Privacy policy

Effective 9 October 2026

Who we are

XYZ Player (xyz-player.com) is a media player app for Android TV, Google TV and Android phones. XYZ Player does not sell, provide or include any TV channels, films or other content. Users add their own playlists, and streams are played directly from the addresses in those playlists.

What data we process

• Account: your e-mail address and a hashed password, or your Google account's e-mail when you sign in with Google. Used to sign you in and to send messages about your account.
• Profiles and settings: profile names, favourites, colour theme, language, sports teams and leagues, and the changes you make to your lists in the web editor (hidden, renamed or reordered categories and channels, channel numbers, PIN-locked categories; PINs are stored only as a hash). Kept so they follow you to every device you sign in to.
• Playlists: the server address, username and password or the M3U link you add. They are stored on the device and, encrypted, on our server so your playlists are available on your other devices. We use them only to make them available to you.
• List overview: the names of your playlist's categories and channels, so the web editor can show them. Not the streams themselves.
• Device data: a random installation identifier, device model, app version and type (TV or phone), the country derived from the IP address and the time of last use. Used to run the app, prevent abuse and for statistics.
• Location for weather: the city you choose, or the country from the IP address, for the weather and local times. We do not use GPS.
• Crash and problem reports: after a crash the app sends a technical description of the error on the next start; reports you send from the app's settings include what you write and, if you choose, a screenshot.
• Contact form: your name, e-mail, topic and message, and the IP address to protect against spam.

The channels, programme guide, films and series you watch are loaded directly from the addresses in your playlist and stay on your device. We do not record what you watch.

Ads

The app may show Google AdMob ads. Google may use the device's advertising ID and usage data under its own policy (policies.google.com/privacy). Users in the EU and UK are asked for consent first.

Third-party services

• Cloudflare – protection and delivery of the website and API.
• Google – Google sign-in, Chromecast, AdMob and Google Play.
• TheSportsDB – fixtures and scores in the sports guide (fetched by our server, without your data).
• TMDB – descriptions, posters and cast of films and series.
• Radio Browser – the list of radio stations.
• MET Norway – weather forecasts (fetched by our server for a city, without your data).

How long we keep data

Account, profile, playlist and settings data are kept while you have an account. When you delete your account in the app, they are deleted from our server. Device data is kept while the app is in use. Messages sent through the contact form are kept as long as needed to reply, at most 2 years. Crash reports are deleted once the problem is fixed.

Your rights

You have the right to access, correct and delete your data, to restrict processing and to object, and to complain to a supervisory authority. You can delete your account in the app's settings; for anything else, write to us through the contact form.

Deleting your account

You can delete your XYZ Player account and all its data (profiles, playlists, favourites, settings and linked devices) at any time, in either of these ways:

• In the app: on the phone More → Profile → Delete account; on the TV Settings → Profile → Delete account.
• On the web: sign in at panel.xyz-player.com/account/me and choose “Delete account”.

Deletion is immediate and cannot be undone. Data is removed from our server at once; backups that may still contain it are overwritten within 30 days. If you can no longer sign in, write to us through the contact form from the account's e-mail address and we will delete it for you.

Children

The app is not intended for children under 13 and does not knowingly collect their data. Kids profiles are made by an adult account holder.

Changes

We may update this policy; the new version is published on this page with its date.