Privacy policy
Last updated:
This policy describes the data Noz IPTV processes when you use its apps and this website. It is written from how the service actually works. The data controller is the publisher of the service, presented in the legal notice. For any question about your data, write to support@nozplayer.app.
The short version
- Noz IPTV provides no channels and no content. You use your own IPTV subscription.
- Video streams never pass through Noz IPTV servers: your device plays them straight from your provider. The catalogue, the programme guide (EPG), posters and downloads stay on your device.
- An account is only useful to sync your profiles, playlists, favourites and progress between your devices, and to control playback remotely.
- Your playlist configuration (provider address, credentials) is encrypted with AES-256-GCM before it is stored. It is never shown on this website nor sent back to a browser.
- No ads, no third-party trackers, no sale of data. This website uses no advertising or analytics cookie and only sets the session cookie it needs when you are signed in, so it shows no consent banner.
- You can delete your account at any time, in the app or on this website.
Data we process
Your account
- Your e-mail address, your name, whether the address is verified, and the creation and update dates.
- Your sign-in method: password (stored only as a hash, never in clear), Sign in with Apple, Google sign-in, or several. For Apple and Google, we keep the identifier of your account with them and the tokens needed to revoke the authorisation when you delete your account. Apple may give you a private relay e-mail address: that is then the one we receive.
- Your sessions: session token, expiry date, IP address and browser or device type at sign-in. A session expires after 7 days of inactivity.
What is synced with your account
- Viewing profiles: name (at most 50 characters) and avatar.
- Playlists: name, a technical fingerprint that lets the same playlist be recognised from one device to another, and the encrypted configuration. The encryption key is a secret held by Cloudflare, separate from the database; the configuration is only decrypted inside the service, for an authenticated request from your account. The playlist type (Xtream or M3U) is visible in your account area, never the credentials.
- Favourites and tags: the channels, films and series you favourited, per profile, and your favourite tags (names of at most 50 characters, order, assignments).
- History and progress: for each title watched, the position, the duration, the date last watched and, when the app knows it, the TMDB identifier of the title.
- Hidden categories, per playlist.
- When you delete an item, a deletion mark is kept so that your other devices learn about the deletion. For a deleted playlist, the configuration is erased; its name and deletion date remain until the account is deleted.
Playback and remote control
- Playback presence: to respect the number of screens your provider allows, the service keeps a temporary lease per device (device identifier, device name, start time and last activity). It lasts 75 seconds and is renewed during playback.
- Cast: a television registers a receiver (name, tokens stored as hashes). While the room exists, the service keeps the last playback state the receiver sent: title (at most 300 characters), content identifier, playback status (playing, paused, buffering…), position and duration, and audio and subtitle track names. This is information about what you are watching. The stream address and its headers, on the other hand, only pass through, and are neither stored nor logged. A guest receiver has no account and gives no access to any of your data.
- Signing in a TV with a code: a six-digit code, valid for 10 minutes, links the television to your account.
This website
- Contact form: your name, e-mail address, subject and message. They are sent by e-mail to our support mailbox. The contact page loads the Cloudflare Turnstile script, a third party that examines your browser to tell a human from a bot. While you write, your draft is kept in the tab’s
sessionStorage, on your device, until the tab is closed; nothing is sent before you submit. - Audience measurement: Cloudflare Web Analytics, without cookies, to count page visits.
- Technical logs: to detect errors, the service writes to its own logs the event, the request path (without query parameters), a request identifier, the country and the data centre, without putting the IP address, the request body, a token or a playlist configuration in them. Its error logs may nevertheless contain your account identifier and the technical error message. Cloudflare Workers Logs also keeps a record of each call to the service (address without query parameters, status).
- Anti-abuse counters: counters limit the number of sign-in attempts and e-mails sent, keyed by IP address (and path). The check of a TV code is counted per IP address and per account; Cast pairing by a controller is counted per account; creating a guest receiver and opening a Cast connection are counted per IP address.
Why we process this data
- To provide the service you ask for: account, sync, remote playback control (performance of the contract).
- To secure the service and prevent abuse: rate limits, technical logs, e-mail address verification (legitimate interest).
- To answer your messages (legitimate interest) and to meet our legal obligations.
We do no profiling and no automated decision-making, and we do not resell any data.
Who receives data
| Recipient | Role | Data concerned |
|---|---|---|
| Cloudflare | Hosting of the service and the website (Workers, D1 database in the European jurisdiction, Durable Objects), sending the service e-mails (Email Sending), receiving and forwarding support mail (Email Routing), cookie-less audience measurement (Web Analytics), anti-spam check (Turnstile) | All account and sync data, as described above |
| Apple | Sign in with Apple; revoking the authorisation when the account is deleted | Apple identifier, e-mail address (possibly private relay), tokens |
| Google sign-in; revoking the authorisation when the account is deleted | Google identifier, e-mail address, tokens | |
| TMDB | Film and series details and images. Our service queries TMDB with only the title identifier and the language, with no account data. Posters are loaded straight from TMDB’s image servers, which then see the device’s IP address | Title identifier, language, device IP address for images |
| YouTube (Google) | Playing trailers in YouTube’s embedded player, when you open a trailer | Technical device data, under YouTube’s policy |
| Google (Gmail) | Mailbox that receives support@nozplayer.app: receives the messages Cloudflare Email Routing forwards to it | Name, e-mail address, subject and message of your form or e-mails |
| Your IPTV provider | Your device connects to it directly for the catalogue, the guide and the video. Noz IPTV is not an intermediary | Your credentials and your activity, under your contract with it |
The app stores (App Store, Google Play) process the data linked to your download under their own policies.
Some of these providers may process data outside the European Union, notably in the United States. For Cloudflare, these transfers rely on the European Commission’s standard contractual clauses and on the EU-US Data Privacy Framework, under its data processing agreement. For Google (Gmail, Google sign-in), they rely on the Data Privacy Framework, to which Google LLC is certified, and on standard contractual clauses. For Apple (Sign in with Apple), transfers of data collected in the European Economic Area rely on standard contractual clauses.
How long we keep data
“Valid for” is how long an item works; “Kept” says how long the data is actually stored.
| Data | Valid for | Kept |
|---|---|---|
| Account, profiles, playlists, favourites, tags, progress, hidden categories | No time limit | Until you delete them or delete the account. Inactive accounts: after 3 years minus 30 days with no activity, an e-mail warns you (unless the account’s e-mail address was never verified). The account and its data are then permanently deleted about 3 years after the last activity, never less than 30 days after that e-mail, and the deletion follows the same path as a deletion you request. Any later activity, including signing in, cancels the warning. Activity means: signing in, using the apps or the website while signed in, and changing your profiles, playlists, favourites, progress or tags. |
| Sign-in session (with the IP address and browser or device type) | Expires after 7 days of inactivity | An expired session is erased by a daily job, about 30 days after it expires. |
| E-mail verification, password reset and deletion confirmation links | 1 hour | Same: the expired row is erased by the daily job, about 30 days after it expires. |
| TV sign-in code | 10 minutes | Same, and deleted with the account once linked to it. |
| Anti-abuse counters (IP address and path; also the account for TV code checks and Cast pairing) | A few seconds to a minute | The rows, IP address included, are erased by the daily job, about 30 days after they expire. |
| Playback presence lease | 75 seconds, renewed during playback | Expired leases are erased lazily, the next time that account’s playback presence is accessed |
| Cast: guest receiver and its state | 24 hours without activity | Erased by an alarm after those 24 hours |
| Cast: an account’s room, and its last playback state | 180 days without offline activity; the authorisation of another account lasts 30 days | Erased by an alarm, at the latest 180 days after the receiver’s last offline activity. If the account is deleted, the room is emptied and its access revoked at the next action on it, which may not happen before that alarm |
| Database backups (point-in-time restore) | — | 30 days (point-in-time restore window, D1 Time Travel, Cloudflare Workers Paid plan): deleted data remains in backups for up to 30 days |
| Manual database exports made for a maintenance operation | — | Deleted within 30 days |
| Technical logs (the service’s own logs and Cloudflare Workers Logs call records) | — | 7 days (Cloudflare Workers Logs retention, Workers Paid plan). A call record holds details about the request, the response and metadata; Cloudflare’s documentation does not say whether the IP address is among them |
| Messages sent through the contact form | — | 3 years after the last exchange, in the Gmail support mailbox |
Security
Exchanges go over HTTPS. Passwords are stored as a hash and playlist configurations are encrypted with AES-256-GCM, with a key kept in Cloudflare secrets, outside the code and the database. Sign-in attempts and e-mail sends are rate limited. No playlist credential is ever displayed on this website.
Your rights
You can ask for access to your data, its rectification, its erasure, its portability or the restriction of its processing, object to it, and withdraw any consent you gave. You edit your profiles and playlists in the app, and you delete your account in the app or on this website. For anything else, write to support@nozplayer.app from your account’s address: we answer within one month at most.
If you believe your rights are not respected, you can lodge a complaint with the data protection authority of your country (in France, the CNIL).
Children
You must be at least 15 years old to create an account and use Noz IPTV. If you think a child under 15 has created an account, write to us: we will delete it.
Changes
We update this page when the service changes. The date of the last update is at the top of the page. For an important change, we tell you in the app or by e-mail.
Contact
support@nozplayer.app, or the contact form.