WhiteIPTV Privacy Policy
This policy describes what data the WhiteIPTV app («the app», for Android and iOS) processes, why, and what you can do about it. The app is developed by underdog co («we»). Contact: white-iptv-player@proton.me.
WhiteIPTV is a media player. It does not show ads, does not require an account, and does not sell personal data.
1. Data stored on your device
Your playlists and their links, the channels and TV guide data loaded from them, favorites, watch history and settings are stored on your device. The app loads playlists, TV guides and streams directly from the addresses you add; we do not receive these addresses or what you watch, except the limited playback error details described in section 2. On Android, this app data can be included in your device's Google backup (if you use it) and restored on a new device; on iOS it can be included in your iCloud or computer backup. Uninstalling the app deletes it from the device. Streams, TV guides and channel logos are loaded from the servers in the playlist, which see your IP address like any website.
Login and password from your provider
If you connect a playlist with the server address, login and password from your provider, the app builds the
playlist link from them and stores it on your device, in the app's database, like any other playlist link. The app
sends the login and password to the server address you entered, to load your playlist and TV guide. They are
usually also part of the stream addresses in your provider's playlist, and may be part of a TV guide address it
names, so they go to whichever servers your provider chose for those. When you choose to, the stream address also goes to your Cast or
AirPlay device, and «copy link» puts the playlist or stream link on your clipboard. We never receive the login or password. If the server, stream or TV guide addresses use
http:// rather than https://, those connections are not encrypted. Because the login and password are part of the stored link,
they can be included in the device backups described above (Android backup and device transfer, iCloud or computer backup on iOS). Your device's
password manager may offer to save them; that is handled by your device, not by us. Deleting the playlist removes
them from the app; a backup made earlier keeps its copy until that backup is replaced or deleted.
Pasted messages
If you paste a message from your provider, the app looks for a playlist link or connection details in it on your device only. The message is not stored and is not sent to us or anyone else; only the details you then confirm are saved, as a playlist. Your keyboard app processes what you type or paste under its own terms.
2. App statistics and crash reports (Google Firebase)
We use Google Firebase services provided by Google LLC:
- Firebase Analytics: pseudonymous usage events (for example: screen opened, which way of adding a playlist you chose, whether a pasted message contained a link or login details, playlist import finished, 30 seconds of first playback, in-app review requested, playback error type and whether it came from the stream source, the connection or the device, and on Android whether a link from our ad could be opened after installation) with a random app-instance identifier, on Android also your device's advertising ID, and basic device information (device model, operating system and app version, language, approximate location derived from the IP address). Playlist, stream and TV guide addresses, logins and passwords, pasted messages and the names of your playlists are never sent; the events about adding a playlist carry only fixed categories, such as which kind of form you used, and technical values such as the import duration or the error type. For playlists you add yourself, a playback error report contains only the error and technical flags, never channel names.
- Firebase Crashlytics: crash and error reports (stack trace, device and app information, recent app events as context) to find and fix bugs; kept for 90 days. On Android, before a crash report is sent, the app tries to remove login data, passwords and the path and parameters of links that it recognises in the crash message; a server name can remain.
- Firebase Remote Config: downloads app settings using a random installation identifier.
- Firebase Hosting: some app resources are downloaded from Google's servers, which keep standard access logs (IP address, user agent).
Google processes this data under its own terms and privacy policy (policies.google.com/privacy) and may process it outside your country. Analytics data is kept according to the retention setting of our Analytics property (between 2 and 14 months).
When the app asks you to rate it, it uses the rating dialog of Google Play (Android) or the App Store (iOS). We do not attach playlist, viewing or provider data to it; your rating or review is handled by Google or Apple under their terms.
3. Advertising measurement (Meta, Android only)
On Android the app includes the Meta SDK (Meta Platforms, Inc. and Meta Platforms Ireland Ltd.) to measure our own ad campaigns on Instagram and Facebook. «Ad measurement (Meta)» in Settings is on by default; while it is on, the app sends to Meta: your device's advertising ID and an anonymous installation identifier; install attribution data (which ad led to the installation); the event names app installed, app opened, first playlist imported, first channel opened and onboarding suggestion tapped, without any details; technical device information (model, OS and app version, language, time zone, screen size, carrier); and your IP address, from which Meta may derive an approximate location. Playlists, links, channel names and what you watch are never sent to Meta, and we do not link the data to a Facebook or Instagram account. If the Facebook app is installed on the device, the Meta SDK can also read Facebook's attribution identifier from it, for install attribution. Meta processes the data also under its own policy (facebook.com/privacy/policy).
To opt out: turn off «Ad measurement (Meta)» in Settings (no further events are sent and queued events on your device are deleted), reset or delete your advertising ID in your device settings, or use «Your activity off Meta technologies» in your Meta account.
4. Legal basis
We process the data above on the basis of our legitimate interest in keeping the app working, fixing errors and measuring our advertising (for example LGPD art. 7, IX in Brazil; GDPR art. 6(1)(f) in the EU), with the right to object described in this policy, and on your consent where the law requires it.
5. Your rights
Depending on where you live you can request access, correction, deletion, portability or information about the data, object to its processing or withdraw consent (for example under the GDPR, LGPD art. 18 in Brazil, ARCO rights in Mexico, Law 1581 of 2012 in Colombia), and complain to your data protection authority. The data described above is pseudonymous (identifiers, not your name or email) and is held by Google and Meta as described; write to us at white-iptv-player@proton.me and we will help you, including with requests to Google or Meta about data they process.
6. Children
The app is not directed to children under 13 and we do not knowingly collect their data.
7. Changes
We will update this page when the app's data processing changes; the effective date above shows the latest version.