retained by Google under the retention period configured for our Firebase project and Google's own policies. Because there is no account and the app instance identifier is not linked to your identity, we are unable to locate the records belonging to a particular person. Resetting or deleting that identifier is described in section 9.

If Android's automatic backup is enabled on your device, Android may include the app's data in the backup associated with your Google account. That backup is governed by Google's terms and is not something we can read.

10. Your choices and rights

• Stop analytics collection. Uninstalling the app stops all collection. Clearing the app's storage resets the app instance identifier, which breaks the link to the data collected before it.
• Device-level controls. Android's "Delete advertising ID" and the ads personalisation controls in your Google account also apply to how Google may use this data.
• Access, correction, deletion, portability, objection. Depending on where you live — for example under the GDPR in the EEA and the UK, or the CCPA/CPRA in California — you may have these rights over personal information. Because the app holds your content data only on your device, you already have direct and complete control over it. For analytics data, write to us at the address in section 14 and we will do what we can, subject to the identification limit described in section 9.
• Complaint. You may lodge a complaint with your local data protection authority.

Where the GDPR applies, our legal basis for analytics is our legitimate interest in understanding and improving the app; our legal basis for storing your sources and settings on your device is performing the service you asked for. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

11. Children's privacy

Zaptik is a general-audience utility and is not directed to children. We do not knowingly collect personal information from children. The app applies no content rating or filtering of its own, because it has no knowledge of what a given source contains — supervision of what a child can reach through a source is the responsibility of the adult who added it.

12. International processing

Google operates globally, so analytics data may be processed in countries other than yours, including the United States. Where required, such transfers rely on the safeguards Google puts in place, including the European Commission's standard contractual clauses.

13. Changes to this policy

If we change what the app collects, we will update this page and change the date at the top before the change reaches the version on Google Play, and we will update the Data safety section of our Play listing to match. Material changes will be signalled in the app or in the release notes.

14. Contact us

Questions about this policy, or a request about your data, can be sent to [email protected]. Please say that your message is about Zaptik, and allow up to 30 days for a substantive reply.