Vidikon Privacy Policy

Last Updated: September 27, 2026

Vidikon ("Vidikon," "we," "us," or "our") is a media player for iPhone, iPad and Apple TV that plays television and video-on-demand catalogs from an IPTV provider that you choose and connect yourself. This Privacy Policy describes how we collect, use, store, share and protect your information when you use the Vidikon app and related services (the "Services"). It is incorporated by reference into our Terms of Use.

The short version. Vidikon does not host, sell or recommend television content. You bring your own provider. To make that work we store your provider login on our servers, encrypted, so that the app can sync your catalog and build playback links on your behalf. We do not run advertising, we do not sell your data, and we do not use analytics trackers. The only telemetry we collect is crash and error reporting so we can fix bugs.

I. Information We Collect

Account information

When you first open Vidikon we create an anonymous account for you. It has no name or email attached; it is a random identifier that lets your profiles, watch progress and lists follow you between your devices. You may optionally upgrade that account by signing in with Apple, Google or Discord. If you do, we receive and store:

Email address, as provided by the sign-in provider (with Sign in with Apple you may choose to hide your real address).
First and last name, if the sign-in provider shares them.
A provider identifier that links your Vidikon account to your Apple, Google or Discord identity so you can sign in again.

We do not store a profile picture and we do not ask for a date of birth, phone number or postal address.

Provider connection data

To play your content, Vidikon needs to talk to your IPTV provider. Depending on what you add, we store:

Xtream Codes logins: the server address, username and password of your provider account. The username and password are encrypted before they are written to our database (see Security below).
M3U playlist URLs and direct stream URLs that you enter, including any access tokens embedded in those URLs by your provider.
Provider account status reported by your provider's API, such as the subscription expiry date, whether the account is a trial, and the maximum number of simultaneous connections.

Catalog and viewing data

Catalog listings synced from your provider: channel, movie and series names, categories, artwork links and electronic program guide (EPG) entries. These describe what your provider offers, not what you watched. Listings for a given provider are shared between all Vidikon users who connect to that same provider.
Watch progress: the item you were playing and how far into it you were, so you can resume across devices.
Lists and reactions: your watchlist and any custom lists, items you liked or disliked, series you dismissed from "continue watching", and which stream you last added by hand.
Profile names you give to each provider connection inside the app.

Device and technical data

Paired devices: when you link an Apple TV to your account, we store the device's name and platform so you can see and revoke the link.
Timezone and language of your device, used to localize the program guide.
Crash and error reports: we use Bugsnag to collect crashes and errors from the app and from our server functions. A report includes the app version, device model and operating system version, a stack trace, and a breadcrumb trail of the API requests the app made shortly before the error (request path, duration, HTTP status and a request identifier). Reports do not include your provider password or the contents of what you were watching.
Server logs: our hosting providers record the IP address, timestamp and request path of calls made to our servers, as is standard for any internet service, and use the IP address for rate limiting and abuse prevention.

Camera

On iPhone and iPad, Vidikon asks for camera access only when you choose to scan the pairing code shown on your Apple TV. Frames are processed on your device to read the code and are never uploaded or stored.

Downloads

Content you download for offline viewing is stored only on your device, in the app's own storage, excluded from device backups. We keep no server-side record of what you downloaded.

What we do not collect

We do not use advertising identifiers, analytics or attribution SDKs, location services, contacts, photos, microphone, health data or push notifications. We do not track you across other apps or websites.

II. How We Use Information

To run the Services: authenticate you, sync and display your provider's catalog, build playback links, keep your watch progress and lists in sync across devices, and pair your Apple TV.
To enrich the catalog: we match the titles in your provider's catalog against The Movie Database (TMDB) to show posters, descriptions, cast and ratings. We send TMDB title names and identifiers, never your account or provider details.
To keep the Services working: diagnose crashes and errors, monitor performance, and prevent abuse.
To communicate with you: respond to support requests sent to us, and notify you of material changes to the Services or these policies.
To comply with law: respond to lawful requests, enforce our Terms of Use, and protect the rights and safety of Vidikon and its users.

We do not use your information for advertising, profiling or sale to third parties, and we do not make automated decisions that produce legal or similarly significant effects about you.

III. How We Share Information

We do not sell personal information and we do not share it for cross-context behavioral advertising. We share information only as described here.

Service providers

Provider	What they process	Why
Supabase (United States)	All account, provider-connection, catalog and viewing data; authentication; server functions	Database, authentication and API hosting
Bugsnag (SmartBear)	Crash and error reports as described above	Crash and error monitoring
DigitalOcean (United States)	Catalog titles and TMDB identifiers; server logs with IP addresses	Hosting for the metadata enrichment service
The Movie Database (TMDB)	Title names and identifiers from provider catalogs	Artwork, descriptions, cast and ratings
Apple, Google, Discord	Your identity with that provider, when you choose to sign in with it	Optional account sign-in

These providers are bound by contract to process data only on our instructions and for the purposes above.

Your IPTV provider

Every catalog sync and every stream you play is a request to your provider's servers, made either from your device or from our servers on your behalf using the login you gave us. Your provider therefore sees your requests, your login and, for playback, your IP address. Vidikon is not affiliated with any provider, does not control what data providers keep, and this Privacy Policy does not cover them. Please review your provider's own terms and privacy practices.

Legal requirements and protection

We may disclose information when we believe in good faith that it is necessary to comply with applicable law, regulation, legal process or governmental request; to enforce our Terms of Use; to detect, prevent or address fraud, security or technical issues; or to protect the rights, property or safety of Vidikon, our users or the public.

Business transfers

If Vidikon is involved in a merger, acquisition, reorganization, sale of assets or similar event, your information may be transferred as part of that transaction. We will notify you through the Services or by email before your information becomes subject to a different privacy policy.

With your consent

We may share information for any other purpose that we disclose to you at the time of collection and that you agree to.

IV. Security

Provider credentials are encrypted at rest. Xtream usernames and passwords are encrypted with AES-256 before being stored. The encryption key is held in a separate managed secret store, not alongside the data, so database backups and exports contain only ciphertext.
Access is scoped to you. Every row of account, provider and viewing data is protected by database-level access rules so that it can be read or changed only by the account that owns it.
Encryption in transit to our servers. All traffic between the app and our servers uses TLS.
Traffic to your provider may not be encrypted. Many IPTV providers only offer plain HTTP endpoints. When that is the case, requests to your provider, including your login as part of the stream URL, travel unencrypted between you (or our servers) and the provider. This is a property of the provider's service, not something Vidikon can change. Prefer providers that support HTTPS.
Session tokens on your device are stored in the system keychain.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account or provider login has been compromised, change the password with your provider and contact us.

V. Data Retention and Deletion

We keep your information for as long as your account exists. You can delete your account at any time from the app under Profile › Account › Delete Account. When you do:

Your email, name and sign-in identities are removed and your login is disabled immediately.
Your stored provider usernames and passwords are erased.
Your watch progress, lists, reactions, paired devices and hand-added streams are deleted.
Your profile records and provider connection records are retained without credentials for a short period for integrity and abuse-prevention purposes, then removed.

Catalog listings synced from a provider are shared reference data and are not tied to your account; they are refreshed and pruned on the provider's sync cycle and remain as long as any user is connected to that provider. Crash reports are retained by Bugsnag according to its retention settings and contain no direct identifiers. Encrypted backups of our database are rotated on a fixed cycle after which deleted data no longer exists in any copy.

Data you downloaded to your device is under your control and is removed when you delete the download or uninstall the app.

VI. Your Rights and Choices

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your personal information, to receive a copy of it in a portable format, and to withdraw consent where processing is based on consent. Residents of the European Economic Area, United Kingdom, Switzerland, California and other U.S. states with comprehensive privacy laws have these rights under their respective laws.

You can exercise most of these rights yourself: edit or remove provider connections in the app, sign out to stop syncing, and delete your account as described above. For anything else, or to request a copy of your data, email us at vlad@octoent.com. We will respond within the time required by applicable law (45 days for U.S. state privacy requests, one month under the GDPR, extendable where the law allows). We may need to verify your identity, for example by asking you to make the request from the email address on the account. You may designate an authorized agent to act for you with proof of authorization.

We will not discriminate against you for exercising any privacy right. We honor Global Privacy Control signals where the law requires it; we do not otherwise respond to browser Do Not Track signals because the Services are not a website that tracks you.

If you are in the EEA or UK and believe we have not handled your data lawfully, you have the right to lodge a complaint with your local supervisory authority.

VII. International Transfers

Our servers are located in the United States. If you use the Services from outside the United States, your information is transferred to and processed in the United States, where data protection laws may differ from those in your country. For transfers from the EEA, UK and Switzerland we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum as implemented by our service providers.

VIII. Children

Vidikon is a general-audience media player and is not directed at children. You must be at least 13 years old to create an account. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us at vlad@octoent.com and we will delete it. The content available through Vidikon is determined entirely by the provider you connect; parents and guardians are responsible for the providers and content their children can access.

IX. Third-Party Content and Links

Catalog artwork and descriptions are loaded from TMDB and from your provider's servers. Trailers open in third-party players. Those services have their own privacy practices. This product uses the TMDB API but is not endorsed or certified by TMDB.

X. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised policy on this page with a new "Last Updated" date and, for material changes, notify you in the app or by email before the changes take effect. Your continued use of the Services after the effective date constitutes acceptance of the revised policy.

XI. Contact

Questions, requests or concerns about this Privacy Policy can be sent to vlad@octoent.com.