Privacy policy

This policy explains how data is processed when you use extraTV on Apple, Android or Windows devices and when you use its pairing and metadata services.

Data controller and pairing-service operator: Tommi Vainio, Koulukatu 28, 33200 Tampere, Finland. Privacy contact: privacy@extratv.fans.

Product owner and software developer: INTERSTEL SAS. Company number: 107980237. Address: 254 RUE VENDOME, 69003 LYON, FRANCE. Website: interstel.org. INTERSTEL SAS has authorised Tommi Vainio to publish, distribute and support extraTV through his Apple Developer and App Store account, where TOMMI VAINIO is shown as the seller. Company contact: tech@interstel.org.

Data stored locally

Provider credentials are protected using the platform facility available to the app: Keychain on Apple devices, app-private Keystore-backed encrypted storage on Android, and DPAPI CurrentUser on Windows Preview. The Windows database contains an encrypted credential blob and opaque references; the blob is bound to the current Windows user. Android backup and device-to-device transfer of app data are disabled for the Preview package.

Favourites, playback history, searches, catalogue and EPG records, hidden categories, provider item identifiers and media addresses, preferences and caches are processed locally. The pairing and metadata services do not receive these records simply because you use the player. Unlinking a source removes its protected credentials and associated local source data. If the device is offline while an unlink must be reported to the metadata service, the app may retain only protected revocation material until it can complete or expire that request. On Apple devices, unlink before uninstalling because iOS may retain Keychain items after reinstallation.

Device permissions

Android uses Internet and network-state access to reach the provider and extraTV services, and foreground media-playback and wake-lock capabilities to keep user-initiated playback working. The Preview package does not request access to the device's photo, video or audio library. Windows uses network access for the same service, provider and update functions.

Pairing service

Apple and Android apps send their platform (iOS, tvOS, Android or Android TV), version and opaque tokens for a temporary session. Windows Preview does not use this pairing flow. As with any network connection, the service receives your IP address. For security and abuse prevention, it uses HMAC identifiers derived from the IP address. Technical logs include that HMAC identifier, the route, method, status and duration of the request; they do not include the request body.

On the pairing page, you enter your chosen playlist name, server URL, and your provider's username and password. If you pair through the authorised Telegram bot, you select one of the accounts already available to you there; the bot sends that account's configuration to the pairing service. In either case, the configuration is encrypted at rest and kept only for the time needed to deliver it to your device: the code expires after 10 minutes, the configuration after 5 minutes and the acknowledgement after 2 minutes. Credentials and temporary tokens are purged after acknowledgement, cancellation or expiry. Technical logs do not contain request bodies, credentials, codes, complete URLs or authorisation headers.

Movie and series metadata

Supported Android and Windows builds request discovery and detail data from The Movie Database (TMDB) through extraTV's bounded metadata proxy; they do not contain a TMDB credential or call the TMDB API directly. A typed request may contain a movie, series or person TMDB identifier, a title or person search, and the year, language, genre, sort and page needed for the requested view. It does not contain provider credentials, the provider URL, playback history, favourites or local searches unrelated to that request. TMDB receives the query and this server's IP address, not your device's metadata token.

Public artwork may be loaded directly from image.tmdb.org. That image host receives your device's IP address and standard request data, but the download does not include provider credentials or the metadata token. If you choose an external trailer, the selected external service receives the request under its own policy. This product uses the TMDB API but is not endorsed or certified by TMDB.

Pairing provides a random bearer limited to metadata enrichment and discovery. The server stores only its HMAC digest, expiry, revocation state and coarse last-use time, without linking it to the session, account, provider or queries made. The normalized metadata cache is shared globally and does not record which token requested each entry. Authorisation headers, request bodies containing titles and parameters sent to TMDB are not included in access logs.

A closed internal test may use a separate, short-lived and revocable test credential. This is not the provisioning mechanism for a generally distributed build.

Windows server assignment and updates

Windows Preview retrieves an administrator-controlled server assignment and update metadata from Google Firebase. Google receives the device IP address and standard technical request data. extraTV does not intentionally send the provider username or password, playback history, favourites or searches to Firebase. A retrieved server assignment is protected locally with DPAPI CurrentUser. Installer downloads use HTTPS and are checked against the declared file size and SHA-256 digest; publisher signing remains a requirement before general distribution.

Purpose and legal basis

Pairing, configuration delivery, metadata enrichment and discovery, server assignment and update delivery are processed to provide the features you request (Article 6(1)(b) of the GDPR). HMAC identifiers, usage limits and technical logs are processed on the basis of the legitimate interest in protecting the service, preventing abuse, investigating faults and maintaining its security (Article 6(1)(f) of the GDPR). extraTV does not use this data for advertising, tracking across apps or websites, profiling or automated decision-making.

Retention

• Pairing secrets are purged when the session is acknowledged, cancelled or expires, within the short periods stated above.
• Operational records for consumed, cancelled or expired sessions and their technical markers are deleted within a maximum of 30 days.
• A normal anonymous metadata token expires after one year; its digest is deleted on expiry or revocation, with a maximum operational margin of 30 days. Internal test credentials have a shorter expiry.
• The global metadata cache is normally refreshed every 24 hours, and its fallback copy is deleted after 7 days.
• Technical logs are retained for 14 days.
• Local backups, which have restricted access and are not public, are retained for 14 days and then deleted through scheduled rotation.

External providers and recipients

The technical infrastructure for hosting, security, backups and email may process the data strictly necessary to provide those services, under the applicable instructions and contractual measures when acting as a data processor. Google Firebase receives the Windows assignment and update requests described above. TMDB receives only the metadata queries described above; its image host and any trailer service receive only the direct requests described above, each under its own privacy policy. Personal data is not sold.

The app connects directly to the server you choose. That provider receives your IP address and the technical and access data needed to respond, under its own terms and policy. extraTV does not control that provider, does not act as a video proxy and does not include content.

International transfers

The location and processing activities of your chosen provider depend on that third party and its own policy. If a technical provider contracted by extraTV were to process data outside the European Economic Area, a mechanism recognised by the GDPR would apply, such as an adequacy decision or appropriate safeguards, including standard contractual clauses where applicable. You can request current information by writing to the privacy contact.

Your rights

You may request access, rectification, erasure, restriction or portability, or object to processing where applicable. To do so, write to privacy@extratv.fans and provide the information needed to locate your request; proportionate identity verification may be requested. We will respond without undue delay and within one month at the latest, unless a legally permitted extension applies, which will be communicated within that first month.

You may also lodge a complaint with the competent data protection authority. Most playback data is stored only on your device and can be deleted using the option to unlink and delete local data.

Changes

If this policy changes materially, the updated version will be published on this page with its new effective date.

Effective date: 11 September 2026.