Last updated: 26 September 2026
GIOT 2021 SOCIEDAD LIMITADA. ("GIOT", "we") is responsible for the processing described in this policy for GIOT IPTV Player. Contact: info@giot.es. Spain.
GIOT IPTV Player works as a player for an Xtream-compatible IPTV service selected by the user. GIOT does not provide commercial channels, playlists, accounts or subscriptions, and does not administer the user's account with their IPTV provider. GIOT does not operate its own server that receives these requests. The app includes an offline demonstration with its own synthetic samples; it does not require credentials or content from a provider.
The app handles the IPTV server address, username and password entered by the user. It uses them to sign in and request categories, channels, movies, series, episodes, metadata, the XMLTV guide and playback addresses from the provider.
After a successful sign-in, credentials are stored on the device using Android Keystore on Android or Keychain on iOS. To communicate with the provider, the username and password are sent to the selected server: in URL parameters for the API and XMLTV guide, and in the media playback path.
The app downloads content names and identifiers, categories, schedules, descriptions, cast, director, genres, dates, ratings and image addresses from the provider when available. It keeps limited copies in the app's private storage to speed up later launches and show previously viewed information during temporary network failures.
Artwork, backdrops and logos are requested from URLs provided by the provider. The provider or image hosts may receive the request and ordinary technical data, such as IP address and headers needed to deliver the file.
When content is played, the provider or media host may receive the IP address, requested content, request time and technical connection data. For played episodes, the app stores locally series and episode identifiers and names, series image, season, episode number, position, duration, watched state and update time. This history allows playback to resume and is not synchronised with GIOT or other devices.
A phone can scan a pairing QR code shown on a tablet, or the user can enter the pairing code manually. Camera access is requested only for scanning; camera frames are processed on the device, with no photo stored or uploaded to GIOT. Paired devices exchange playback status, channel names and remote commands over the same local network. The pairing code and key are not sent to a GIOT server. The last pairing is stored locally using device-only Keychain on iOS and encrypted storage backed by Android Keystore on Android. It remains after closing the app until you forget it, revoke it or replace it. Disconnecting or using Sleep stops the current connection without deleting the saved pairing. Anyone who obtains an active pairing code may control playback.
On Android tablets, the user may separately enable device administrator access so the Sleep action locks the screen immediately. This requests the force-lock policy only and can be disabled in the app or Android settings. Without it, Sleep uses the normal system screen timeout. iOS does not request device administrator access.
The Google Play version offers an optional one-time purchase that adds a cosmetic supporter badge. All player features remain free without it. The app checks purchase ownership with Google Play Billing when it opens or returns to the foreground, and communicates with Google Play when the user views or completes this purchase. It may receive the product identifier, displayed price and purchase information such as purchase status, purchase token and acknowledgement status. The app uses this information only to show the offer, confirm and acknowledge the transaction, restore the purchase and display the badge.
Google Play processes the payment under Google's terms and privacy policy. GIOT does not receive or store card numbers, bank details or other payment-method details. The app does not send purchase tokens or purchase records to a GIOT server; GIOT has no billing backend. Google Play maintains the purchase associated with the user's Google Play account so that the app can check ownership again.
The app sends necessary data directly to the Xtream provider and the video, audio or image hosts configured by, or communicated by, that provider. They are services independent of GIOT and may be located in other countries. Their terms and policies determine how they handle the data they receive; users should consult them with their provider.
In the Google Play version, Google receives and processes information needed to provide the optional purchase. Google's terms and privacy policy govern Google's payment processing and retention. The app does not include advertising, analytics or crash-reporting SDKs.
Connections use HTTPS when the supplied URL starts with https://. The app also supports http:// servers and resources. In that case, credentials, requests, images and content are not protected by TLS in transit and may be observed or changed by third parties on the network. The provider and external hosts determine their own security practices.
On Android and iOS, paired remote-control messages travel over the local network encrypted with a pairing key stored securely on the device. Use a trusted local network and keep pairing codes private.
Catalogues, guide data, metadata and watch history are stored without additional encryption in the app's private storage.
Credentials, catalogue copies and watch history are stored on the device. On Android, signing out removes saved credentials, catalogues, guide, details, episodes, watch history and app-managed image caches. On iOS, signing out removes the saved credentials, the signed-in account's catalogue cache and its saved episode progress. Catalogue and image copies may also be replaced or removed automatically because of size and age limits.
Signing out does not delete an account, logs or data retained by the IPTV provider, an external host or Google Play; requests for those records must be made to the relevant service. Clearing app data or uninstalling removes app-local state but does not cancel or erase a Google Play purchase. Google Play can report the purchase again when the Android app is reinstalled or used on another eligible device with the same account.
The app uses network access to connect to the provider and paired devices and, on Android through Google Play, to Google Play Billing. Camera permission is requested when the user chooses to scan a pairing QR code. Android may request optional device administrator access only if the user enables immediate screen lock. The app does not request sensitive location, contacts, microphone, media files, phone or advertising identifier permissions. Android app data is excluded from Android backup; iOS credential storage is device-only.
The IPTV provider selected by the user is responsible for the content it offers and its ratings. Responsible adults should supervise use by children when the provider's content may not be suitable.
Where applicable, requests to GIOT for access, rectification, erasure, objection, restriction of processing and portability of data under GIOT's responsibility may be sent to info@giot.es. Requests about an IPTV provider's account, logs or content must be made to that provider. Purchase and payment records held by Google are managed through the user's Google Play account and Google's privacy channels.
You may also lodge a complaint with the Spanish Data Protection Agency (AEPD).
We will publish changes to this policy at the same location and state the date of the last update.