Privacy & Cookie Notice

Technical verification required before publication. This notice describes the intended processing model. Confirm the deployed website, app, API, hosting, email and payment integrations before relying on it. Replace the clearly marked processor and retention details with the actual configuration.

1. Data controller

VidiYow is operated by an independent individual developer, not an incorporated company. Controller's full legal name: [INSERT FULL LEGAL NAME]. Privacy contact: vidiyow@mail.com. The legally required geographical address and competent supervisory authority must be completed based on the controller's actual establishment and processing circumstances.

2. Information that may be processed

Account and sign-in: email address, account identifier, sign-in-code status and account status to create and secure an account and provide access.
Premium and payment: payment status, transaction/reference identifiers and limited receipt/customer information returned by the payment provider. Payment-card details are handled by the payment provider; VidiYow should not store full card details.
Service operation and capacity: registration date, account status, limited activity indicators and aggregated user counts to protect the service and estimate hosting capacity.
Technical/security data: hosting and security systems may process IP addresses, timestamps, request logs, device/browser information and diagnostic events. Exact fields and retention must be confirmed with the host.
Local media information: playlists, channel/media metadata, favourites and resume positions may be stored in browser or device storage. The intended design is local storage; verify that no such data or provider credentials are transmitted to VidiYow servers. If they are transmitted, this notice must be amended.

3. Purposes and legal bases

Account creation, sign-in and Premium entitlement administration are generally necessary to provide the service requested by the user (GDPR Article 6(1)(b)). Limited security, abuse prevention, service stability and capacity planning may rely on legitimate interests (Article 6(1)(f)), subject to a documented necessity and balancing assessment. Payment providers may process data for payment execution, fraud prevention and their own legal obligations. Accounting data may be retained where required by law.

4. Public stream directories and external links

The website links to the independent public stream directory iptv-org and displays an optional M3U playlist URL that users may copy and add themselves. If you open the directory, retrieve its playlist or play a stream, the relevant third-party directory or stream host may receive technical data such as your IP address, browser/device information, request time and requested URL. Where the VidiYow app loads a playlist or stream directly from an external host, the request is made to that host and its own privacy information applies. VidiYow does not control the third party's processing. Verify the actual web and Android app network behaviour before relying on this description, especially whether any playlist URLs, stream URLs, credentials or playback requests pass through VidiYow infrastructure.

5. Cookies, local storage and analytics

The intended configuration does not use Google Analytics or advertising trackers. The app may use essential browser storage for settings and locally stored media-library information. The payment provider may use cookies or similar technologies within its checkout for security and fraud prevention. This description must be checked against all deployed scripts, SDKs, cookies, local storage and embedded services. Any non-essential cookies or similar technologies must be handled with the consent required by applicable law. Do not claim that no tracking or non-essential storage exists until the technical audit is complete.

6. Recipients and processors

Payment provider: currently described as Stripe. Confirm the actual legal entity, role, data fields and privacy documentation; update this notice if another provider is used.
Hosting/cloud provider: [INSERT ACTUAL PROVIDER LEGAL NAME, COUNTRY/REGION, RELEVANT SUBPROCESSORS AND DPA DETAILS].
Email delivery provider: [INSERT ACTUAL PROVIDER OR STATE THAT SIGN-IN EMAILS ARE SENT DIRECTLY BY YOUR OWN SERVER].
Other recipients: professional advisers or public authorities only where necessary or legally required.

For transfers outside the EEA, identify the destination and document an applicable GDPR Chapter V transfer mechanism and safeguards. The physical server location alone does not identify every processor or determine the controller's legal obligations.

7. Retention

Keep account data only while the account is active and for a defined period afterwards where needed for support, disputes, security or legal obligations. Sign-in codes should expire quickly and should not remain readable longer than necessary. Keep technical logs only for a documented security/operational period. Retain payment and accounting records for the period required by applicable law. Exact periods to publish after checking the live system: [ACCOUNT DATA: …] [SIGN-IN CODES: …] [SECURITY LOGS: …] [CAPACITY METRICS: …] [PAYMENT/ACCOUNTING RECORDS: statutory period].

8. Data minimisation and account choices

Collect only information necessary for account access, Premium entitlement, security and capacity planning. Where feasible, use aggregated or pseudonymised counts for capacity reports. Do not collect playlist contents, channel names, media titles or provider credentials for capacity planning. If the deployed app/API does process any of these, explain that processing accurately here.

9. Your rights and complaints

Depending on the applicable law, you may have rights to access, rectify, erase, restrict or port your data, and to object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it. Contact vidiyow@mail.com. You may also lodge a complaint with the competent data-protection supervisory authority. The authority must be identified once the controller's main establishment and processing circumstances have been confirmed.

10. Security and children

Describe the actual technical and organisational measures used to protect accounts, sign-in codes, server access and backups: [INSERT ACTUAL SECURITY MEASURES]. Do not claim security controls that are not implemented. Review age-related processing and any data relating to children before publication.

11. Changes

Update this notice when the app, payment provider, hosting, email delivery, analytics, data flows or purposes change. Last updated: 3 November 2026. Questions: vidiyow@mail.com.