Novara

Privacy Policy

For the Novara IPTV Player app on Android TV, Google TV and Fire TV, the app for Android smartphones and tablets, and the QR code setup on novaraiptv.com.

This is a translation for convenience. In case of discrepancies, the German version prevails.

1. Controller

The controller responsible for processing your data within the meaning of the General Data Protection Regulation (GDPR) is:

Code by MKUngargasse 1451030 Wien, AustriaEmail: support@novaraiptv.com

This privacy policy applies to the TV app (Android TV, Google TV, Fire TV), the app for Android smartphones and tablets, and the QR code setup on the website novaraiptv.com. Where the TV app and the smartphone app differ, this is stated.

2. Summary

Novara is a player: you bring the channels, movies and series, and the login details for them, from your own IPTV provider. You do not need an account with us, and your playlists and login details stay on your device – they are only sent to your IPTV provider. So that we can fix crashes and improve the app, it sends usage and error data to Google Firebase, but no login details, no profile names and no search texts. Other services are only contacted when you use the corresponding feature. There is no advertising, no advertising ID and no sale of data.

3. Data on your device

The app stores the following data only locally on your device:

  • Playlists including your login details (in an encrypted database)
  • Favorites, watch history and progress
  • Profiles including PIN
  • Settings

The app sends your login details only to your IPTV provider in order to retrieve the content. How your provider handles this data is governed by its own privacy policy. We only receive your login details if you use the cloud backup or the QR code setup (see section 5).

If you create a backup as a file (for example on a USB stick or SD card), that file stays with you. Please note: the file is not encrypted and may contain your login details. Keep it in a safe place.

4. Data that is always transmitted

The published versions of the app use services from Google Firebase (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and its parent company Google LLC, USA). This transmission always takes place; the app currently has no setting to turn it off. You can, however, object (see section 9).

  • Google Analytics for Firebase (usage statistics): a randomly generated app instance ID (not an advertising ID), device model, operating system and app version, language and the approximate country derived from your IP address; Google Analytics does not store the IP address itself. In addition, usage events: which areas of the app you use, the names of the channels and categories you open, playback duration, loading and buffering times, error codes, the type of your playlist (M3U, Xtream or Stalker), the setup steps, and the length – not the content – of your searches.
  • Firebase Crashlytics (crash and error reports): in the event of a crash or error, a technical report with the error trace (stack trace), device model, operating system, app version, memory usage, an internal profile number, the name of the channel and playlist in use, and the server name (host) of your IPTV provider – without login details.
  • Firebase Performance Monitoring (TV app only): measurements such as channel switching time, buffering interruptions and app start time, each with the device model. Network addresses are not recorded.
  • Firebase Remote Config (central settings): The app retrieves settings that we define centrally. The installation ID, app version, language and country are transmitted.
  • Firebase Cloud Messaging (notifications): The app receives a registration token from Google that could be used to send notices to the device. None of our own servers currently uses this token.

Not transmitted: your login details (they are technically filtered out of error reports), profile names, the text of your searches, an advertising ID, and location, contacts, camera or microphone data – the apps have no permission for location, contacts, camera or microphone.

5. Data transmitted only when you use a feature

The following services are only contacted when you use the corresponding feature. For technical reasons, your IP address is transmitted to the respective service with every connection.

  • Cloud backup with code: The backup is encrypted on your device with your code (AES-256-GCM) and stored only in encrypted form on a Novara server (Google Cloud Run, region europe-west1, Belgium). Without the code, nobody can read the backup – not even us. Depending on your selection, it contains playlists including login details, favorites, history, profiles and settings. You can delete the backup in the app.
  • QR code setup: You enter your login details on the website novaraiptv.com. They are transmitted to your device via the Novara server (Google Cloud) and kept there only for the duration of the setup (see section 8).
  • SIMKL (simkl.com, USA): When you open Movies or Series, the app downloads public trending lists from SIMKL. Only connection data and the app version are transmitted, no data from your playlist; matching against your catalog happens only on your device. Only if you connect your SIMKL account in the settings are the movies and series you have watched (title, year, IMDb or TMDB ID) additionally synchronized with that account.
  • OpenSubtitles (opensubtitles.com): When you search for subtitles, the title, release year, season and episode where applicable, IMDb or TMDB ID and the requested languages are transmitted. If you log in with an OpenSubtitles account, its username and password are also sent to OpenSubtitles.
  • Radio: For the station list, the app queries the Radio-Browser directory (radio-browser.info) with country, search term and selected station. The app retrieves the radio stream directly from the respective station.
  • Free TV: The app downloads public channel lists (Free-TV and iptv-org on GitHub) and program data from epgshare01.online.
  • SportHub (TV app only): Queries for league, team and date are sent via the Novara server to TheSportsDB.
  • DNS-over-HTTPS (off by default): If you turn this feature on, the app resolves server names via Cloudflare (1.1.1.1) or Google Public DNS. The respective provider learns which server names the app looks up.
  • Chromecast (smartphone app): When you stream to a Cast device, the stream address and title are sent to the device you selected in your own network.
  • Update check (only for installations outside Google Play): The app downloads a version file from Google Cloud Storage or novaraiptv.com. No user data is transmitted.

6. Recipients and transfers to third countries

Depending on the features you use, the recipients of your data are the services named in sections 4 and 5. We do not sell data, do not pass it on for advertising purposes and do not create profiles for advertising purposes.

Google may also process data from Firebase in the USA. This transfer is based on the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses. The cloud backup is stored in the Google Cloud region europe-west1 (Belgium).

SIMKL is based in the USA; data transmitted when retrieving the trending lists or via a connected SIMKL account is processed there by SIMKL. Other services from section 5 (for example GitHub, Cloudflare or TheSportsDB) may also process data outside the EU. These services are subject to their own privacy policies:

8. Retention periods

  • Data on your device: until you delete it in the app, clear the app data or uninstall the app.
  • Usage statistics (Google Analytics for Firebase): event data is deleted automatically after 14 months.
  • Crash and error reports (Crashlytics): 90 days.
  • Performance measurement (Performance Monitoring): in accordance with Google’s specifications (see the Firebase privacy information).
  • Cloud backup: until you delete it, but automatically no later than 12 months after it was last retrieved or saved.
  • QR code setup: Your login details are deleted within 15 minutes after being transferred to your device; setups that are not collected are deleted after 24 hours at the latest.
  • External services (SIMKL, OpenSubtitles and others): according to the terms of the respective provider.

9. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). To exercise them, write to support@novaraiptv.com.

Objecting to statistics and error reports: the app currently has no setting for this. You can object to the processing by email to support@novaraiptv.com. All data collection by the app ends when you uninstall it.

Since you have no account with us, we cannot attribute statistics and crash data to a person. To process a request concerning this data, we may need the app instance ID of your device.

You also have the right to lodge a complaint with a data protection supervisory authority. In Austria, this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

10. Children

The apps are not directed at children under 14. In Austria, this is the age from which children can consent to the processing of their data themselves (§ 4(4) Austrian Data Protection Act, DSG). If you are a parent and find that your child has sent us data, please contact support@novaraiptv.com so that we can delete it.

11. Security

  • Playlists and login details are stored on the device in an encrypted database.
  • Cloud backups are encrypted on your device with your code (end-to-end, AES-256-GCM) and are stored on the server only in encrypted form.
  • Login details are technically filtered out of error reports.
  • File backups are not encrypted – keep them in a safe place.

12. Changes

We update this privacy policy when the apps, the services used or the legal requirements change. The version published on this page applies.

This privacy policy is available in several languages. The German version is authoritative.

Last updated: October 2026