Privacy Policy

Last updated: November 12, 2026

This policy explains what information Legacy Player ("Legacy Player", "we", "us") collects when you use the Legacy Player applications and the website at legacyplayer.site, why we collect it, and what you can do about it. It forms part of our Terms & Conditions.

In short: we collect only what the player needs to work and to be activated. We do not have user accounts with names, we show no ads, we use no tracking or analytics tools, and we never sell your information.

Information we collect

From the app, about your device

• MAC address, device key and VIP code. When the app starts for the first time, our server gives your device a MAC address (a random identifier in MAC format, not your device's hardware address), a device key, and a VIP code that resellers use for activation. They identify and protect your device account. The device key is stored encrypted, so that the app can show it to you.
• Device information: the platform (for example LG webOS, Samsung Tizen, Android, iOS, macOS), the device model, and the app version.
• Technical connection data: the IP address of your last connection and the time the app last checked in. We use them to keep the service secure and working, for example to limit abuse.
• Licence status: the trial and activation dates of your device, and, if you bought from a reseller, which reseller activated it.
• A secret app token, stored on our server only as a one-way hash.

From the website, when you manage your playlists

• Your playlists: the name you give a playlist and either its address (M3U) or the server, user name, and password of an Xtream-compatible account. They are stored encrypted and are sent only to your device, so that the app can play them.
• A PIN set by your reseller, if any, stored only as a one-way hash.

Stored only on your device

• Your favourites, viewing history, resume positions, profiles, appearance settings, and your Parental PIN (as a one-way hash) stay on your device and are not sent to us.
• On the website, your browser remembers your language and that you accepted our legal terms (in its local storage). We do not use advertising or tracking cookies.

Resellers and administrators

Accounts in the reseller panel hold an email address, a hashed password, optional two-step verification, credits and orders, and a security log of sign-ins and actions (with IP address and browser). This applies only to resellers and administrators, not to viewers.

Why we use it

• To run the player: to identify your device, deliver your playlists to it, and show messages about your activation.
• To manage trials and activations, including activations made by resellers, and to move an activation to a new device when you ask.
• To keep the service secure: to prevent abuse, investigate problems, and respond to copyright complaints as described in our Terms.
• To meet legal obligations.

Where the GDPR applies, we rely on the performance of our contract with you (providing the player you use) and on our legitimate interest in keeping the service secure.

Who we share it with

• Hosting and delivery: our server is hosted in Germany (EU), and the website and service run through Cloudflare, which protects and delivers it.
• Your reseller, if a reseller activated your device: the reseller sees your device's VIP code, device ID, model, activation dates, and the playlists of the devices they manage, so that they can support you.
• Authorities, when the law requires it.

We do not sell or rent your information, and we do not share it for advertising.

Third-party services the app talks to

Some features connect your device directly to other services, which then see your device's IP address: the playlist servers you add yourself; the open radio directory radio-browser.info (Radio); the sports data provider (Sport); and YouTube, when you open a trailer. These services have their own privacy policies.

How long we keep it

• Device and playlist data: as long as the device account exists. You can ask us to delete it at any time.
• Connection data (last IP address and last check-in) is replaced at each connection.
• Reseller and administrator security logs: as long as they are needed for security and accounting, and for a maximum of 2 years.

Your rights

You can ask us for a copy of the information we hold about your device, ask us to correct it, or ask us to delete your device account and its playlists. Where the GDPR applies, you also have the right to object to or restrict some processing, to data portability, and to complain to your local data protection authority. Write to viptread@gmail.com and include your MAC address, so that we can find your device. You can delete your playlists yourself at any time on legacyplayer.site.

Security

Playlists and device keys are stored encrypted; app tokens and PINs are stored only as one-way hashes; all connections to legacyplayer.site are encrypted (HTTPS). No system is perfectly secure, but we take reasonable measures to protect your information.

Children

Legacy Player is not directed at children under 16, and we do not knowingly collect information from them. The app includes parental controls, so that adults can protect children who use a shared device.

Changes to this policy

We may update this policy. The date at the top shows when it last changed. If the changes are significant, we will announce them on legacyplayer.site or in the app.

Contact us

For any questions about this policy or your information, contact Legacy Player at viptread@gmail.com.