Privacy Policy

Which apps this covers

The Android TV app, the Samsung smart TV app and the LG smart TV app. They are media players: you supply a playlist you already have, and they play it. They are not affiliated with any broadcaster and they carry no channels of their own.

The phone and tablet app is a different program with a different policy. Use the button above to read it.

Who we are

These apps and this website are run by Smart Queen Labs, which operates worldwide. You can reach us at squeenlabs@gmail.com or through the contact form on this site.

Our server and this website are hosted by Hostinger, whose servers hold the data described below on our behalf.

Information we collect

A device identifier

The first time the app starts, our server creates an identifier and a separate key for the device and sends them to it; the app keeps both. (Older versions of the app built the identifier on the device itself, from a piece of the device's own ID run through a one-way cryptographic hash.) The identifier is shown in the app as a "MAC address", because that is what activation pages everywhere expect, but it is not your device's real network hardware address: it cannot be used to find your device on a network, and a new one is created if the app's storage is wiped, for example by a factory reset. That identifier and key are sent to our server at smartqueenlabs.com when the app starts and when it returns to the foreground, along with the device model and the app version.

It is used for four things: checking whether your trial or licence is still active, letting you sign in to your device page on this website, telling you when a newer version exists, and knowing what device and version you are on if you contact us about a problem.

Crash reports

When the app closes unexpectedly it sends a short report to our own server: the identifier and key above, the app version, the error, and the last lines of the app's own log, with playlist credentials removed first. Nothing goes to Google or to anyone else. Crash reports have no automatic expiry: they stay until we delete them, and we delete yours when you ask.

The Android TV app also keeps its last few reports in its own private folder on the device, so one can be read off the box directly if you ask us for help.

Your playlist details

There are two ways to set the app up. If you type a playlist into the TV app, its address, username and password are also copied to our server, stored encrypted, so your device page can show and restore them; they are deleted when your device record is deleted. If instead you scan the code shown on the television and type the same details on this website, they are stored on our server so the app can collect them. Either way, it only happens with details you typed yourself.

Connection history, to protect licences

Each time the app checks in, our server notes the internet (IP) address it came from, the approximate country that address belongs to, the app version and the time. This history is kept for 30 days and then deleted. It is used only to protect licences: to notice one licence being used on several televisions at once, to limit free trials to three a day per internet address, and to slow down anyone guessing device codes. Records of wrong codes and failed sign-ins keep the address for one day. Security alerts that name an address are kept for up to 90 days. None of it is shared with anyone, except that an address the device has not used before is sent, over an encrypted (HTTPS) connection, to a geolocation service to find its country (see Sharing and third parties).

Nothing else

From the app itself we do not collect your name, email address, phone number, physical location, contacts, photos, or anything about what you watch. (If you buy a licence on this website, PayPal gives us an email address for your receipt — see Purchases.) There is no account and no password: the app never asks for one.

Also recorded

A licence order placed on this website is stored with the full internet (IP) address it came from. So is each crash report, which also carries the television's firmware version and screen size. A message sent through the contact form is stored with the name (if you give one), email address and message you typed, and the IP address it came from. A reseller's credit purchase is stored with the IP address it came from and the email address PayPal gives us for the receipt.

The device record keeps the model name the television reports, which kind of television it is (Android TV, Samsung or LG), the app version and the country it first connected from.

It can also carry two flags, used only to protect licences and only ever reviewed by a person: whether the app reported itself as a modified copy, or as having data copied over from another television, and whether the device appeared to be shared between several internet connections at once.

This website keeps a few things in your own browser, not on our server: your device sign-in (its MAC address and key), a copy of your device's details so its page opens quickly, your language choice, your answer to the analytics notice, and, for the current tab only, a draft of the playlist form so a reload does not lose what you typed.

When you add a playlist on this website, our server signs in to your playlist provider once, with the details you typed, to check that the playlist works before it is saved.

This website's typefaces are loaded from Google Fonts, so your browser fetches them from Google's servers, which see your IP address as with any web request.

What stays on your device

Your playlists, including any saved username and password, along with the channel list, programme guide, favourites, recently-watched channels and an optional parental-control PIN, are stored on your device. On Android they are encrypted with the device's own secure hardware keystore. On a Samsung or LG set, which has no keystore an app may use, they are kept in the app's own private storage that no other app on the set can read. If you type a playlist into the TV app, its address, username and password are also copied to our server, stored encrypted, so your device page can show and restore them; they are deleted when your device record is deleted. Apart from that, none of it is backed up to any cloud service by the app.

Permissions these apps ask for

• Internet access — required to load your playlist and stream content.
• Network state — Android TV: to detect whether the device is connected.
• Keep the screen awake — Android TV: so the screen does not dim while a channel plays.
• Microphone — Android TV: only if you press the voice-search button, and only while you are using it. Samsung: dictation through the remote's own microphone button, handled by the television. LG: not used.
• Install packages — Android TV only: so an update it has downloaded can be installed when you accept it.
• Private storage on the set — Samsung and LG: to cache a large playlist in the app's own private files.

No app requests access to your contacts, photos, camera, location or shared file storage.

Purchases

A licence for these apps is bought on this website through PayPal. You can pay with a PayPal account, with a debit or credit card, or with Google Pay, which runs through PayPal's checkout. Paying by card or Google Pay needs no PayPal account.

PayPal handles the payment, and the security of it is theirs. A card is typed into PayPal's own checkout, which they operate and secure to the card industry's standards — not into a form on this site, and not into anything we built. We never see, receive or store a card number, an expiry date, a security code, or your PayPal password. There is nothing of your card on our server to lose.

What reaches us is the confirmation that a payment succeeded, the plan it was for, and the email address PayPal gives us so a receipt can be sent to it.

A licence can also come from a reseller, who activates your device from their own page using the two codes the app shows you.

Resellers

If you apply to become a reseller, the details on the application form — name, company, email, phone, country, website and how you sell — are stored with your application and, if you are accepted, on your reseller account for as long as it exists. Sign-in to your partner page is by a link we email: we keep a hashed link, never a password.

When you activate a customer's device, we record that device's address and its name against your account, with the date and the licence period it produced. The device key is checked, not stored. That record lets you see your own activations and lets us settle any dispute about which reseller activated which device. Your customers' details go nowhere else, and we do not contact them.

This website's own analytics

Separately from anything the app does, this website (smartqueenlabs.com) counts visits — which pages get looked at, roughly how long, from which country, on what kind of device. No account is needed and none of it is tied to your name. Your IP address is stored with its last portion blanked out before it is ever written down, so what is kept can no longer be traced to your connection, only to a rough area.

Counting a visit uses nothing of yours. No cookie is set, nothing is read from your browser and nothing is stored on your device, so it happens for every visitor. A random id, which would let a return visit read as the same person, does live in your browser — so a notice asks you first. Decline and no id is ever stored, and your visits still count the same anonymous way.

The country comes from a lookup. At the start of each visit, and when you download an app from this site, your full IP address is sent, over an encrypted (HTTPS) connection, to the geolocation service freeipapi.com (or, if it does not answer, api.country.is), which returns the country. Only the shortened address is stored afterwards, but the lookup itself receives the whole one.

Apart from that lookup, this data is never shared, never sold and never used for advertising.

Sharing and third parties

We do not sell your information and we do not share it with data brokers, or with anyone who would use it to build a profile of you. Our own server, hosted by Hostinger, receives what is described above. PayPal receives whatever a payment itself requires, and tells us back only the email address it came from, for the receipt.

Country lookup. To show which country a device or visit comes from, its IP address is sent to the geolocation service freeipapi.com (or, if it does not answer, api.country.is), which returns the country. This happens when a device registers, when a device checks in from an address it has not used before, when a device whose country is not yet known checks in or collects its playlist, at the start of each visit to this website, and when an app is downloaded from it. The full address is sent, over an encrypted (HTTPS) connection, and nothing else goes with it — no identifier, key, name or email address.

This website's typefaces come from Google Fonts, as described above. Apart from these, nothing is shared with anyone. These apps send nothing to Google.

How long we keep it, and how to delete it

Data on your device is under your control at all times: clearing the app's data, or uninstalling it, removes it completely.

On our server, a device record — the identifier, key (as a one-way hash), model, version, country and licence dates — and any playlist you added through this website or the app stay while the device keeps checking in, and are kept after it stops until they are deleted. The connection history described above is deleted after 30 days, records of wrong codes and failed sign-ins after one day, and security alerts after 90 days.

When you ask us to delete your device, we remove its device record and its playlists from our server.

What is kept, and why:

• A small record of the deleted device — its identifier, name, model, kind of television, country, trial and licence dates, whether it was paid for, and its key as a one-way hash. It has no expiry. It exists so that if the same television installs the app again, it gets back the paid licence it already had, and a free trial is not given to it a second time. It is removed when that television comes back.
• Payment records — the order, with its receipt email address and the IP address it came from — kept for our accounts. The receipt email is used for nothing except that receipt and any support conversation about it.
• Crash reports and contact-form messages — these have no automatic expiry. They stay until we delete them, and we delete yours when you ask.
• Our own records that name the device — the log of changes we made to it, the record of which app updates reached it, and, if a reseller activated it, that reseller's activation record.
• The connection history is not removed at once, but it expires on its own after 30 days.

Our server takes a backup copy of its database, normally once a day, and keeps only the 14 most recent, so a deleted record drops out of the backups within about two weeks. If a payment fails, our server's private error log may record PayPal's reply about it; that log is read only by us and is overwritten as it grows.

Your rights

You can ask us to show you the data we hold about your device, to correct it, to delete it (with the exceptions above), or to send you a copy of it. Write to squeenlabs@gmail.com or use the contact form on this site, and include the MAC address shown in the app so we can find your device. We answer within 30 days.

You can also complain to the data-protection authority in the country where you live.

Security

This website and our server are reached only over HTTPS, and the country lookup described above is made over HTTPS too. Playlist logins held on our server are stored encrypted. Your device key is stored only as a one-way hash, so it cannot be read back from our database. Payments are handled by PayPal, and we never see your card details. Our admin panel needs both a password and a code from an authenticator app to sign in.

No system is perfectly secure, but these steps limit what anyone could read or misuse.

Children's privacy

These apps are not directed at children and are not meant for anyone under 16 without a parent's involvement. We do not knowingly collect information from children. If you think a child has sent us information, contact us and we will delete it.

Which law applies

This policy applies wherever you use the apps or this website. As in our terms of use, the consumer-protection and data-protection law of the country where you live applies, and nothing here removes rights your local law gives you.

Changes to this policy

If anything here changes, we'll update the date at the top of this page. We'd encourage checking back occasionally if you'd like to stay current.

Contact us

Which app this covers

The Android phone and tablet app, downloaded from Google Play. It is a media player: you supply a playlist you already have, and it plays it. It is not affiliated with any broadcaster and carries no channels of its own.

It has no connection to our server or to this website. Nothing you do in this app reaches us: no identifier, no licence check, no crash report, no playlist, nothing. We could not tell you whether you use it. Everything described below that leaves the device goes to Google, and goes there because the app is a Play app.

The television apps are different programs with a different policy. Use the button above to read it.

This app never contacts our server

It does not register, does not check a licence with us, does not fetch anything from this website and does not report that it is running. Your subscription is checked with Google Play, which tells the app whether you have one without us being involved. We therefore hold no record of you from this app at all. If a future version starts contacting our server, this policy will say so before it does.

Information collected, and by whom

Crash reports and usage statistics — to Google

When the app closes unexpectedly it sends a report to Google Firebase Crashlytics so the fault can be found and fixed. The report contains the error, the part of the program it happened in, your device model, your Android version and the app version. It does not contain your name, your email address, or anything about what you were watching.

Your playlist credentials are removed before the report is sent. A fault in the player can quote the address it failed on, and those addresses contain the username and password of your IPTV subscription, so the app strips them out and replaces them with asterisks.

The app also sends basic usage statistics through Google Analytics for Firebase: how often it is opened and for how long, and on what kind of device. This is counted in aggregate and is tied to no account, because there is no account. We never record which channels, films or programmes you watch. Both are subject to Google's privacy policy, and neither reaches our own server.

Advertising

This app is free and is paid for by advertising. Adverts are supplied by Google AdMob and appear only while you are browsing — beneath the film and series lists, and between sections. They never appear over a channel or a film you are watching.

To do this, AdMob uses your device's advertising ID: a resettable number Android provides for advertising, which you can reset or delete at any time in Android's own settings, under Privacy then Ads. AdMob receives it along with technical details about the device, and is subject to Google's privacy policy. We do not receive it and we never see who you are.

Where the law requires it — in the European Economic Area, the United Kingdom and Switzerland — the app asks your permission before showing personalised adverts, using Google's own consent form, and you may change that answer later. If you refuse, the app shows no adverts at all — it does not fall back to unpersonalised ones, because without your agreement it never starts the advertising system in the first place. You can change that answer later from the app's Settings.

Subscribing removes them. With an active subscription the app requests no adverts at all, and your advertising ID is not used.

Your playlist details

Whatever you type into this app — playlist address, username, password — is encrypted and kept on your own device, and is sent only to the IPTV provider you chose. It never reaches us, because this app does not contact us at all.

Nothing else

We do not collect your name, email address, phone number, physical location, contacts, photos, or anything about what you watch. There is no account and no password: the app never asks for one.

What stays on your device

Your playlists, including any saved username and password, along with the channel list, programme guide, favourites, recently-watched channels and an optional parental-control PIN, are stored on your device only, encrypted with the device's own secure hardware keystore. None of it is backed up to any cloud service by the app.

Permissions this app asks for

• Internet access — required to load your playlist and stream content.
• Network state — to detect whether the device is connected.
• Keep the screen awake — so the screen does not dim while a channel plays.
• Microphone — only if you press the voice-search button, and only while you are using it. If you never press it, the microphone is never accessed.

It does not request access to your contacts, photos, camera, location or shared file storage.

Purchases

The subscription is bought inside the app through Google Play and handled entirely by Google Play's billing system. We never see or store your card details or any other payment information, and Google's own terms and privacy policy apply to that purchase. A licence bought on this website does not apply to this app, and this app cannot be paid for on this website.

This website's own analytics

This section is about visiting smartqueenlabs.com in a browser, and nothing else. The app is not involved in any of it and sends us nothing. If you never open the website, none of this applies to you at all.

The website counts visits — which pages get looked at, roughly how long, from which country, on what kind of device. No account is needed and none of it is tied to your name. Your IP address is stored with its last portion blanked out before it is ever written down, so what is kept can no longer be traced to your connection, only to a rough area.

Counting a visit uses nothing of yours. No cookie is set, nothing is read from your browser and nothing is stored on your device, so it happens for every visitor. A random id, which would let a return visit read as the same person, does live in your browser — so a notice asks you first. Decline and no id is ever stored, and your visits still count the same anonymous way.

The country comes from a lookup. At the start of each visit, and when you download an app from this site, your full IP address is sent, over an encrypted (HTTPS) connection, to the geolocation service freeipapi.com (or, if it does not answer, api.country.is), which returns the country. Only the shortened address is stored afterwards, but the lookup itself receives the whole one.

Apart from that lookup, this data is never shared, never sold and never used for advertising.

Sharing and third parties

We do not sell your information and we do not share it with data brokers, or with anyone who would use it to build a profile of you. Google receives the advertising ID for AdMob, and the crash reports and usage statistics described above. Our own server receives nothing from this app. Apart from the website's country lookup described above, nothing else is shared with anyone.

How long we keep it, and how to delete it

We keep nothing from this app, because it sends us nothing. Data on your device is under your control at all times: clearing the app's data, or uninstalling it, removes it completely. What Google holds — crash reports, usage statistics and the advertising ID — is governed by Google's own policy, and your advertising ID can be reset or deleted in Android's settings at any time.

Children's privacy

This app is not directed at children, and we do not knowingly collect information from children.

Changes to this policy

If anything here changes, we'll update the date at the top of this page. We'd encourage checking back occasionally if you'd like to stay current.

Contact us