What we keep,
and what we don’t.

The short version

TiviDeck works entirely on your television with nothing switched on. It has no account, no analytics library and no advertising identifier. Everything it knows about you — your provider, your channels, your recordings, what you watched — is on the box.

One thing is sent without your asking: if the app crashes or freezes, it sends us a crash report so we can fix it. It says what failed, not who you are.

A few things change that, and only if you choose them: linking a phone, buying a plan, or redeeming a code. Each creates an anonymous household so that your televisions and phones can see each other and so a purchase stays with you. What that sends, and what it does not, is set out below.

We do not sell data. There is no data broker, no audience segment and no third party paying us for anything about you.

What stays on your television

Unless you link a phone, none of this leaves the box at all:

• Your provider’s details — the address and sign-in you entered. Stored encrypted on the device.
• Your channel list and guide data, cached so the app opens quickly.
• Recordings and downloads, which are files on your own storage.
• What you watched and for how long, which is what builds the profile page and the family report.
• Favorites, lists, hidden channels, category choices, themes, text sizes and remote key bindings.
• The parental PIN and the child rules — bedtimes, allowances, allowed categories.
• How often you were shown an advertisement, counted on the box so a daily cap can be honored. That count is never sent anywhere and carries no identifier.

A backup file you create yourself contains these things, including your provider sign-in. It goes where you send it — a USB drive or your own server — and never to us.

What leaves the box only if you link a phone

Linking is opt-in, reversible, and creates an anonymous account: no email, no name, no password. It exists so that a household’s televisions and phone can see each other.

Once linked, these are stored in your household’s record on our hosting provider:

• Your profiles — names, avatars, whether each is an adult or a child.
• Your settings and look, so a second television matches the first.
• Favorites, lists and continue-watching positions.
• Child rules — bedtimes, daily allowances, what a child may reach — so a parent can set them from a phone.
• What is playing now, and a summary of what has been watched, per television. This is what lets a parent see “Bluey, started twenty minutes ago” from the kitchen. It is the point of the feature; if you do not want it, do not link.
• A profile photograph, if you upload one from the phone.
• Messages you send to a profile, until they are read and cleared.
• Your providers and the services you connected (Trakt, a debrid account and so on), so a new television or phone in the household does not need them typed again. These are sealed on the device before they travel: encrypted with AES‑256‑GCM under a household key that only your own devices hold. Our servers store them but cannot read them.

Unlinking removes this television from the household. When nothing is left in a household, the household and its settings are removed with it.

Crash reports

When the app closes on its own or stops answering, the next start sends us a report.

• What it holds: the error and where in the app it happened, the screen that was open, the app’s version and edition, and the device’s make, model and Android version.
• What is cut out before it is written: stream and provider addresses, and anything shaped like a login, user name, password, token or key.
• A report you send yourself from Settings also carries the app’s recent log lines, cleaned the same way. To tell which part of a failing stream was refused, it can include your provider’s server name and port, never your user name or password.
• Reports carry no household, account or device identifier. To stop one box flooding us, we keep a one-way keyed hash of the internet address a report came from, never the address itself. Reports are used only to fix the app.

The public game rooms

The Caveman Room is public, and the screen says so before you type.

Every live game has a room, and everybody watching that game on TiviDeck can read it. A message you send is visible to strangers. It carries a short anonymous tag rather than your name, and the room ends when the game ends.

Do not put anything personal in a game room. Messages can be reported by other viewers and reviewed by us for abuse. Rooms are for grown-up profiles only; a child’s television has no chat in it.

Children

Nothing is sold on a child’s screen, and nothing is collected from one for advertising.

• A child profile is never shown an advertisement of any kind.
• A child profile has no chat, no search across the whole playlist, and no settings.
• What a child watched is recorded for their own parent — that is what the family report is — and is visible to that household only.

We do not knowingly collect personal information from children. A child profile is created by an adult in the household and has no account, no email and no identity outside that household.

Advertising

The free tier shows occasional advertisements: a short spot before an on-demand title, a card while you are paused, a tile on the home screen. Any Premium plan removes them for good.

• Advertisements are chosen on the television from a list it downloads. Nothing about you is sent to choose one, and there is no advertising identifier.
• How often one was shown is counted on the box, to honor a daily cap. That count stays there.
• Advertisers are told how many times their campaign ran in total. They are never told who saw it.
• A campaign can be bought for a country. That is matched using your device’s own region setting, on the device.

The website and the dashboard

The marketing pages set no cookies and run no analytics.

• Signing in to the dashboard uses a one-time code sent to your email. We keep that email address to identify your account and to send you codes and receipts.
• The contact form sends us your email address and your message, so that we can answer.
• Buying Premium is handled by Google Play, the App Store, the Amazon Appstore or Stripe. We never see or store your card details; we keep a record that the purchase happened so your household stays unlocked.
• Placing an advertisement keeps your email, your campaign and its creative, and whether it was approved.

Premium, the trial and your devices

The seven‑day trial is counted on the television or phone itself. Nothing is sent to start it. Once a household exists, the date it began is kept with the household, so reinstalling does not start it again.

• Store edition (Google Play). Google handles the payment. We receive the purchase token and check it with Google; we store a fingerprint of it, the plan, and whether it was refunded.
• App Store and Amazon Appstore. Apple or Amazon handles the payment the same way: we receive the store’s receipt, check it with the store, and keep a fingerprint of it, the plan, and whether it was refunded.
• Enhanced edition (card, at tivideck.com). Stripe handles the payment and keeps your email for its receipts. We keep Stripe’s payment references, the plan, and whether it was refunded. If a payment is refunded or disputed, we record that and what it bought is taken back.
• Devices. A plan covers a number of devices, so the household lists each TV and phone in it by the name the device gives itself, with when it was last seen. Removing one takes it off the list.
• Accepting these terms. Before TiviDeck can be used it asks you to accept the Terms of Use and this policy. Your device remembers that you did, and we keep a record of it: a random number your device makes for this (it identifies nobody), which version you accepted, when, the app’s version and the kind of device. If you later link a device or buy a plan, the record is attached to that anonymous account. Deleting your account deletes the record.

The services TiviDeck talks to

Each of these is contacted for a specific job. None of them is sent your provider details or your viewing history.

Your provider is not one of ours. When you play a channel, your television talks to your provider directly, exactly as any player would.

What we never do

• No analytics library. There is no Firebase, no Crashlytics, no Facebook SDK and no third-party measurement code in the app. You can verify this in the build file.
• No advertising identifier is read or sent.
• No selling or sharing of personal information, and no cross-context behavioral advertising.
• No reading your provider’s content. We do not see what you watch unless your own household is linked and you look at it yourself.

Your choices

• Do not link. The player is complete without it.
• Unlink at any time in Settings › Account & profiles › My account (on the phone, My TiviDeck › My account). The television leaves the household; an empty household is removed.
• Delete a profile and its history goes with it.
• Delete your account and its data: tivideck.com/delete-account.
• Ask us for a copy of what we hold, or to delete it. Write to us and we will do it. If your televisions were never linked, we hold nothing to send.

Depending on where you live you may have rights to access, correct, delete or export your personal information, and to object to its processing. We honor those requests from anyone who asks, wherever they live, rather than checking first whether we are obliged to.

Contact

Write to us through the form on the front page, or at support@tivideck.com. The operator and data controller is:

If this page changes in a way that affects what we collect, the date at the top changes and the change is described in the app’s release notes.