Privacy policy
This policy explains what data openTV (“the site” or “we”) collects when you use it, why, how long we keep it, who we share it with, and what your rights are. In short: no ads, no selling of data, and no third-party analytics or tracking tools.
What we collect
- Account data: Your username, email address and password (used to open the settings and to leave the kids screen), stored hashed (Argon2id) so that it cannot be recovered even by us.
- Sign-in codes: You sign in with a code sent to your email; we store a fingerprint of the code, not the code itself, for at most ten minutes. Linking a TV with a QR code stores fingerprints of the code and the device secret for the same period.
- What you save on the site: Favourites, lists, the categories, countries, languages or channels you blocked, the home page you chose, the channels you watched most recently, and the kids screen channels.
- Sessions: When you sign in we create a session and store a fingerprint of its token (not the token itself), when it was created and last used, and your browser type (User-Agent).
- Security event log: Sign-ins and sign-outs, failed sign-in attempts, account creation, password changes and administrative actions, each with its time and the IP address it came from.
- Attempt counters: We keep the IP address temporarily to count sign-in and registration attempts and to limit guessing and automated registration.
- Stream reports: If you report that a channel is not working, we store the report linked to your account.
- Registration request: The form data until you confirm your email, when it becomes an account.
- Technical server logs: The method and path of each request (which may include a channel identifier), its status code and processing time, without the IP address or anything you type into forms.
Why we use it
- To run your account and save your preferences and sync them across your devices.
- To protect your account and the site: verifying sign-ins, preventing guessing and automated registration, and investigating abuse.
- For essential messages only: sign-in codes, the email confirmation link, alerting you if someone tries to register or sign in with your email, and replying to your messages. We do not send marketing email.
We do not sell or rent your data, and we do not use it for advertising or to build profiles about you.
Cookies and browser storage
- Session cookie: Keeps you signed in. Scripts cannot read it (HttpOnly) and it is sent over HTTPS only. The session ends after 90 days without use, after 180 days at most, or when you sign out.
- Form protection cookie: Short-lived; it ties the sign-in and registration forms to the browser that opened them (CSRF protection).
- Local storage: Player settings, such as the volume, stay on your device and never reach us.
- Cloudflare: May set technical cookies to protect against bots, including the Turnstile check on the sign-in and registration pages.
We do not use advertising or analytics cookies.
Who we share it with
- Cloudflare, Inc.: Requests to the site pass through its network for protection and speed, its Turnstile service verifies that you are not a bot, and Cloudflare Email Service delivers our messages to your inbox. Cloudflare processes this data to provide its services to us, under its own privacy policy.
- Stream sources: When you play a channel your browser may connect to the stream server directly, so that server sees your IP address and browser type as on any website visit. When the stream passes through our servers, the source sees only our server's address. We do not control the practices of these sources.
- Authorities: If the law requires it, and only to the extent it requires.
We do not share your data with anyone else.
How long we keep it
- Account data and what you saved in it: as long as the account exists.
- The session: until you sign out or it expires.
- A registration request whose email was not confirmed: deleted automatically after 24 hours.
- Sign-in codes and TV pairing requests: deleted after 10 minutes, or as soon as they are used.
- Attempt counters: deleted within an hour.
- Stream reports: deleted after two days.
- The security event log: kept for security and abuse investigation; the part concerning an account is kept after its deletion for the same purpose.
- Technical server logs: rotated automatically whenever they reach their maximum size.
- Database backups: deleted after 14 days.
Your rights
You can request a copy of your data, its correction, or the deletion of your account and everything in it. Write to us from the email registered on your account at contact@opentv.live and we reply within 30 days. Some of this is directly in your hands, from the settings page: changing the password, clearing the recent channels list, editing favourites, lists and blocks, and deleting the account.
Children
Creating an account is open to those aged 13 or over, or the minimum age in your country if higher. The “kids screen” is a feature inside the guardian's account; it shows selected channels and collects no data about the child. If you learn that a child under this age created an account, write to us and we will delete it.
Security
The site runs over HTTPS only, passwords are hashed with Argon2id, session tokens are stored as fingerprints rather than plain text, forms are protected against CSRF, and sign-in and registration attempts are rate-limited. No system is completely secure, but we work to protect your data and will notify those affected if a breach touches it.
Changes to this policy
We publish any amendment on this page and change the “last updated” date above it. If the amendment is material, we notify account holders before it takes effect.
Language
This policy is written in Arabic and shown in other languages for convenience; in case of any discrepancy between the versions, the Arabic version prevails.
Contact us
For any question about your privacy: contact@opentv.live.