Draft, not yet reviewed. This text has not been reviewed by a lawyer and is not in force yet.
Privacy policy: Rivas TV
DRAFT for review by a lawyer. Not in force. Version 0.1, 2026-11-10. Placeholders in
⟦ ⟧are listed inlegal/README.md. Statements marked [verify] describe features that are planned but not built yet; check each against the shipped code before publishing.
Effective date: ⟦EFFECTIVE_DATE⟧
1. Short version
- Rivas TV is a player. It contains no channels or films, and we do not see what you watch.
- Free: no account. Your sources, favorites, history and settings stay on your TV.
- Pro: you create an account. We keep your email, your devices and your purchase, and, only if you switch on cloud sync, an encrypted copy of your favorites, progress, profiles and settings.
- We never sell data, show ads, use advertising IDs or track you across apps.
- You can delete your account and everything we hold in the app, on the web or by email. It is gone within 24 hours, and from backups within 30 days.
2. Who is responsible
The controller for the personal data described here is:
⟦PUBLISHER⟧
Contact for privacy questions and requests: privacy@rivastv.com. We have not appointed a data protection officer, because we are not required to; the address above reaches the person responsible.
3. What the app keeps on your TV only
The following stays on your device and is never sent to us, in Free and in Pro (unless you turn on cloud sync, section 5.3):
| Data | Why |
|---|---|
| Your sources: playlist and guide addresses, server addresses, user names and passwords | To play what you added. Stored encrypted on the device |
| The channel lists, films, series and guide your sources provide | To browse them |
| Favorites, watch history, resume points, profiles, PINs, settings | The app's features |
| Local backups you make | So you can restore them |
When you play something, your TV connects directly to the source you added. We are not in that connection and do not see it. Your source's operator sees your IP address and what you play, under their own privacy policy.
4. What every user sends us
4.1 Crash reports [verify against P2-07]
If the app crashes or hits a serious error, it sends a report to Sentry, our crash-reporting service: the error and the code path, app version, device model, Android version, available memory, and a random installation ID created by the app (not your Android ID or advertising ID). Reports are scrubbed before they leave the TV: no stream, playlist or server addresses, no user names, no titles. Sentry is set not to store IP addresses. You can turn crash reports off in Settings › Privacy. Legal basis: our legitimate interest in a working app (GDPR article 6(1)(f)).
4.2 App updates and store data
The store you installed from (Google Play, Amazon Appstore, Apple App Store) handles download, updates and reviews under its own privacy policy. We receive aggregated statistics from the store (installs, crashes, ratings by country and device), not your identity.
4.3 Feature flags [verify against P2-07]
The app asks our server, a few times a day, for settings that switch features on or off per device model (for example a fix for one TV's video decoder). The request contains the app version, device model and Android version. We do not store these requests beyond the server logs (section 7).
4.4 Product events [verify against P2-07]
docs/01 plans "minimal first-party events". If they ship, this section must list them. The rule they must follow: counts without an account or installation ID attached (for example "the guide was opened"), never titles, channel names or sources, and a switch in Settings › Privacy. Until they ship, the app sends none.
5. What Pro users send us
5.1 Account
| Data | Why | Legal basis |
|---|---|---|
| Email address, or the ID Google or Apple gives us if you sign in with them | To sign you in and to send account emails (sign-in links, receipts, important changes). No newsletters unless you ask for them | Contract (6(1)(b)) |
| Devices: a name you can change ("Living room Sony"), model, app version, installation ID, last sign-in time | To show your devices, enforce the 5-device limit and let you sign a device out | Contract |
| Purchase: plan, store, purchase token, start and end dates, refunds | To unlock Pro on every device and to handle refunds | Contract; bookkeeping law for records of sales (6(1)(c)) |
| Usage counters per account (for example subtitle downloads this month) | Fair-use limits of the plan | Contract |
5.2 Details, posters and subtitles
When you open a title that is missing details, your TV asks our server for them. The request contains the cleaned title name, the year and the kind (film or series). The shared catalogue stores films, not people: no table links an account to a title, and our logs do not record who asked for what. We fetch missing details from Trakt, fanart.tv, OMDb and TVmaze from our server, so those services never see your IP address or your account.
Subtitles [verify against P3-07]: when you search for subtitles, your TV sends the title, year, season and episode, language and file length to our server, which searches the subtitle services for you. The subtitle file itself is downloaded by your TV directly from the subtitle service, which sees your IP address. If you sign in to OpenSubtitles with your own account, that sign-in goes to OpenSubtitles and its privacy policy applies. We never store subtitle files.
Your own TMDB key (optional): if you add your own TMDB key, your TV contacts TMDB directly with it. TMDB sees your IP address and the titles you look up. The key stays on your TV.
Channel logos and guide matching [verify against P3-11]: to find logos and guide data for channels that lack them, your TV sends channel names to our server. They are not stored with your account.
Legal basis: contract (providing the Pro features you bought).
5.3 Cloud sync (off until you turn it on)
If you switch on cloud sync, your favorites, watch progress, profiles and settings are uploaded so your other TVs can use them. Your sources (addresses, user names, passwords) are encrypted on your TV with a key derived on the device that we never receive, so we cannot read them. [verify against P3-03: whether the whole blob or only the sources are end-to-end encrypted, and how the key reaches a second TV.] The channel lists and catalogues of your sources are never uploaded. Switching sync off deletes the copy on our servers within 24 hours. Legal basis: consent (6(1)(a)), which you withdraw by switching sync off.
5.4 Trakt (optional) [verify against P3-09]
If you connect Trakt, your TV sends Trakt what you watch, so Trakt can keep your history and watchlist. Trakt is then a separate controller under its own privacy policy. Disconnect any time in Settings. Legal basis: consent.
6. Who processes data for us (subprocessors)
| Company | What they do for us | Data | Where |
|---|---|---|---|
| Cloudflare, Inc. | Runs our server, database and file storage (Workers, D1, KV, R2, Queues); network security | Account, devices, purchases, sync copies, server logs | Global network; we request EU storage where available. EU-US Data Privacy Framework and standard contractual clauses |
| Functional Software, Inc. (Sentry) | Crash reports | Section 4.1 | US or EU region ⟦SENTRY_REGION⟧ [verify]; Data Privacy Framework and standard contractual clauses |
| Google LLC / Google Ireland Ltd | Google Play billing and purchase checks; Sign in with Google (if you choose it); "Continue watching" on the Google TV home screen | Purchase tokens; sign-in ID; titles you are watching and your progress, shown on your own TV's home screen [verify against P2-05] | EU and US |
| Apple Inc. | Sign in with Apple (if you choose it); App Store billing (later) | Sign-in ID, purchase tokens | EU and US |
| Amazon.com Services LLC | Amazon Appstore billing (later) | Purchase tokens | EU and US |
| Stripe Payments Europe, Ltd. | Payments on our website (only for the version sold outside the stores) | Payment details are entered with Stripe; we receive the plan and a customer ID | EU, US |
| ⟦EMAIL_PROVIDER⟧ | Sends sign-in links and receipts | Email address | ⟦EMAIL_PROVIDER_REGION⟧ |
Trakt, OpenSubtitles, SubDL, SubSource, fanart.tv, OMDb, TVmaze and TMDB are not our processors. Our server calls the catalogue services without any data about you. Where your TV contacts a service directly (subtitle download, your own TMDB key, Trakt), that service is a separate controller.
7. How long we keep data
| Data | Kept for |
|---|---|
| Account, devices, usage counters | Until you delete the account. Accounts with no sign-in and no active purchase for 3 years are deleted after an email warning |
| Sync copy | Until you switch sync off or delete the account |
| Purchase records | 7 years after the end of the year of sale, as Swedish bookkeeping law requires (bokföringslagen). Only plan, dates, amounts and the store reference |
| Crash reports | 90 days |
| Server logs (request time, path, status, country, coarse device data; no IP address stored by us) | 14 days |
| Backups of the database | 30 days, then overwritten |
| Data on your TV | Until you delete it or uninstall the app |
8. Deleting your data
- In the app: Settings › Account › Delete account. [verify against P3-01]
- On the web: rivastv.com/account, sign in, Delete account. This is also the link in our store listings for users who no longer have the app.
- By email: privacy@rivastv.com from the address on the account.
We delete the account, devices, sync copy and usage counters within 24 hours and confirm by email. Copies in backups disappear within 30 days. Purchase records we must keep by law (section 7) are kept without your email. Deleting your account does not cancel a store subscription: cancel it in Google Play, Amazon or Apple, which we link to from Settings.
To remove everything on a TV, uninstall the app or use Settings › Reset.
9. Your rights
Under the GDPR you can ask us to: see the data we hold (and get a copy in a machine-readable format), correct it, delete it, restrict or object to its use, and withdraw consent at any time without affecting earlier use. Write to privacy@rivastv.com; we answer within one month. You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se, or the authority where you live.
10. Children
Rivas TV is not directed at children. Accounts are for people aged 13 or over (Sweden's age of consent for online services); where local law sets a higher age, up to 16, that age applies. Kid profiles are a household feature on the TV: they are not accounts and send nothing to us about the child.
11. Security
Connections to our servers use TLS. Data at rest on our servers is encrypted by Cloudflare. Sources on the TV are stored with Android's encrypted storage. Access to production data is limited to the publisher and logged. If a breach puts your data at risk, we tell IMY within 72 hours and you without undue delay.
12. What we do not do
No ads, no advertising ID, no data sales, no profiling, no automated decisions with legal effect, no tracking across apps or websites, no analytics SDKs from third parties.
13. Changes
We will show important changes in the app and email Pro users at least 30 days before they apply. Earlier versions are kept at rivastv.com/privacy/history.