Privacy policy

1. The short version

Rhoe is a player for an IPTV service you already have. It contains no channels, no playlists and no catalogue of its own.

You can use Rhoe without giving us anything. A Rhoe account is optional and exists only to copy your settings between your own devices.
Your provider password never leaves your device. It is written to the iOS Keychain or the Android Keystore and is never uploaded.
Your video never passes through us. The app requests a stream from your provider and plays it directly from their servers.
No ads, no advertising ID, no analytics or crash-reporting SDKs.
We do not build a viewing history. If you sign in, your own watch progress and favourites are stored so your devices agree; nothing profiles you and nothing is sold.

2. Who we are

"Rhoe", "we" and "us" mean the developer of the Rhoe applications and the operator of the Rhoe backend and of rhoe.app. For anything in this policy, write to privacy@rhoe.app.

Your IPTV provider is a separate company that we have no relationship with. They are the controller of the account you hold with them, and their own privacy policy governs it.

3. Rhoe account data

You only have this if you choose to sign in. Signing in is what makes your settings follow you from your phone to your television.

Everything the Rhoe backend stores against an account
What	Why it exists
Email address	It is your account identifier and where the sign-in code is sent. Required if you want an account.
Display name	Optional. Shown in the app so you can tell accounts apart.
Sign-in code record	A one-way hash of the emailed code, a per-record salt, an attempt counter and an expiry time. The code itself is never stored in a readable form.
Password hash	Only for older accounts created before passwordless sign-in. Stored as a hash, never as a password.
Session records	A one-way hash of each device's session token plus its expiry, so you can be signed in on several devices and sign them out individually.
Your settings	Interface and content languages, subtitle and audio language, video fill mode, autoplay-next, keep-screen-awake, episode order and caption preferences.
Favourites and watch progress	The titles you marked, and how far into a film or episode you were, so another device can resume it.
Saved connection list	For each service you connected: a label, the provider's server address with any credentials stripped out of it, the username you sign in with there, and a portal MAC address where that is how the portal authenticates. This is what lets a new device offer your existing connection instead of making you type it again.

The one thing worth reading twice

Your saved connection list includes your provider username and server address, because a device that has never seen your setup cannot otherwise offer it. It never includes your provider password, and credentials embedded in a playlist or portal URL are stripped before the address is stored.

If you would rather we held none of that, do not sign in. The player works fully without an account.

4. Data that stays on your device

This never reaches a Rhoe server. It is written to your device's own storage, and provider secrets go to the platform keychain rather than ordinary app storage.

Provider credentials — username, password, portal MAC address and playlist URLs, held in the iOS Keychain or Android Keystore.
Imported playlist files — any .m3u or .m3u8 file you opened in the app.
Your parental PIN, stored as set on the device that set it.
Recently watched channels and recent searches, so the rails and the search field are useful.
Cached channel logos, posters and guide data, so the app does not re-download the same artwork every time you open it.

Uninstalling the app, or using the in-app option to clear a connection, removes this.

5. What your IPTV provider and their CDN see

When you connect a service or press play, your device talks straight to your provider — not through us. They will normally receive:

your IP address and approximate location derived from it;
the credentials you gave Rhoe for that service;
which channel, film or episode you asked for, and when;
basic device and player information sent with the request.

What they log, how long they keep it and who they share it with is theirs to answer. Read their privacy policy — we cannot see, control or delete anything held there.

6. Server logs

The Rhoe backend answers sign-in, settings-sync and health requests. Like any web service, its infrastructure records the request line, a timestamp, the response status and the source IP address. These logs exist to keep the service running, to enforce rate limits and to investigate abuse or an attempted break-in. They are kept for a short period and then rotated away.

Sync request bodies carry your settings as described above. They do not carry provider passwords, and stream URLs are never posted to us.

7. What we never collect

No advertising identifier, and no advertising of any kind.
No third-party analytics, attribution or crash-reporting SDK in the app.
No contacts, photos, calendar, microphone, camera or precise location.
No payment details — Rhoe takes no payment, and your subscription is billed by your provider.
No channel names, search terms, or stream URLs sent to a Rhoe server.

If any of this changes — for example if crash reporting is ever added — this policy and the store data-safety declarations will be updated before the change ships, not after.

8. Why we use what we use

To sign you in — your email address and the hashed code. Without this an account cannot exist.
To keep your devices in step — your settings, favourites, progress and saved connection list.
To keep the service standing up — session records, rate limits and short-lived logs.
To answer you — anything you send us by email when you ask for help.

Where the GDPR or UK GDPR applies, we rely on performance of a contract for the account and sync features you asked for, and on our legitimate interests in a secure, working service for logs, rate limiting and abuse prevention. We do not rely on consent for anything, because we do not do anything optional with your data.

We do not sell personal data and we do not share it for advertising. Data is processed on our behalf by:

Our hosting provider, which runs the servers and database the backend uses.
An email delivery service, which transmits your sign-in code. It receives your email address and the message containing that code.

We may also disclose data where the law actually requires it, or where it is necessary to establish or defend a legal claim. If that ever happens we will tell affected users unless we are prohibited from doing so.

10. How long we keep it

Account, settings and saved connections — until you delete your account.
Sign-in codes — minutes. They expire quickly and are erased once used or expired.
Sessions — until they expire or you sign that device out.
Server logs — a short rotation window, then discarded.
Support email — as long as needed to resolve your issue and keep a record of it.

11. Security

Provider credentials are stored by the operating system's keychain, not in ordinary app storage.
Release builds require HTTPS for every control endpoint — sign-in, catalogue and guide requests — because those are the requests carrying credentials.
Sign-in codes and session tokens are stored only as one-way hashes with a per-record salt, so a stolen database does not yield working logins.
Sign-in endpoints are rate limited, and codes have an attempt counter and a short expiry.

No system is perfect. If you believe you have found a vulnerability, write to security@rhoe.app and please give us a reasonable chance to fix it before publishing.

12. Your rights

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or hand it over in a portable form. You can also complain to your national data-protection authority. If you are in California, we do not sell or share personal information as those terms are defined there, and we will not discriminate against you for exercising any right.

Email privacy@rhoe.app from the address on the account. We answer within 30 days.

13. Deleting your account

You can do this two ways, and both remove the same data:

In the app — Account, then Privacy and account, then Delete Rhoe account.
On the web — rhoe.app/delete-account, no app needed.

Deletion removes your account record, your settings, favourites, watch progress and saved connection list, and invalidates every session on every device. It is not reversible.

It does not cancel your IPTV subscription — that account belongs to your provider and only they can close it.

14. Children

Rhoe is not directed at children and we do not knowingly collect data from anyone under 13, or under the minimum age of consent where you live. The app has a parental PIN so an adult can restrict what is reachable, but the content itself comes from your provider and is not rated or filtered by us. If you believe a child has created an account, write to privacy@rhoe.app and we will remove it.

15. International transfers

Our servers and processors may be located in a different country from you, so using an account means your data may be transferred and stored there. Where the law requires a transfer safeguard, we rely on the European Commission's standard contractual clauses or another approved mechanism with the processors involved.

16. Changes to this policy

When this changes we update the date at the top. If a change materially affects what we collect or why, we will say so in the app before it takes effect. Continuing to use Rhoe after that means the updated policy applies to you.

17. Contact

Privacy and data requests — privacy@rhoe.app
Security reports — security@rhoe.app
Everything else — support@rhoe.app