Zapeo IPTV privacy policy

Last updated: October 23, 2026.

Who is responsible

Zapeo IPTV is an app developed by Rafael Grande Ocampo (hereinafter, "the developer"). Contact: soporte@zapeoiptv.com.

What the app is

Zapeo IPTV is a media player. It does not include, distribute or recommend any audiovisual content. Users enter the playlists or credentials provided by their own provider, and are solely responsible for that content and for holding the rights needed to watch it.

What data the app processes

• Playlists and credentials. M3U playlist URLs, Xtream Codes login details (server, username and password) and Stalker portal details (URL and MAC address) are stored only on the user's device, in the app's local database. They are not sent to the developer or to third parties. The app uses them only to connect to the provider's server indicated by the user.
• History and preferences. Favorites, recent channels, playback position, recordings, the parental control PIN (stored as a hash) and settings are stored locally. They are deleted when the playlist is removed or the app is uninstalled.
• TV guide. The app downloads the guide (XMLTV) from the address set by the user or their provider and keeps it in a local cache.
• Zapeo account (optional). Only if the user creates an account, which is required to buy Premium and to sync across their devices. The following is stored on the server:
  • their email address and, if they choose one, their password, which the service provider stores encrypted and the developer cannot read;
  • their Premium license: the plan (yearly or lifetime), how long it is valid and the payment reference;
  • the devices using the license (up to three): a random identifier created when the app is installed, the device name, the operating system and the date of the last connection, in order to limit the license to three devices. The user can see them and remove them from the account itself, and devices that do not connect for 90 days are deleted automatically;
  • with Premium, what they watch and where they left off: playback position and episode, favorites and hidden items, identified by the internal code of each channel, movie or series.

  Each playlist is identified by an irreversible fingerprint (SHA-256). Playlist addresses, usernames, passwords and provider MAC addresses are never sent. This data is used only to manage the license and sync the user's own devices. Each user can only access their own data. On the device, the account session and the license are stored in the system's secure storage (Keychain, Keystore, Credential Manager or the Linux keyring).

• Purchases. In the store versions, the Premium purchase is handled entirely by the app store (Google Play, App Store or Microsoft Store). Elsewhere (computers and versions downloaded from the website), payment is made in the browser through Paddle (Paddle.com Market Ltd), which acts as the seller and handles billing, taxes and invoices. Paddle processes the email address, country and payment details under its own privacy policy (paddle.com/legal/privacy). The developer and the app only receive the payment confirmation and its reference, in order to activate the license on the account. The developer never has access to card details.

What data the app does NOT process

• No account or sign-up is needed to use the app. The Zapeo account is optional.
• No personal data, location, contacts or advertising identifiers are collected.
• There is no advertising and no third-party SDK for advertising purposes.
• No telemetry or usage statistics are sent to the developer.

Network connections

The app connects only to:

1. The servers configured by the user (playlists, credentials, EPG guide, channel logos and posters).
2. The app store, to verify or restore the Premium purchase.
3. Only with a Zapeo account: Supabase (Supabase Inc.), which hosts the account, the license and the synced data on servers in the European Union (Ireland) as data processor.
4. Only when buying outside the app stores: Paddle's checkout page, in the browser.
5. Only in versions downloaded from GitHub: the GitHub API, once a day, to check for a new version. No user data is sent, other than the IP address inherent to any connection.

Permissions

• Internet: to play the content indicated by the user.
• Keep the device awake: so the screen does not turn off during playback.
• App storage: for recordings the user starts manually. They are saved in the app's private folder (phone and TV) or in Downloads/Zapeo IPTV (computer).

Children

The app is not intended for children under 14. It includes a PIN-based parental control, configurable by the user, to restrict categories.

User rights

Without a Zapeo account, the developer does not process any personal data of the user: all information resides on the device and can be deleted from Settings or by uninstalling the app.

With a Zapeo account, the user can delete their account and everything synced at any time from Settings → Zapeo account → Delete account. Deletion is immediate and permanent. Data is kept for as long as the account exists. The legal basis is the provision of the service the user requests when creating it. Users can also exercise their rights of access, rectification, erasure, objection and portability by writing to soporte@zapeoiptv.com, and lodge a complaint with the Spanish Data Protection Agency (aepd.es).

Changes

This policy may be updated. The current version is published with the app in the store and at https://zapeoiptv.com/en/privacy.