Privacy policy

This policy explains what personal data FlickX Player (“FlickX”) processes when you use the apps, the device portal and this website. We collect as little as possible: there are no user accounts, no ads, no analytics or tracking cookies, and we do not sell data.

Who is responsible

The controller is FlickX, [legal entity, address], the Netherlands, KvK [KvK number]. Contact for privacy questions: [email protected] or Contact.

What stays on your device

The sources you add in the app (server address, username, password or M3U link), the downloaded catalogue, your parental PIN (as a hash), downloads and settings are stored on your device, encrypted where the platform supports it. When you play something, your device connects directly to your provider; we do not see those streams. Signing in with your phone (QR code) happens directly between your phone and your TV on your home network.

What we process on our server

• Device data: a device identifier created by the app (on Android based on the system’s app-specific ID, on macOS a hash of the hardware ID), the FlickX MAC address derived from it, the device name and model, platform, app version, trial and activation dates, when the device last checked in, and on Android a fingerprint of the app’s signing certificate. Purpose: provide the trial and licence, prevent abuse. Legal basis: performance of the contract, and our legitimate interest in preventing fraud.
• Device key and secret: stored only as one-way hashes. Counters of failed sign-ins, reinstalls and lock-outs. Purpose and basis: security (legitimate interest).
• Playlists you add on the website: name, type, and the server, username, password or M3U link, encrypted, sent only to the device they belong to. Basis: contract.
• Library sync: your favourites, playback progress and watched status (item IDs, titles, poster links, season/episode, position, time of change), stored under a one-way hash of your provider login so we never see the login itself. These entries are not yet encrypted on our server. Deleted entries are kept for 90 days so your other devices can catch up. Basis: contract (the sync feature). This only applies to Xtream Codes logins.
• Subscription and payment: your email address, Stripe customer ID, subscription status and period, and the payment events Stripe sends us. Card details are handled by Stripe and never reach us. Basis: contract, and our legal obligation to keep accounting records.
• Website sign-in: a session ID (stored as a hash) and, temporarily in memory, your IP address to limit sign-in attempts. Basis: legitimate interest (security).
• Security log: events such as device registration, sign-ins, lock-outs, playlist changes and licence changes, linked to the device, without IP addresses. Basis: legitimate interest (security and support).
• Download statistics: when you download an app through our site we count the time, platform, a source tag and the country reported by Cloudflare. No IP address is stored.
• Support: what you send us when you contact us. Basis: contract or legitimate interest.

Processors and other recipients

• Stripe (payments, invoices, billing portal, tax calculation). Stripe may process data in the United States under the EU–US Data Privacy Framework and standard contractual clauses. For some purposes (such as fraud prevention) Stripe acts as an independent controller; see Stripe’s privacy policy.
• Cloudflare (network, security, the tunnel to our server and the Turnstile check on the sign-in page). Cloudflare processes IP addresses and technical data and may transfer them outside the EU under the EU–US Data Privacy Framework and standard contractual clauses.
• Our server and backups run on hardware we manage in [country, presumably the Netherlands].
• [Email provider, once transactional email is used.]

We do not share data with anyone else, unless the law requires it.

Cookies and similar technologies

We use one strictly necessary cookie: the session cookie set after you sign in with your MAC address and device key. It expires after two hours or when you sign out. The Turnstile check on the sign-in page is loaded from Cloudflare to block automated sign-in attempts; Cloudflare may use technical data from your browser for that. We use no analytics, advertising or tracking cookies, so we do not ask for cookie consent.

How long we keep data

• Device, playlist and library data: as long as the device uses FlickX. [Planned: deleted after [24] months without any check-in.] You can delete playlists yourself on the dashboard at any time.
• Website sessions: two hours. Security log: about 13 months (400 days). Sign-in attempt counters: in memory, at most a day.
• Library entries you remove: 90 days.
• Customer and payment records: 7 years, as Dutch tax law requires.
• Backups: up to 30 days.

Your rights

You can ask for access to, correction or deletion of your data, restriction of processing, a copy in a portable format, and you can object to processing based on our legitimate interest. Because there are no accounts, we will ask you to prove that you control the device (for example with its MAC address and device key). Send your request to [email protected] or through Contact; we answer within one month.

You also have the right to complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the authority in the EU country where you live.

Security

Connections are encrypted (HTTPS). Playlist logins are encrypted at rest, device keys and session IDs are stored only as hashes, and access to the server is restricted.

Children

FlickX is not aimed at children under 16, and a subscription can only be bought by an adult.

Changes

We will update this page when our processing changes and show the date at the top.