ZapStream — Privacy Policy

Last updated: 2026-09-06 (rev. 8)

ZapStream ("the app") is a video-playback client for M3U playlists or Xtream Codes accounts that you configure yourself, available on Android (including Android TV / Chromecast with Google TV, and Fire TV) and iOS. The developer does not provide, host, sell, or have any access to video content played through the app — the app is a player only.

Data the app collects

Crash and diagnostic data (Firebase Crashlytics). If the app crashes, it reports the crash to Firebase Crashlytics: device model, OS version, app version, a stack trace, and an anonymous per-install identifier generated by Firebase. This is used solely to find and fix bugs.

Performance data (Firebase Performance Monitoring). The app reports app-start time and (on Android) screen-rendering performance (slow/frozen frames) to help diagnose performance issues. Automatic network-request monitoring is explicitly disabled on both platforms — the Xtream Codes protocol requires the user's username and password to be embedded directly in request URLs, and Firebase's automatic network instrumentation would otherwise capture those URLs. Network performance is not currently measured for this reason.

Usage data (Firebase Analytics). The app reports anonymous usage data — screen views, session length, app opens — to help understand how the app is used and prioritize improvements.

Advertising and ads (Google AdMob — Android phone/tablet and iOS). The app shows interstitial ads via Google AdMob at three points: when you open a movie, episode, or live channel, and when your channel/movie/series catalogue reloads (on setup, profile switch, or manual refresh) — at most once every 90 minutes. On Android, AdMob additionally uses mediation partners AppLovin MAX and Unity Ads to help fill these ad slots; on iOS, only Google AdMob itself serves ads, with no third-party mediation partners. Ads are shown on Android phones and tablets and on iOS — the Android TV / Chromecast with Google TV / Fire TV experience never shows ads and never initializes the ads SDK at all. Where required by your region's law (e.g. EEA/UK/Switzerland), a consent prompt appears before any ad is requested (via Google's User Messaging Platform, "UMP"), and ads are non-personalized by default until you consent to personalization; declining does not block app use. On iOS, this consent step follows Apple's own App Tracking Transparency ("ATT") prompt, shown once at first launch. In addition to the interstitials, a banner ad is shown on the Home screen on Android phones/tablets and on iOS. Showing ads requires collecting the device's advertising identifier — the Google Advertising ID on Android, or Apple's IDFA on iOS (only if you grant ATT permission; declining still allows non-personalized ads without IDFA collection). A one-time Pro purchase (see "Purchases" below) permanently removes every ad on either platform.

Name resolution (DNS over HTTPS). By default the app resolves the hostnames it needs — your provider's server, EPG and artwork hosts — through Cloudflare (cloudflare-dns.com), falling back to Google (dns.google) and then to whatever DNS server your network provides. Those resolvers therefore see the hostname being looked up and your IP address, under their own privacy policies; they never see your username, password, or playlist URL, which are not part of a DNS lookup. This is a connectivity feature, not a privacy or anti-blocking feature — the destination IP address and the TLS server name are still visible to your network operator. You can switch it off at any time in Settings → DNS → "Disable DoH", which returns the app to your network's own DNS server. On Android this covers all of the app's traffic; on iOS it covers catalogue, guide, diagnostics and artwork requests, while video playback itself uses the system resolver.

Development/test builds never show real ads. Builds that seed test IPTV credentials for development (never the version you install from the Play Store or Amazon Appstore) are hard-wired to request only Google's publisher test ad creative, never a real ad — this is enforced structurally, not just by policy, so real ads and test content can never be served together.

Your source configuration. The playlist URL, server address, username, and password you enter to connect to your own M3U or Xtream Codes source are stored only in local, on-device storage — encrypted at rest using the Android Keystore on Android, or the Keychain on iOS — and are sent only to the server address you configured, to play your streams. They are never sent to the app developer, and (per the network-monitoring note above) are kept out of the Firebase telemetry described above too.

No account required. The app does not require account creation, on any platform, including for the cross-device sync described below.

Cross-device sync (optional, off by default). The app can keep your favourites, watch progress, watched-episode marks, custom lists and category-filter selections the same across your own devices. It is off until you turn it on, and nothing is uploaded until you do.

What is uploaded. Only the items listed above, plus the display name of each source profile and a device label (your device's manufacturer and model) so you can recognise which device last synced. Your source credentials are never uploaded — not the server address, username, or password. Stream addresses stored alongside your watch progress have the username and password stripped out of them before anything leaves the device; where an address cannot be stripped, it is dropped entirely rather than uploaded.

It is encrypted on your device, and we cannot read it. Everything is encrypted with AES-256-GCM before it leaves your device, using a key derived on-device from your pairing code. The pairing code never leaves your device — the server is sent only a one-way hash of it, computed with a different prefix so the value the server holds cannot be used to derive the key. The service therefore stores an opaque encrypted blob it has no ability to decrypt.

What the service can see. The hosting service (Cloudflare Workers KV, operated by the developer at sync.zapstream.app) can see that hash, the size and timestamps of the encrypted blob, and the IP address of each request — the last of which is used to rate-limit abuse. It cannot see the contents.

Your pairing code is the only key. There is no account, email or password, so there is no recovery: anyone who obtains your pairing code can read your synced data, and if you lose it, neither you nor the developer can recover it. Treat it like a password, and do not share the pairing link or QR code.

Your controls. Settings → "Sync across devices" lets you choose per category what is shared (favourites, movie progress, series progress, custom lists), unlink this device (which stops syncing here and leaves your on-device data untouched), or delete the synced data, which erases the stored copy for every device using that code. Deletion is recorded so other devices stop syncing and do not re-upload it.

Retention. The encrypted blob is deleted automatically 90 days after the last time any device used it. Deleting it from the app removes it immediately.

Purchases

The app offers an optional, one-time "Pro Lifetime" purchase that permanently removes the ads described above and unlocks a small set of extra features (advanced title cleanup, PIN-protected category lock, and custom lists). On TV devices, which never show ads, the purchase unlocks those features only.

The purchase is processed entirely by the store the app was installed from — Google Play Billing on Google Play builds, Apple's App Store (StoreKit) on iOS, or Amazon In-App Purchasing on Amazon Appstore (Fire TV) builds. ZapStream never sees, receives, or stores your payment card details or any other financial information on any platform. The store shares back to the app only a purchase token/transaction record and product identifier, used solely to confirm you own the purchase (so ads stay off and features stay unlocked, including after reinstalling). The purchase is tied to your account with that store and does not sync across stores or platforms — a purchase made on Google Play does not unlock the iOS or Fire TV app, and vice versa. Standard Google Play / Apple / Amazon refund policy applies respectively; refunds are requested and processed through that store, not through the app or developer directly.

Data storage and retention

All configuration, favourites, watch progress, and cached data live in the app's local storage on your device. Uninstalling the app deletes all of it. The one exception is cross-device sync (see above): if you have turned it on, an encrypted copy of the synced items also sits on the sync service until you delete it from the app or it expires 90 days after last use — uninstalling the app does not remove that copy, because the app can no longer prove it holds the pairing code once it is gone. Delete it from Settings first if you want it removed. Crashlytics, Performance Monitoring, and Analytics data is retained according to Google Firebase's own retention policy (currently 90 days for most product data; some Analytics data may be retained longer per Google's product documentation) — see Firebase's Privacy and Security policy.

Third parties

The app uses Google Firebase (Crashlytics, Performance Monitoring, and Analytics) and Google AdMob to show ads on Android phones/tablets and on iOS — governed by Google's Privacy Policy. On Android, AdMob additionally uses mediation partners AppLovin MAX and Unity Ads, governed by AppLovin's Privacy Policy and Unity's Privacy Policy respectively — these are not used on iOS. The one-time Pro purchase (see "Purchases" above) is processed by Google Play Billing, Apple's App Store, or Amazon In-App Purchasing, depending on the store the app was installed from — governed by the same Google Privacy Policy, Apple's Privacy Policy, or Amazon's Privacy Notice respectively. If you enable cross-device sync (see above), the encrypted blob is stored on Cloudflare Workers KV — governed by Cloudflare's Privacy Policy — where the developer operates the service; Cloudflare and the developer hold only ciphertext and cannot decrypt it. Hostname lookups go to Cloudflare and Google by default (see "Name resolution" above), governed by Cloudflare's 1.1.1.1 privacy commitments and the same Google Privacy Policy; this can be turned off in Settings. Where required by your region's law, you can opt out of personalized ads via the in-app consent prompt shown on first launch (Google's UMP, preceded on iOS by Apple's ATT prompt), or at any time through your device's ad settings.

Children's privacy

The app is not directed at children under 13 and does not knowingly collect data from children.

Changes to this policy

This policy may be updated as the app changes. Changes are reflected by the date above.

Contact

Questions about this policy can be sent to info@zapstream.app.