Last updated: May 2026 · Summary for a self-hosted-style IPTV client — have counsel review if you market worldwide or handle EU personal data at scale.
The operator of this Streamly deployment (the person or company running the website you are using) is the controller of personal data described here. Streamly is built so each deployment can have its own operator; this policy describes typical processing.
To play your content, Streamly processes IPTV server URLs, usernames, and passwords that you enter. Those values may be stored in an encrypted HttpOnly cookie (guest mode) or encrypted at rest when you attach providers to aStreamly account. We use them only to talk to your panel and proxy streams — not to sell profiles or advertising segments.
No sale of personal information. We do not sell your personal information as that term is commonly defined in consumer privacy laws (including California “sale” concepts). We do not use your IPTV credentials to build advertising profiles.
We collect and process personal data only for reasonable business purposes: providing Streamly, securing the service, complying with law, and improving reliability (for example error telemetry if the operator enables it). We do not collect sensitive categories (health, biometrics, etc.) through Streamly by design.
The operator sets how long logs and backups are kept. Account and encrypted provider data remain until you delete your Streamly account or we delete it for inactivity, security, or legal reasons as described in our Terms of Service. We do not promise indefinite retention of server logs; retention may be shortened without notice where the law allows.
We use industry-typical safeguards (encryption for credentials at rest and in transit where applicable, access controls on servers, and secure development practices). No method of transmission or storage is 100% secure. If we become aware of an incident that affects your personal data and the law requires notice, we will follow applicable breach-notification rules for this deployment.
We may preserve or disclose information when we reasonably believe it is required by law, regulation, legal process, or governmental request; to enforce our terms or investigate abuse; or to protect the rights, property, or safety of users, the public, or us. Where permitted, we may notify you before disclosure unless law or a court order prohibits it.
If you connect from outside the EU, your information may still be stored on servers in the European Economic Area (this deployment uses EU infrastructure). Depending on where you live, you may have rights to information about safeguards (such as standard contractual clauses or adequacy decisions). Ask the operator for details if you need them for compliance.
If you are in Canada, you may have rights under applicable federal or provincial privacy law (for example access, correction, and complaint pathways). If you are in the European Economic Area or the UK, you may have GDPR-style rights (access, erasure, restriction, portability, objection, and complaint to a supervisory authority) where they apply to our processing. If you are in California or other U.S. states with privacy laws, you may have additional disclosures or opt-outs depending on how the operator does business there.
Favorites, recents, UI preferences (such as category selections), and parental-control settings are stored in your browser (localStorage) on your device. Clearing site data removes them. If you sign in with a Streamly account, your favorites for each IPTV login are also saved on this server so they can sync across devices.
Video segments pass through this app's proxy when needed for CORS or mixed content. Hosts may keep minimal server logs (IP, errors, timing) for operations and abuse prevention — configure retention on your deployment.
Your IPTV provider and any CDNs they use receive requests directly or via this proxy. Optional error reporting (e.g. Sentry), if enabled by the host, may send stack traces — configure DSN and sampling in deployment env vars. If you use Cloudflare Turnstile, Cloudflare receives data needed to run the challenge.
Essential cookies or storage may be required for login and playback. If the operator enables NEXT_PUBLIC_SHOW_COOKIE_CONSENT, a banner may record your analytics vs essential choice in localStorage. When that banner is on, Google Analytics is only loaded if you choose analytics (e.g. "Accept all").
If you create a Streamly account, you may optionally opt in to occasional emails about product features, tips, and launch news. We store that preference in our database and, when you opt in, may sync your contact to our email provider (Resend) for broadcasts. You can unsubscribe from any product-update message or change your preference in Settings. Transactional messages (email verification, password reset) are separate and may still be sent when needed for your account.
Sign out to clear the IPTV session cookie. Delete your Streamly account from Settings to remove encrypted provider rows from our database. For privacy requests, use the operator's published contact (they may set NEXT_PUBLIC_LEGAL_CONTACT_EMAIL).
Disclaimers, limitations of liability, indemnity, and dispute-related provisions that protect the operator are in our Terms of Service. This policy focuses on privacy practices, not liability caps.
This policy is provided as a summary. Interpretation may be governed by Canadian law where the terms of service say so, without prejudice to mandatory rights in your own country.