Privacy Policy

IPStreamBox (the app, this website and the activation service) is operated by [Business legal name], which is responsible for the personal data described in this policy. We collect only what we need to activate devices, run the Service, keep it secure and answer support requests.

When the app registers and checks a device, we store:

• the device’s MAC address (or the MAC-style ID the app creates when the device does not expose one);
• the device key, stored only as a keyed hash; we never store the key itself in readable form;
• the platform, app version, device label, and whether the ID is a hardware or app-created one;
• the device status, plan and expiry date, and the dates the device was registered, activated or deactivated;
• the time and IP address of the device’s last check, used for security, abuse prevention and rate limiting.

If you create an account, we store your email address, your name if you provide it, and your password as a bcrypt hash (we cannot read your password). We also store the date of your last sign-in and which devices are linked to your account.

Each website session stores a hashed session token with the IP address and browser user agent used to sign in, so that sessions can be secured and signed out.

Your playlists, including any IPTV server address, username and password, are stored on your device.

• When you add or edit a playlist on this website, the details are encrypted (AES-256-GCM) and kept on our server only until your device picks them up and confirms them. They are then deleted. If the device does not pick them up within 7 days, they expire and are deleted.
• To show your playlists on the website, the server keeps only the playlist name, the server host name (without path or credentials) and its sync status.
• Records of delivered or expired playlist changes (without credentials) are deleted after 30 days.

• Contact form: your name, email address, subject, message and the IP address it was sent from, so we can reply and prevent spam.
• Security and audit logs: important actions (for example sign-ins, activations, plan changes and administrator actions) with the outcome, time, IP address and browser user agent.
• Rate limiting: short-lived counters keyed on IP address, MAC address or email, deleted automatically after they expire.

• to register and activate devices, check plans and let the app work;
• to deliver playlist changes you make on the website to your device;
• to provide your account, apply plans and answer support requests;
• to keep the Service secure, prevent fraud and abuse, and investigate problems;
• to meet legal obligations.

We use only essential cookies: a sign-in session cookie for your account and a session cookie when you sign in with your device. They are HTTP-only, sent only to this website, and expire after 14 days (account) or 7 days (device), or when you sign out.

We do not use analytics, advertising or third-party tracking cookies, and our fonts are served from this website.

We do not sell your data or share it for advertising. The website and database are hosted by Hostinger, which processes data on our behalf. If we reply to you by email, the message is handled by our email provider.

We may disclose data where the law requires it, or to protect the Service and its users.

• Device and account data: while the device or account is in use, and afterwards only as long as needed for support, security or legal reasons, or until you ask us to delete it.
• Playlist credentials on our server: only until your device confirms them, at most 7 days.
• Sessions: until they expire or you sign out.
• Contact messages and security logs: as long as needed to handle your request and keep the Service secure.

Connections use HTTPS. Passwords are hashed with bcrypt, device keys and session tokens are stored only as hashes, and playlist credentials in transit are encrypted. No system is perfectly secure, so please keep your device key and password private.

Depending on where you live, you may have the right to access, correct or delete your personal data, or to object to or restrict its use. You can:

• change your password and sign out of all sessions in My Account;
• unlink or deactivate your device from My Account or the Status page;
• ask us to access or delete your data by contacting us by email at support@ipstreambox.com or through our contact form. Please include your MAC address or account email, never your device key.

You may also have the right to complain to your local data protection authority.

The Service is not directed to children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy. The “Last updated” date at the top shows the latest version.