Zapio

Legal

Privacy Policy for Zapio on Android and Fire TV

Last updated: 2026-11-05

This policy applies to Zapio on Google TV, Android TV, Fire TV, Android phones and tablets (Google Play and Amazon Appstore). For iPhone, iPad and Apple TV, the privacy policy of the Apple apps applies.

Controller

Andreas Klundt, Rieheweg 1, 32469 Petershagen, zapio.app@proton.me

In short

Zapio has no account and no server of its own. There are no ads, no analytics, no tracking and no crash reports to us – the app contains no analytics, crash-reporting or advertising SDK. What you enter or save in the app stays on your device – login details always; favorites, progress and settings only if Android backup of your Google account is turned off (see “Backups and deletion”). To work, the app connects directly to the services listed below.

What is stored on your device

  • Encrypted with a key from the Android Keystore: your playlist address or Xtream account (server, username, password), a guide address of your own, the parental control PIN and the start of the trial. The key never leaves the device.
  • In the app’s catalog database: channel lists, movies, series, guide data, favorites and viewing progress. This includes the stream addresses of all channels and titles; for Xtream accounts they contain – as the providers’ format requires – your username and password. The database lives in the app’s protected storage, which other apps cannot access.
  • In the app’s settings: your settings, the list of your sources, hidden languages, locked categories, whether kids mode is on, its daily limit and the time watched today, recently watched channels.
  • Cache: channel logos and posters, so they don’t have to be loaded every time. Android may clear it on its own.

Zapio does not send any of this to us.

Backups and deletion

Zapio uses Android backup (your Google account, “Backup” in the device settings) only for user data without login details: the IDs of saved favorites, progress and “watched” marks, hidden languages, locked categories, picture format and version per channel, and which hints were already shown. Login details, stream addresses, TV guide addresses, the PIN and the start of the trial are excluded. The data is linked to an account via a hash of server and user name, not the address itself. Google stores the backup encrypted in your Google account; whether backups are made is up to your device settings. After reinstalling, Zapio restores the data as soon as you set up the same account. Fire TV and the Amazon Appstore do not have this backup. When you remove a source in the settings, the app deletes its login details, its catalog with all stream addresses, its guide, progress and “watched” marks; only the IDs of saved favorites may remain in the database. When you uninstall Zapio, Android removes all of the app’s data, including the key in the Keystore.

Who the app talks to

With every connection, the server sees – as with any internet connection – your IP address, the time and technical details of the request. Zapio does not send identifiers of your device or details about you to any of these services.

  • Your provider (the servers whose address you enter): when loading the channel list, catalog and guide, and during playback. Your login details and the channels and titles you choose are transmitted. The same applies to a guide address of your own.
  • Images from your list: Zapio loads channel logos and posters from the addresses in your list. Only the request for the image is transmitted.
  • Free-to-air channels in Germany: The list (ARD, ZDF, regional channels and other free-to-air channels) is built into the app. Only when you use it (“Load free channels from Germany” or Settings → “Free-to-air channels”), the streams come directly from the broadcasters’ servers or their delivery networks (e.g. ard-mcdn.de, ndr.de, br.de, Akamai, 3Q) and the channel logos from Wikimedia Commons (upload.wikimedia.org). Only the request is transmitted – no login details, nothing about your channel list.
  • iptv-org (iptv-org.github.io, GitHub Pages): only with “Try with free channels” in countries without a built-in list, the public channel list for your country. The streams and logos of these channels come directly from their servers, whose addresses are in the list. Only the request is transmitted.
  • Free TV guides (epgshare01.online): only if you switch one on (Settings → “Guide URL” → “Free Guides”; the app asks first). Zapio then downloads the guide file for the chosen countries. Only the request for the file is transmitted – no login details, no channel list, no identifier. The service does not say where its server is located; it may be outside the EU.
  • Other devices on your network: only with “Send to TV” (phone) and “Send from phone” (TV). The phone sends the active account (address, user name, password, name, TV guide settings) directly to the TV on the same Wi-Fi – encrypted with a key derived from the code the TV shows, through no server and not over the internet. While the page is open, the TV announces itself with its device name on the home network (mDNS). Zapio does not use a camera for this; the phone’s camera app reads the QR code.
  • The TV’s home screen (Google TV, Android TV): Zapio adds started movies and episodes (title, image, position) and a few favorite channels to the “Continue watching” row. The system shows this row on this device; Zapio sends nothing to us. Nothing is added in Kids Mode or from locked categories.
  • Google Play or Amazon Appstore: trial, Full Version and monthly subscription. The trial runs only on the device. Purchases and subscriptions are handled by the store you installed Zapio from (Google Play Billing or Amazon In-App Purchasing); Zapio only learns whether you own the Full Version or a subscription and sends nothing about it to us. Google’s or Amazon’s privacy policy applies to the payment.

GitHub, Wikimedia, epgshare01 and the servers of the free channels receive no login details and nothing about your channel list. Their own privacy policies apply to their processing.

Crash reports

Zapio does not write crash reports of its own and sends none to us. If you have allowed your device to send usage and diagnostics data to Google or Amazon, the operating system may report crashes to its maker; this is governed by Google’s or Amazon’s settings and privacy policies. Through the store’s developer console we then see aggregated crash counts and technical stack traces, without details about you.

Transfers to third countries (USA)

GitHub (iptv-org.github.io), the Wikimedia Foundation (upload.wikimedia.org), Akamai, Google and Amazon are based in the USA. Where your provider, a guide address of your own, epgshare01 or the servers of the free channels are located depends on your choice. If a service is certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR). For the other services, your device connects directly, only when you use the feature in question. In the USA, authorities may in some cases access data without you having the same legal remedies as in the EU.

Connections to your provider, to iptv-org, to the free channels, to free TV guides and to the store serve the features you use in the app: Art. 6(1)(b) GDPR. The same applies to the transfer on your own network, the “Continue watching” row and Android backup; you can turn off backup in the device settings.

Children

Kids mode limits what is shown and counts screen time on the device only. It does not collect any data about children.

This website

This section covers the website you are reading. It is a static site with no accounts, forms or comments.

  • Hosting on GitHub Pages: The website is hosted on GitHub Pages, a service of GitHub, Inc., 88 Colton Street, San Francisco, CA 94107, USA. On every visit GitHub processes your IP address, the date and time, the page requested and details about your browser (such as browser type and operating system) in server logs to deliver the site and protect it against abuse and attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and available website. How long these logs are kept is governed by GitHub: GitHub’s privacy statement.
  • Transfer to the USA: GitHub is certified under the EU-US Data Privacy Framework (see www.dataprivacyframework.gov). The transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR).
  • No cookies, no analytics, no third-party content: The website sets no cookies, uses no analytics or statistics services and loads no fonts, scripts, videos or other content from third-party servers. We do not analyze visitor data.
  • Email links: Clicking an email address opens your own mail app; nothing is sent automatically. If you write to us, the section Support requests by email applies.

Your rights

We do not store any data about you from the app itself. If you email us, we use your address and message only to reply and delete them once the request is settled, at the latest twelve months after the last contact. You have the right to access, rectification and erasure, to restriction of processing and to data portability, and you can object to the processing (Art. 15–21 GDPR). Questions: zapio.app@proton.me. You have the right to lodge a complaint with a data protection supervisory authority.