Legal

Privacy Policy

Last updated: October 21, 2026

This policy explains what data the Star Player app (Android, package app.starplay.player) and the website starplay.app (together, the “Service”) process, why, and what choices you have. Star Player is a media player only. It does not provide any content, and we never see what you watch.

Who is responsible

The Service is operated by the operator of starplay.app. For any privacy question or request, write to [email protected].

Data the app sends to the Service

When Star Player starts for the first time, it registers the device with the Service so that you can add a playlist on starplay.app and so that the free trial and your license work. The app sends:

a random installation ID created by the app, and a device key — a one-way SHA-256 hash of the Android ID that Android gives to this app. The Android ID itself never leaves the device; the hash only lets the free trial and your license survive reinstalling the app;
device information: manufacturer, model, Android version, screen size, whether it is a TV, the language setting, the app version and whether the app was installed from Google Play;
while the app is open, a periodic status message (whether the app is in the foreground or background).

We create a device code (for example ABCD-2345) and an access token for the device, and store the time of registration and of the last contact. The app does not report what you watch, your channel list, your viewing history or your favorites — these stay on the device, unless you turn on sync between devices (below).

Sync between devices (optional)

If you link your devices in the app (Settings → Sync between devices), your viewing history and playback positions are shared between the linked devices through the Service. Before anything is sent, the app encrypts it on the device with a key that only your linked devices have (end-to-end encryption); the key passes from one device to the other inside the one-time pairing code, which the Service never receives in full. We therefore store only the encrypted entries, an identifier of the device group and which devices belong to it — we cannot read what you watch. You can stop syncing on any device in the app; when no device is left in a group, we delete the group and its entries.

Playlists

If you add a playlist on starplay.app, we store the name you give it, the type, the server address and username or the playlist and TV guide addresses, and the password. Passwords and playlist addresses are stored encrypted. We use them only to deliver the playlist to the device with that code, and we never connect to your provider ourselves. The website shows only the playlist name and the server name to anyone who knows the device code — never the password or the full address. You can remove the playlist at any time on starplay.app/device.

If you log in inside the app instead, your provider details are stored encrypted on the device only and are not sent to us. The app connects directly to your provider; your provider’s own privacy policy applies to that connection.

Purchases

Google Play: when you unlock Star Player in the app, Google processes the payment. The app sends us the product, the order number and the purchase token, which we check with Google to unlock the device. We do not receive your payment details.

Web, card (Stripe): card payments on starplay.app are processed by Stripe. Stripe collects your card and billing details under Stripe’s privacy policy. We receive the payment reference, the amount, the currency and the email address you used, and we store them with the order and the device code you entered (or your partner account), so that we can unlock the device and issue an invoice. We never receive your card number.

Web, cryptocurrency (CryptAPI): for a cryptocurrency payment, CryptAPI creates a one-time payment address and forwards the payment to our wallet, under CryptAPI’s privacy policy. We store the payment address, the coin, the amounts and the transaction IDs with the order. Blockchain transactions are public by design.

If you give us an email address with a purchase, we send the invoice there.

Partner accounts

If you register as a partner, we store your name, email address, password (only as a secure hash), and the company, phone number, country, website and language you enter; the time, IP address and browser type of your sign-ins and active sessions; your credit history, orders and invoices; the device codes you activate or send playlists to, the customer names and notes you add, and your playlists and app look (logo and background images, colors and texts). We send you the emails your account needs: email confirmation, sign-in codes, sign-in notifications and expiry reminders (both can be turned off in your account settings) and invoices.

If a partner activates your device or sends you a playlist, that partner sees your device code, model, app version, when the device last contacted the Service and its activation status, and the name or note the partner gave the device — but never your own playlists. The partner’s logo, colors and app name are shown with that partner’s playlists and on devices the partner activated.

Website

The website does not use advertising, analytics or tracking cookies. It remembers your language choice in your browser’s local storage. Our web server keeps technical logs (IP address, time, requested page and browser type) for up to 14 days for security and abuse prevention, and briefly keeps IP addresses in memory to limit repeated requests. Stripe’s checkout page, when you open it, is provided by Stripe under its own policy. The partner panel uses one strictly necessary cookie to keep you signed in.

Why we process data (legal bases)

to provide the Service you ask for — device registration, delivering your playlist, the free trial and your license (performance of a contract);
to keep the Service secure, prevent abuse of the free trial and handle support requests (legitimate interests);
to keep records of purchases where the law requires it (legal obligation).

We do not sell your data, use it for advertising or share it with anyone except the processors needed to run the Service (our hosting provider, Google for verifying Google Play purchases, Stripe and CryptAPI for web payments, and our email provider for account emails and invoices).

How long we keep data

device records and playlists: until you remove them, and automatically 12 months after the device last contacted the Service;
sync data (encrypted entries and device groups): until the last device leaves the group or is deleted;
license records (the hashed device key and the license status): as long as the license is valid, so that a purchase keeps working;
purchase records and invoices: as long as the law requires for accounting;
partner accounts: while the account exists; sign-in sessions expire after 14 days without use, and sent emails are logged (without their content) for 90 days;
web server logs: up to 14 days.

Where data is stored

The Service runs on servers in the European Union. Google, Stripe and CryptAPI may process data in other countries under their own safeguards.

Your rights

You can ask us for access to, correction or deletion of your data, restrict or object to processing, and receive your data in a portable format. Write to [email protected] and include your device code so that we can find the device. You can also lodge a complaint with your data protection authority.

Children

The Service is not directed to children under 13, and we do not knowingly collect their data.

Changes

If we change this policy, we will publish the new version on this page with a new date.

Star Player does not provide, host or sell any content. You are responsible for using it only with content from providers that are authorized to distribute it to you.