Privacy Policy

Effective date: 18 October 2026

This policy explains what personal data KawaTV collects, why, who receives it, how long we keep it and what choices you have. It covers:

the KawaTV Android app, published on Google Play as "Kawa Player: IPTV M3U Playlist"
the KawaTV iOS app, published on the App Store as "Kawa Player: IPTV M3U Playlist"
the KawaTV web player at watch.kawatv.app
this website, kawatv.app
the former addresses of the website and the web player, tv.boredbros.dev and ktv-app.boredbros.dev, for as long as they still show these pages or redirect to them
any other address where our hosting provider serves the current version of the web player or this website

Who we are and how to contact us

KawaTV is run by HYK OPS, the data controller for the personal data described here. In this policy, "KawaTV", "we" and "us" mean HYK OPS.

For any privacy question or request, email omar@boredbros.dev. It helps if you tell us which platform you use (Android, iPhone, iPad or web).

KawaTV is a media player. You add your own M3U or Xtream playlists and KawaTV plays them.

The short version

You can use KawaTV without giving us an email address.
KawaTV has no ads and no advertising SDKs, and it does not collect an advertising ID.
We do not sell your data, and we do not use it to track you across other companies' apps or websites.
Our websites use Google Analytics only if you accept analytics cookies. You can change your choice at any time.
The Android and iOS apps use Google Analytics for Firebase to count which screens are used. You can turn this off in Settings → About → Share usage analytics once you are signed in. All platforms use Sentry to find and fix crashes. Both are set up to leave out what you watch.
If you add playlists, we store them on our servers, including any Xtream username and password, so that our servers can load them for you.
You can delete your account, playlists and favourites from inside the app at any time. Some records are kept after that (see "How long we keep data").

What we collect

Your account

KawaTV offers two ways to sign in. Our account provider, Supabase, runs both.

Anonymous sign-in. This creates an account with a random account ID. We do not ask for your name, email or anything else.
Email sign-in. You enter your email address and we email you a one-time code. If the address is new, an account is created for it when the code is sent, and the account is confirmed when you enter the code.
Linking an email to an anonymous account. In Settings → Account you can add an email address to an anonymous account. We send a code to that address. Your account keeps the same ID, playlists and favourites, and you can then sign in with that email on other devices.

For your account we store your account ID, your email address if you gave one, and whether the account is anonymous.

When you sign in, Supabase also records sign-in information as part of running the account service, such as the time of sign-in, your IP address and your device or browser type.

KawaTV does not ask for your name, phone number or payment details, and the apps do not use passwords for KawaTV accounts.

Playlists and favourites you add

When you add a playlist, we store it on our servers and link it to your account:

the name you give it
its address (an M3U link or an Xtream server address)
for Xtream playlists, your provider username and password
its sync status, when it was last synced, and the account expiry date your provider reports

If you paste an Xtream link that contains a username and password, our servers split it into the server address, username and password once your provider accepts the sign-in. Until then, the full link is stored as you entered it.

When a playlist syncs, our servers download it and store the channels and stream addresses it lists, so the app can show and play them. For Xtream playlists, and for some other providers, the stream addresses contain your username and password. Those addresses are stored too, and the app downloads them to show and play the playlist.

For favourites, we store which channels you marked as favourites and when.

How we handle your playlist credentials:

Your Xtream username and password are stored in our database with your account. Database access rules let only your account read, change or delete them through the app. Our own server code also reads them, and only to sync your playlist.
Our servers use them to sign in to your provider and download your playlist. This download runs on Cloudflare's network, so for this step your provider sees our server's address, not yours.
They are not encrypted separately from the rest of the database.
The app does not save them on your device. It loads them from our servers, together with your list of playlists, while the app is open. The edit screen hides the password unless you tap to show it.
Your saved username and password are never put in share links (see "Streams and content from third parties").
They are deleted when you delete the playlist or your account.

Usage analytics in the apps

The Android and iOS apps use Google Analytics for Firebase to understand which parts of the app are used.

Analytics runs only in release builds of the app: the versions in the app stores and our test releases (such as TestFlight and Google Play test tracks). It does not run in development builds.
The only event we send ourselves is a screen view. It records the type of screen, for example the settings screen or the player screen. It does not record the channel, playlist, search term or address you were looking at.
We do not send your account ID or email to Google Analytics, and we do not log what you watch.
Google Analytics also collects some information on its own: an identifier created for your app installation (the app-instance ID), basic usage information such as when you first open the app and how long you use it, your device model, operating system and app version, and your approximate location (such as your city, region and country), which Google works out from your IP address.
Automatic screen reporting is turned off.
On Android, Google Analytics may use the Google Play install referrer, which tells it how the app was installed.

To turn usage analytics off, go to Settings → About → Share usage analytics. It is on until you turn it off. Settings is available once you are signed in, including after the one-tap anonymous sign-in. Before that, in release builds, Google Analytics for Firebase collects its automatic first-open and session events, and the app records views of the sign-in screens.

When you turn it off, the app tells Google Analytics for Firebase to stop collecting straight away. It also deletes analytics data that has not been sent yet from your device and resets the app-instance ID, so if you turn analytics on again later, you start with a new ID that is not linked to the old one.
Your choice is saved on your device and applied each time the app starts. If you clear the app's data, or reinstall the app without restoring a backup of its data, the switch is on again.
Data Google has already received is kept for the period described in "How long we keep data".

Analytics on our websites

This website and the web player use Google Analytics only if you accept analytics cookies.

On your first visit, a banner asks you to choose. Until you press Accept, Google's analytics script is not loaded and no analytics cookies are set.
If you accept, Google Analytics records the pages you view, how you reached them, interactions it measures automatically such as scrolling, your browser and device type, and your approximate location, and it sets the cookies described in "Cookies and similar technologies".
We use Google Consent Mode. Accepting turns on analytics storage only. The advertising signals stay switched off.
Each site has its own choice and its own Google Analytics cookies, kept on that site's own address. Your choice on one site does not change your choice on the other. Your choice is saved in your browser's local storage for each site.
Page addresses from the web player. The web player reports each screen to Google Analytics by its type only. The page address it sends ends with the screen's general pattern instead of the real screen address, for example "watch.kawatv.app/#/stream/:channelId" for any channel's player screen. The real screen address, which can contain the number of the channel or playlist you opened or the email address on the sign-in code screen, is never sent, and neither are the playlist address and playlist name from a shared-playlist link. Of the rest of the address, only campaign tags (such as utm_ parameters) are kept. If you arrived from another website, its address is sent as where you came from. When you move between screens, the previous screen's general pattern (for example "watch.kawatv.app/#/home") is sent as where you came from, never its real address. We have set Google Analytics for the web player not to record page changes on its own, so only these addresses are sent.
This website (kawatv.app) reports its page addresses as they are. They contain no playlist or account details.

To change your choice, use the Cookie settings button in the footer of kawatv.app. In the web player, use the Cookie preferences button on the sign-in screen, or Settings → About → Cookie preferences once you are signed in. Clearing the site's data in your browser also clears your choice, and the banner appears again.

If you choose Decline after accepting, the page first tells Google Analytics to stop, then deletes the Google Analytics cookies, saves your choice and reloads without the analytics script. On every later visit, while you have not accepted, the site deletes any Google Analytics cookies left in your browser. This stops further collection. It cannot recall data Google already received.

Crash and error reports

We use Sentry to find and fix crashes and errors on Android, iOS and the web. When something goes wrong, the app sends Sentry a report that can include:

the type of error, its message and where in the code it happened
which part of the app failed
the app version and technical details about your device or browser and its operating system, language and time zone
a list of the software components the app uses
a short trail of recent events: the names of the screens you opened (for example "the player screen", without the channel), the kind of control you tapped (for example "a button", not its name or what it says), and app and system events

What the app removes. Before the app sends an error report from its own code, it removes:

email addresses
channel and playlist IDs and any other details passed between screens
the names and labels of the controls you tapped
the query and fragment of every web address, and any username and password written into an address
Xtream usernames and passwords in stream addresses, and other username, password and token values
on the web player, the page address is reduced to the site address

Reports these filters do not cover:

On the web player, some errors are caught by Sentry's browser script rather than by the app's own code. A separate filter in the web player cleans these before they are sent: web addresses lose their query, fragment and any username and password written before the server name, Xtream usernames and passwords in stream addresses are masked, email addresses and username, password and token values are replaced in the error message, its extra details and the trail of recent events, and cookies are removed.
On Android and iOS, crashes and freezes in the app's native code (outside its Flutter code), including "app not responding" on Android and app hangs on iOS, are reported by Sentry's own Android and iOS components without these filters. These reports contain the error and where it happened, device and app details, and the trail of recent events. The trail's entries that come from the app's own code have already been filtered.

These filters recognise common patterns, so we also avoid putting personal data in error messages in the first place.

Sentry does not take screenshots or screen recordings, it does not record the layout of your screen or the network requests the app makes, and performance tracing is off.
We do not add your account ID or email to error reports.
On all platforms, Sentry counts app sessions (when a session starts and ends, how long it lasts, how many errors happened and whether it ended in a crash) so we can see how often the app crashes. On Android and iOS, it also adds a random ID for your app installation. On the web player, it includes your browser's user agent.
Sentry receives your IP address as part of the network connection when a report is sent. The app does not ask Sentry to store it, and we have set our Sentry project not to store IP addresses.
On Android and iOS, Sentry keeps reports that could not be sent yet on your device until it can upload them.
On the web player, error reporting loads Sentry's script from Sentry's servers.

Server logs and request data

When the apps, the web player or this website contact our servers, our hosting providers, Cloudflare and Supabase, receive your IP address and standard request details, such as your browser or device type. They need these to deliver the service, and they keep their own operational logs for a limited period that they set.

Database request logs. Supabase logs the requests the apps and the web player make to our database, together with your IP address and the account ID in your sign-in token. Some requests name what they load, so for as long as these logs are kept they show which channel's stream addresses and programme guide the app loaded when you opened a channel and, on Android and the web, the text you typed into channel search. We do not copy these logs into our database or use them to build a viewing history.

Our server code also writes logs, which are kept by Cloudflare and sent to Grafana Cloud for monitoring:

Playlist sync. Each time the app asks our servers to sync a playlist, Cloudflare records the request with its standard details, which can include your IP address, the app's user agent and an approximate location (such as city, region, postcode and network provider) derived from your IP address. The request itself contains only the playlist's number. Our sync logs contain the playlist's number, item counts, error messages and your provider's server address.
Credentials removed from logs. Before a sync log line leaves our server code, we remove usernames, passwords and access tokens in the formats IPTV providers use: written into a server address ("user:password@"), in the path of an Xtream stream address, in address parameters such as "username=", "password=" and "token=", as values stored under names like these in logged data, and as sign-in tokens. Database errors are logged as the error's name, code and message only, without the additional details that quote stored records. The message itself can still quote a value, with credentials in these formats removed.
Live sports and playback relay. Request tracing and per-request logs are turned off for these services, so the leagues you look up or search for are not logged. The live sports service logs only a notice when TheSportsDB asks it to slow down, which contains no information about you. The playback relay is not switched on (see "Streams and content from third parties").
Request tracing is also turned off for playlist sync. The pages of this website and the web player are served as static files and are not logged or traced by our code. The service that answers app-link checks at kawatv.app/.well-known/ (and at its former address) records a log entry and a trace for each request, which can include browser type and approximate location.
Monitoring dashboards show totals, such as how many user playlists are syncing or have failed. They show no addresses or credentials.

Country lookup

To work out which country you are in, the app sends a request directly to ipwho.is, a third-party IP location service. ipwho.is receives your IP address and returns your country.

On Android and the web, this is used to show suggestions for your region on the Home screen.
On every platform, it also happens when you open Settings → Favourite leagues → Add league, to preselect your country.

We use only the country. It is kept in the app's memory while the app is open and is not saved. To load the Home screen suggestions, the app sends the country to our servers. When you add a league, it sends the country to our live sports data service.

Live sports data

Live scores, schedules and league details come from TheSportsDB. The app sends these requests to our own proxy service on Cloudflare, which adds our API key and forwards them. TheSportsDB receives the league or event you asked about, any league search text you typed and the country filter, but no account information, and it sees our server, not you. Our proxy does not log these requests (see "Server logs and request data"). League badges and logos load directly from TheSportsDB's image servers, which see your IP address.

Data stored on your device

The apps and the web player keep some data on your device, in the app's own storage (on the web, your browser's local storage):

Your sign-in session: the tokens that keep you signed in, your account ID and your email if you gave one. It is not kept in a separate encrypted store such as the iOS Keychain.
Recently watched: up to 10 channels you played recently. Each entry holds the channel's ID and the channel details shown in the app, such as its name, logo, country and categories, but not stream addresses. This list stays on your device and is never sent to our servers.
Favourite leagues you chose for live scores.
Settings you change in the app, including your Share usage analytics choice on Android and iOS.
Rating prompt data: a count of streams you played and the app version that last asked for a rating, so the app asks at most once per version. The web player keeps the count too, although it never shows the prompt.
Your cookie choice (web only).

Signing out removes your session from the device. Your recently watched list, favourite leagues and settings stay on the device, even after you delete your account. They stay until you clear them (Recently watched has a clear button), uninstall the app, or clear the site's data in your browser.

On Android, if Android backup is turned on for your Google account, your device may include this app data in that backup.

What we don't collect

No ads. KawaTV contains no ads and no advertising SDKs.
No advertising ID. The Android app removes the advertising ID permission and turns off advertising ID collection in Google Analytics. The iOS app we publish is built without the advertising ID part of Google Analytics and never asks to track you. Google Analytics' collection of the iOS vendor identifier (IDFV) is also off.
No selling or ad tracking. We do not sell your personal data, share it for advertising, or use it to track you across other companies' apps or websites.
No viewing history in our database. We do not store what you watch. Your recently watched list stays on your device, and app analytics and error reports leave out what you watch. Supabase's request logs do show which channels were opened, for the limited time they are kept (see "Server logs and request data").
No sensitive device access. The apps do not ask for your camera, microphone, location (GPS), contacts, photos or files.
No access to your contacts when you share. Sharing uses your device's own share sheet. KawaTV does not see who you share with.

How we use your data and our legal bases

Under data protection laws such as the GDPR, we rely on these legal bases.

To provide the service you asked for (contract):

creating your account and sending sign-in codes
storing, syncing and showing your playlists and favourites, and using your provider credentials to load your playlists
loading the streams and programme guide of the channels you open and, on Android and the web, searching channels
live sports data for the leagues you follow
deleting your account when you ask
processing your IP address and request details so our servers can respond

Our legitimate interests in running a reliable, secure and useful app:

usage analytics in the Android and iOS apps, to understand which features people use and improve them
crash and error reports, so we can find and fix problems
server logs and monitoring, to keep the service working, secure and free of abuse
country lookup, to show suggestions for your region on Android and the web, and to preselect your country when you add a favourite league

You can object to processing based on legitimate interests at any time. For app analytics, turn off Settings → About → Share usage analytics, available once you are signed in (see "Usage analytics in the apps"); this takes effect straight away. For anything else, email us (see "Your rights").

Consent:

Google Analytics cookies on this website and the web player. You can withdraw consent at any time through Cookie settings or Cookie preferences, as described in "Analytics on our websites".

We may also keep or disclose data where the law requires us to.

Who receives your data

We use these providers to run KawaTV. They process data on our behalf, or as described here.

Supabase runs our database, accounts and server functions, and sends our sign-in code emails, either itself or through an email delivery service connected to it, which then receives your email address to deliver the code. Supabase stores your account, email, playlists (including credentials), synced channel lists and favourites, records sign-in information and keeps the request logs described in "Server logs and request data". Our database is hosted in the European Union (Paris, France).
Cloudflare hosts kawatv.app, watch.kawatv.app and their former addresses, and runs our server code for playlist syncing and the live sports data proxy. It receives your IP address and request details, keeps our server logs and caches sports data.
Google provides Google Analytics for Firebase in the apps and, if you accept, Google Analytics on our websites. The web player also loads parts of its display engine and some fonts from Google's servers (gstatic.com), which receive your IP address.
Sentry receives crash and error reports and session counts. The web player loads Sentry's script from Sentry's servers.
Grafana Labs (Grafana Cloud) receives our server logs, the traces described in "Server logs and request data", and total-only monitoring data.
TheSportsDB receives live sports requests through our proxy, as described in "Live sports data". Its image servers receive your IP address when the app loads league badges and logos.
ipwho.is receives your IP address for the country lookup. The app calls this public service directly, and we use it under its public terms; we have no contract with it.
Your IPTV providers receive requests from our servers when your playlists sync, and from your device when you play a stream (see "Streams and content from third parties").
Apple and Google distribute the apps and show the in-app rating prompt on iOS and Android. KawaTV passes them no data for the prompt.

These providers operate internationally. Data they process may be handled outside the European Economic Area and the UK, including in the United States. Where a provider offers them, we rely on the EU Standard Contractual Clauses in its terms. ipwho.is offers us no such terms, and we do not control where it processes your IP address.

Streams and content from third parties

The playlists you add point to servers run by your provider or by other third parties. We do not control those servers or their privacy practices.

Playback. Your device connects directly to the server that hosts each stream, so that server sees your IP address. The Android and iOS apps also send the user-agent and referrer values listed in your playlist, if it has any. Channel logos and programme artwork load directly from their own hosts in the same way.
Playlist sync. Our servers download your playlist and sign in to Xtream providers for you (see "Playlists and favourites you add"). Your provider sees our server's address and the credentials you saved.
Playback relay. KawaTV includes an optional playback relay for Android and the web. It is not switched on in the published apps, and it is not available on iOS. We will update this policy before we switch it on.
Share links. When you share a playlist, the link contains the playlist's address and name. Your saved Xtream username and password are never put in the link, Xtream addresses are cut down to the server address, and usernames and passwords written into the playlist address in the standard "username=" / "password=" or "user:password@" form are removed. Other access details that are part of a playlist address stay in the link, for example a "token=" or "key=" value, or a username and password written into the path. Check the address before you share it. Opening the link sends its address, including the playlist address and name, to watch.kawatv.app. The web player adds the playlist only if the person who opened it chooses to save it.

Cookies and similar technologies

kawatv.app stores your light or dark theme choice and your cookie choice in your browser's local storage. Google Analytics cookies are set only if you accept them.
watch.kawatv.app stores your sign-in session, recently watched channels, favourite leagues, settings, the rating prompt's playback count and your cookie choice in your browser's local storage. Google Analytics cookies are set only if you accept them. The web player registers a small service worker that removes itself straight away and caches nothing.
Google Analytics cookies, after you accept, are "_ga" and one cookie named "_ga_" followed by the site's ID. Each site keeps them on its own address, so kawatv.app and watch.kawatv.app do not share them. Google sets them to count visits and distinguish visitors, and sets their lifetime (by default up to 2 years).
Android and iOS apps do not use cookies. Google Analytics for Firebase stores its app-instance ID on your device until you turn off Share usage analytics, clear the app's data or uninstall the app.

You can also block or delete cookies and site data in your browser settings. Clearing the web player's site data also signs you out of it and removes your on-device lists and settings. See our Cookies Policy for a short summary.

How long we keep data

Account and email: until you delete your account. If you request a sign-in code but never enter it, the email stays on an unconfirmed account until it is deleted; contact us to remove it.
Anonymous accounts: kept until deleted, even if you sign out. If you sign out of an anonymous account you cannot sign back in to it, but its playlists and favourites stay on our servers. To remove them, delete the account before you sign out, or contact us.
Playlists, credentials and synced channel lists: until you delete the playlist or your account. Synced channel lists are replaced at each successful sync. If a sync finds no channels, or far fewer than before (less than half, for lists of 50 or more), we keep the previous list and mark the playlist as failed. When you change a playlist's address or login, its stream addresses are removed at once, and channels the new source no longer lists are removed at its next successful sync.
Favourites: until you remove them or delete your account.
Sign-in records and backups: Supabase's sign-in records (which can include your email and IP address) and database backups can remain after you delete your account. Backups expire on Supabase's schedule. Contact us if you want your sign-in records removed as well.
Database request logs: kept by Supabase for a limited period set by Supabase, then deleted automatically.
Server logs: kept for a limited period set by Cloudflare and by Grafana Cloud, then deleted automatically.
Live sports data cache: up to one hour. It contains no account information.
App and website analytics: Event-level analytics data is kept for the retention period set in our Google Analytics settings (2 or 14 months) and then deleted by Google; Google keeps aggregated reports that do not identify you after that.
Crash and error reports: kept for a limited period set by Sentry.
Provider logs: our hosting providers keep their own operational logs, which may include IP addresses, for periods they set.
Data on your device: until you clear it, uninstall the app or clear the site's data.

Your rights

Depending on where you live, you have the right to:

access the personal data we hold about you and get a copy of it
correct data that is wrong
delete your data
receive data you gave us in a portable format
object to processing based on our legitimate interests (for app analytics, use Settings → About → Share usage analytics)
restrict how we use your data in some situations
withdraw consent at any time, where we rely on it
complain to the data protection authority in your country

Delete your account in the app. Go to Settings → Account → Delete Account and confirm. This immediately deletes your account and email, your playlists (including saved credentials), their synced channel lists and your favourites from our live database, then signs you out. Sign-in records, backups, logs, analytics and crash reports expire on the schedules in "How long we keep data". Data kept only on your device stays until you clear it or uninstall the app.

Manage your content in the app. You can edit or delete playlists and remove favourites at any time.

Everything else. Email omar@boredbros.dev. We may ask you to confirm that the account is yours, for example by writing from the email address linked to it. We will reply within the time limits set by law.

Children

KawaTV is not directed at children under 16, and you must be at least 16 to use it. We do not knowingly collect personal data from children under 16. If we learn that we hold such data, we delete it. If you believe a child under 16 has given us personal data, contact us.

Security

Database access rules let each account read and change only its own playlists, credentials and favourites through the app.
Account deletion acts only on the account in your verified sign-in token.
Server keys that can access all data are used only on our servers, never in the apps.
Playlist sync is protected by a shared key that is built into the apps and the web player, not by your sign-in. Our sync service does not yet check that a request comes from the playlist's owner, so someone who extracts that key and knows a playlist's number could make our servers sign in to that playlist's provider and sync it again, which updates its sync status. The reply contains a channel count or an error message. The message can include the provider's server address or the playlist's address and the account's expiry date, with usernames, passwords and tokens in the formats listed under "Server logs and request data" removed.
Saved usernames and passwords are kept out of share links, and personal data is filtered out of our sync logs and out of the error reports that pass through the app's and the web player's filters (see "Crash and error reports").
All connections between the apps, our websites and our servers are encrypted (HTTPS).

No system is perfectly secure. As described above, saved provider credentials are not encrypted separately from the rest of our database, and your sign-in session is kept in the app's own storage on your device. If you think your account has been misused, contact us.

Changes to this policy

We will update this page when our practices change and change the effective date at the top. If a change significantly affects how we use your data, we will point it out clearly on this page.