Privacy policy

The short version

Nova Stream is a player. We do not host video. We do not sell your data. We do not place advertising trackers. The only personal data we hold is what we need to give you an account that follows you between devices.

What we collect — exhaustive list

• Account: email address and a salted PBKDF2 password hash. We never see your plain-text password.
• Settings blob: the M3U / EPG / Xtream URLs you typed into the app, your display preferences, parental-control settings, list of recently watched titles, and scheduled recordings. This is the data that synchronises across your devices.
• Session cookie: a random 32-byte token that identifies your device as signed in. HTTP-only, Secure, SameSite=Strict. 30-day lifetime.
• Diagnostic logs: when a request fails on the server, we log the URL path, HTTP status, and IP address for up to 7 days so we can debug the issue. We do not log request bodies.

What we don't collect

Microphone, camera, contacts, browsing history outside the app, third-party analytics SDKs (no Google Analytics, no Facebook Pixel, no Sentry user identifiers). We do not place advertising trackers. We do not log the URLs of the video segments your player fetches from your provider — those requests, when going through the proxy, are streamed and never written to disk on our side.

Where it lives

All server-side data is stored in Cloudflare KV, a globally replicated key-value store operated by Cloudflare, Inc. on our behalf. Cloudflare is a sub-processor under their Customer Data Processing Addendum. If you are in the EU/EEA we can on request configure your account to use a KV namespace pinned to EU jurisdiction.

How long we keep it

Your account and settings stay until you delete them. Session cookies expire after 30 days of inactivity. Diagnostic logs roll off after 7 days.

Your rights (GDPR Articles 15–22)

• Access & portability (Art. 15 / 20): click Settings → Help & legal → Export my data to download a JSON file containing everything we hold on you. Available immediately, not in 30 days.
• Erasure (Art. 17): click Settings → Help & legal → Delete my account. Your account, settings, sessions, and all derived data are removed within 30 days. Anonymised aggregate metrics (e.g. total daily active users) are retained.
• Rectification (Art. 16): edit any field directly in Settings, or write to privacy@novastream.tv.
• Complaint (Art. 77): you have the right to lodge a complaint with your local data-protection authority. In Israel that is the Privacy Protection Authority; in the EU the relevant national supervisor.

Children

The service is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has created an account, write to privacy@novastream.tv and we will delete it.

Changes to this policy

If we change this policy materially we will notify you in the app at least 30 days before the change takes effect.

Contact

privacy@novastream.tv — for any question about this policy or to exercise your rights.