Privacy Policy
This privacy policy informs you about the processing of personal data when using the app Smart IPTV Plus and the web portal at ovaar.de. It applies to:
- Smart IPTV Plus (package name:
de.ovaar.smartiptv) — Google Play Store - the web portal at ovaar.de/portal
1. Controller
The controller for data processing within the meaning of the General Data Protection Regulation (GDPR) is:
Tolga Zengin
Ovaar (Kleingewerbe)
Kaiser-Otto-Straße 16
56070 Koblenz
Germany
Email: info@ovaar.de
Full provider identification: see the legal notice.
2. Overview of the processing
Smart IPTV Plus is a client application (“media player”) for playing back IPTV content. The app stores and processes in particular your account data, the IPTV access details you enter, and technical device information in order to enable sign-in, synchronisation and streaming.
Important: Smart IPTV Plus does not provide TV, film or series content itself and does not host it. Streams are retrieved exclusively through third-party sources you configure yourself (Xtream Codes, M3U, Stalker). The data processing carried out by those providers is governed by their own privacy policies.
3. What data we process
3.1 Account and registration
- Email address and password (stored only in encrypted/hashed form)
- Display name or user name, if you provide one during registration
- Supabase session and authentication data (e.g. access tokens)
- Subscription status (e.g. free or premium) and, where applicable, expiry date
- Time of registration and of the last sign-in
Registration is required in order to use account-bound features (synchronisation of sources across several devices, premium status). One account works across mobile devices and Android TV with the same sign-in.
An account is optional — the app can also be used solely with your own IPTV access details, which are then stored on the device only.
3.2 IPTV sources
- Server URL, user name and password of your IPTV source
- Name and type of the source (Xtream Codes, M3U, Stalker)
This data is stored encrypted in our database (Supabase) in order to make it available in the app on all your devices.
3.3 Devices
- Device name, platform (e.g. Android, Android TV) and unique device ID for device management
- Time of the last sign-in
3.4 Usage data within the app
- Favourites (channels, films, series)
- Continue-watching history (playback positions)
- Local app settings (e.g. language, appearance, playback options)
3.5 Usage count (audience measurement)
So that we know how many devices actually use the app, the app reports a counting point to our server at most once every 20 hours. Only the following is transmitted:
- the pseudonymous device ID (the same as under 3.3, not an advertising ID)
- platform (mobile device or television) and app version
- whether an account is currently signed in (yes/no)
- time of the first and the most recent counting point
Not transmitted are content, channel or title names, your IPTV access details or account data. The count is kept separate from your account and cannot be attributed to it. Its sole purpose is audience measurement: without it, users who use the app only with their own IPTV access details and without an account would not be statistically visible at all. The legal basis is our legitimate interest in developing the app in line with actual demand (Art. 6 (1) (f) GDPR).
3.6 Payments (in-app purchases)
Premium features can be unlocked through an in-app purchase. Payment is processed exclusively through Google Play (Play Billing).
Google processes your payment data under its own responsibility. To verify the purchase we receive only a purchase token or receipt identifier and product information in order to unlock your premium subscription. We do not store complete payment data (e.g. credit card numbers).
3.7 Advertising
Advertisements may be displayed in the free version. On mobile devices this may take place through Google AdMob; device identifiers, IP address and usage information may be processed by Google in this context. Further information: Google Privacy.
3.8 Image and title information (posters, cover art, thumbnails)
Images are displayed in part on this website and in the app, such as film and series posters, cover art or thumbnails:
- On the website these images serve solely to illustrate the streaming experience by way of example. They are hosted locally on our server and do not constitute access to content.
- In the app, cover, poster and title information is loaded from the metadata of your own IPTV source configured by you and serves for orientation within the programme guide. It is retrieved from the servers of your respective provider.
Smart IPTV Plus does not provide film, series or TV content itself and does not host it. All trademark, title and image rights remain with their respective owners. The display is purely illustrative or for orientation. If you believe that a displayed image infringes your rights, please contact us at info@ovaar.de; we will remove the content in question without delay.
3.9 Technical log data
- IP address when accessing the website or the API (server-side, briefly)
- Error and access logs for security and stability
4. Purposes and legal bases
- Performance of a contract (Art. 6 (1) (b) GDPR): provision of the account, source synchronisation, streaming features and premium status
- Legitimate interest (Art. 6 (1) (f) GDPR): IT security, abuse prevention, error analysis, stability
- Consent (Art. 6 (1) (a) GDPR): where required, e.g. for optional features or personalised advertising
- Legal obligation (Art. 6 (1) (c) GDPR): retention where required by law
5. Hosting and processors
We use the following services, which may process personal data on our behalf:
- Supabase – authentication, database, backend (project hosted in the EU region Paris).
- Google (Google Play / Google AdMob) – payments and advertising (Play version of the app)
- Hosting provider for ovaar.de and the web portal
Where required, data processing agreements pursuant to Art. 28 GDPR are concluded with processors.
6. Retention period
Personal data is deleted as soon as the purpose ceases to apply and no statutory retention obligations stand in the way. Account data remains until you delete your account. Server logs are usually deleted automatically after a short time.
6.1 Deleting your account
You can delete your account yourself at any time: in the app under “Account” or “Settings” via “Delete account”, or in the web portal at ovaar.de/portal in the settings area. The following is then irreversibly removed:
- Your profile including display name and email address
- Your stored IPTV sources including the access details saved there
- Your registered devices
- Your support enquiries including messages and uploaded images
- Your subscription entry and your assignment to operator messages
- Your sign-in account itself
Exception for the free trial period: if the app is used on a television set, we store a device identifier for that device together with the start time of the free trial period. This entry remains even after the account is deleted. Its purpose is to prevent abuse, since the trial period could otherwise be renewed any number of times by repeatedly deleting and re-creating an account. The legal basis is our legitimate interest under Art. 6 (1) (f) GDPR. The entry contains no user identifier; after account deletion there is no longer any link to you as a person.
Note on paid subscriptions: deleting your account does not cancel an existing premium subscription, because billing runs through Google Play. Please cancel it there beforehand in your subscription settings.
7. Disclosure to third parties
Data is disclosed to processors (see section 5), to Google in the case of in-app purchases or advertising, and to your IPTV providers when retrieving streams. Any other disclosure to third parties takes place only with a legal basis or your consent.
8. Transfers to third countries
When using services based outside the EU (e.g. the USA), data may be transferred to third countries. Appropriate safeguards (e.g. standard contractual clauses) are used in this context, insofar as provided by the respective provider.
9. Your rights
You have the following rights vis-à-vis us, where the statutory requirements are met:
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection (Art. 21 GDPR)
- Withdrawal of consent given (Art. 7 (3) GDPR)
To exercise your rights, please contact the controller at info@ovaar.de. You may also lodge a complaint with a data protection supervisory authority.
10. Security
We use technical and organisational measures (including TLS encryption, access controls, secure password storage) to protect your data against unauthorised access.
11. Children
Our services are not directed at persons under the age of 16. We do not knowingly collect data from children below that age.
12. Changes
We may adapt this privacy policy if our services or legal requirements change. The current version is always available at this URL.
13. Language
This is a translation of the German Datenschutzerklärung, provided for convenience. In the event of any discrepancy, the German version prevails.