Legal
Privacy
Contents12 sections
| Data | Where | How long | How to delete |
|---|---|---|---|
| Without an account: sources, passwords, list, resume positions | Only on your device | Until you delete them | Delete the source or remove the app |
| Account: identifier, sign-in, e-mail | Our server (Türkiye) | While your account exists | Delete the account |
| Synced sources (password encrypted) | Our server | While your account exists | Delete the source. For the password only, turn off “Other devices” (Android: “Do not keep it on the server”) |
| Favourites, resume positions, settings, devices, membership | Our server | While your account exists | Delete the account |
| Diagnostic counts | Our server | 90 days | Turn off “Send diagnostics data”; deleted at once when you delete the account |
| Requests to the server: IP address, time, requested address | Our server | 14 days | Automatic |
| Backup of deleted data | Encrypted nightly backup | 14 days at most | Automatic |
- No ads, no tracking identifier, no third-party analytics.
- No cookies and no visitor tracking on this website.
1Without an account
If you do not open an account, everything below stays only on your device and is not sent to us. The only thing that reaches us is anonymous daily technical counts, which you can switch off (section 6).
- Source details (the name you give, the M3U address or the Xtream server and username): in the app's database on your device.
- Passwords and tokenised addresses: in the Keychain on iPhone and iPad, encrypted with the Android Keystore on Android. They are never written to the database, the logs or the measurement text you export.
- Your channel list, search index, film and series catalogue, resume positions: on your device.
2With an account: what the server keeps
If you open an account and use sync between devices (Premium), our server keeps:
| Data | Why |
|---|---|
| Account identifier, sign-in provider (Apple, Google or e-mail), the e-mail that provider gives us | Sign-in. If you use Apple's “Hide My Email”, we only get that relay address. |
| If you sign in with Google: the account number Google gives us (an identifier that does not change), your Google account's e-mail address, and whether Google has verified it | Sign-in; and, if you already have an account with that address, offering it to you — no accounts are joined without your yes. We receive nothing else from Google: not your name, your photo, your contacts or anything else in your Google account. (On Android, the sign-in token Google issues also carries your name and the address of your profile photo; we neither read nor keep them.) |
| Your devices: the name you give, platform, model, app version, last seen | So you can see your devices and sign one out remotely |
| Source definitions: name, kind, address, username, password | So the source opens on your other devices. The password and any tokenised address are held in an encrypted envelope (section 3). |
| Favourites, resume positions, channel preferences, settings, profiles | Sync |
| Membership: plan, status, expiry date, store | To know whether Premium is active |
Access logs: requests that reach the server (the app's sync and sign-in requests, and this website's pages) are logged with their IP address, time and requested address, for security and fault finding; these logs are deleted automatically after 14 days. Diagnostic data and problem reports are not part of this log.
What the server does not keep: the channel list itself and the programme guide. Every device fetches them straight from your provider. Our server is not in between, carries no stream and touches no stream.
3Protecting your source password
- The password is encrypted with AES-256-GCM. The key is not in the database; it exists only in the environment the service runs in. A database dump, a nightly backup, a replica or a hand-written SQL query returns only encrypted data.
- Every record has its own random value. The envelope is bound to its account and source; a record copied into another account will not open.
- Without the key the service does not start. The password cannot end up written in plain text.
- Your password never enters a log line, an error message, a metric or a trace. On the network it travels only inside TLS.
- The limit: because the key is in the service's environment, the running service can decrypt these details. This is not end-to-end encryption.
- If you would rather not: on iPhone and iPad turn off the source's “Other devices” switch; on Android choose “Do not keep it on the server”. Then only the source's name and kind go to the server and the password stays on that device. Your other devices ask for it once.
This is what lets a source you add on your phone open on your TV.
4Connections
| Connection | What happens |
|---|---|
| Your provider | For playback the app connects only to the provider you enter. Like any IPTV server, it sees your IP address and which channels you request; its privacy policy applies there. Channel logos and posters load from the addresses it gives, too. |
Sotto server (api.) | Sync if you have an account; diagnostic counts if they are on. The app talks to no other server of ours. |
| Sign in with Google | The sign-in screen is Google's (Google's own page on iPhone and iPad, Google Play services on Android), and Google's privacy policy applies there. Google learns that you signed in to Sotto; we send Google nothing about you. |
| Google Cast (Android) | If you use Google Cast to send to another screen, Google keeps Cast's own technical logs under its own terms. |
5Payment
The subscription is sold by Apple or Google, and the payment goes through them. We never see your card number, billing address or payment details. The store only tells us your account's membership status (plan, status, expiry). The three free months on a new account come from us, not the store, and no payment details are asked for them.
6Ads, diagnostics, cookies
The app has no ads, no tracking identifier and no third-party measurement tool. Nobody follows you across apps and websites. This website sets no cookies and does not track visitors.
Diagnostic counts. So we can see why streams stall, the app sends technical counts once a day, and nothing else.
Sent
- Minutes played, how often playback stalled and reconnected
- How long playback stalled and the likely cause (e.g. “the provider is sending no data”)
- A one-way code made from your provider’s server name (not the name itself), with watching and stall times by hour
- How many milliseconds the first picture took
- The error code of a stream that would not open (e.g. 403, timeout)
- Player engine and audio format
- Playlist and guide download times, sync results
- App version, device model, operating system version
Never sent
- Channel, film, series, category or source names
- Stream, playlist or guide addresses
- Usernames and passwords
- Your IP address (not stored)
- With an account the counts are kept linked to your account and device, so we can see what happened when you report a problem.
- Without an account the counts are anonymous: not linked to an account, a device identifier or any lasting identifier; they only add to totals.
- Counts are deleted after 90 days, and at once if you delete your account.
- To switch off: the “Send diagnostics data” switch in the app's “Data and support” section. While it is off, nothing is counted or sent.
- The last 10 minutes stay on your device. So it can tell you on screen why the picture froze, the app keeps the last 10 minutes of playback measurements (download speed, buffer, stalls, error codes; no address, no channel name) in the device’s memory only. That detail is sent only if you tap “Report a problem” while “Send diagnostics data” is on.
- The provider code answers “is everyone on this provider stalling tonight?”. The address never reaches the server and cannot be worked back from the code; but someone who knows the provider’s name can make the same code and compare. So we treat it as a pseudonym, not as anonymous.
- If you tap “Report a problem”, the counts of that moment and the short note you write are sent, and, with diagnostics on, the last 10 minutes of playback measurements too. The code on screen lets us help you. Please keep personal information out of the note.
7Beta (TestFlight)
While you try the iPhone and iPad beta through TestFlight, Apple collects crash reports and basic testing data under its own rules. If you send feedback from TestFlight, your text and any screenshot reach us through Apple. That data is governed by Apple's privacy policy.
If you e-mail us directly, what you write and your e-mail address are used only to solve your problem.
8Deletion
- Removing the app deletes everything it keeps on the device: sources, passwords, list, resume positions. For a single source, deleting it in the app is enough.
- With an account, deleting a source also destroys its encrypted envelope on the server in the same step. Deleting the account removes every row held for it. How: account and data deletion.
- Deleting your account deletes the Google sign-in record too; you can remove Sotto's access in your Google Account under Security › Third-party connections.
- Deleted data stays in encrypted nightly backups for 14 days at most; then the backup rotates too.
- Our server never connects to your provider on its own with your source details. It only hands them to the verified devices on your account.
9Children and adult content
Sotto is not aimed at children and does not knowingly collect data from them. What it plays comes from your provider, is unfiltered and cannot be known in advance. The store age rating is 18+.
If your source marks an item as adult content, Sotto hides it by default. To see it you set a PIN in the app and enter it. The lock comes back when the app closes. With no PIN set, the content stays hidden.
This is a child lock, not a security boundary. A short PIN is easy to guess, and the marking depends on your provider; no filter can recognise a stream your provider did not mark.
10Controller and your rights
Data controller: Ekrem Sekman (a natural person, not a company). Contact: help@sottoiptv.com. This is who you deal with under KVKK (Türkiye's data protection law) and the GDPR.
| Data | Legal basis |
|---|---|
| Account data: e-mail, devices, source definitions, favourites, resume positions, membership status | Performance of the contract: giving you the service you asked for |
| Security records (e.g. the sign-in attempt counter, the 14-day access logs) | Legitimate interest: stopping brute-force attempts and finding faults |
| Diagnostic counts | Legitimate interest: seeing that the service works and solving the problems you report. You can switch them off at any time. |
Without an account nothing linked to you is processed; only anonymous daily counts arrive.
How long: as long as your account exists. There is no fixed period, because the point of this data is to give your sources back to you. Deleting the account or a single source really deletes it; it stays in encrypted nightly backups for 14 days at most.
Your rights: to access your data, correct it, delete it, receive a portable copy and object to its processing. Deletion works in the app and on the account and data deletion page. For anything else, write to help@sottoiptv.com; we answer within 30 days at the latest.
Right to complain: in Türkiye to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu), in the European Union to the data protection authority of the country you live in. You do not need to write to us first.
11Where the server is
Our account and sync server is hosted in Türkiye. If you live in the European Union, your data goes directly from the app to this server in Türkiye, so it is processed outside the EU; there is no intermediary or other recipient in between. Türkiye is not covered by a European Commission adequacy decision; your rights under the GDPR apply in full.
What is transferred is limited to what section 2 lists. Your channel list, search index and guide data never go to the server. Without an account, the app sends nothing linked to you to the server.
12Changes and contact
If this text changes, the date at the top changes with it. Questions and requests: help@sottoiptv.com.