Ember

Privacy policy

Last updated: 2026-10-30

Ember ("the app", "we") is a video player for IPTV playlists, Xtream Codes logins and media servers (Plex, Jellyfin, Emby) that you add yourself. The app comes with no channels, films or series of its own. This policy explains what information the app handles, where it is kept and what you can do about it.

Who is responsible: Isac Rost, Sweden, support@embertv.app.

What stays on your device

These never leave the device you enter them on:

  • Your sources' logins: playlist addresses, Xtream usernames and passwords, and media-server tokens. They are kept in the device's secure storage (Keychain on Apple devices, encrypted storage on Android). The desktop app encrypts them with the operating system's protection (Windows Data Protection, the macOS Keychain). In a web browser they are kept in the app's local storage.
  • Your sources' catalogs: the channel lists, films, series and TV guides the app downloads from your sources, so they can be browsed quickly.
  • Downloads: films and episodes you download to watch offline.
  • Settings such as the language and the library view.

What is stored in your account (only if you create one)

You can use the app without an account. If you create one, so that your progress and lists follow you to other devices, we store:

  • Account details: your name, email address and a protected (hashed) password. If you sign in with Apple or Google, we receive your name and email address from them instead of a password.
  • Sign-in sessions: for each signed-in device, a session token, when it was created and expires, and the IP address and device type it signed in from. We use these to keep you signed in and to protect your account. Sessions are deleted when they expire or when you sign out.
  • Profiles: each profile's name, color, whether it is a kids profile, and a protected (hashed) PIN if you set one.
  • Watch progress and your list: for each profile, which films, episodes and programs were watched, how far, and when, plus the titles added to "My list". Titles are stored as an identifier (for example a TMDB number or a cleaned-up title), not as the source they were played from.
  • Your sources, without their logins: each source's type, the name you gave it and its server's address (the host name, plus the folder a media server is installed under), so your other devices can show which sources you use. Usernames, passwords, tokens and full playlist addresses are never sent.
  • TV sign-in codes: when you sign in a TV with your phone, the short code shown on the TV, for up to 10 minutes.

Purchases

Premium is sold through the App Store, Google Play, or (in the browser and desktop app) a card payment handled by Stripe. We don't see or store your payment details. RevenueCat keeps the record of what was bought, under your account's identifier (or a random identifier for this device if you aren't signed in), so Premium works on all your devices. Our server asks RevenueCat whether your account has Premium and remembers the answer for up to an hour.

Artwork and film information

To show posters, artwork and descriptions, the app sends the cleaned-up title and year of films and series in your library to our server, which looks them up at The Movie Database (TMDB). These requests are not linked to your account. Our server keeps the answers (keyed by title, not by user) for up to 30 days so it doesn't have to ask TMDB again. It sees your IP address while answering, and uses it only to limit how many requests one address can make per minute; it doesn't store it. Pictures are loaded directly from TMDB's image servers (image.tmdb.org), which see your IP address like any website you visit.

This product uses the TMDB API but is not endorsed or certified by TMDB.

Who else is involved

  • Cloudflare runs our server and database (Cloudflare's privacy policy).
  • TMDB provides film and series information and images (TMDB's privacy policy).
  • Apple and Google, only if you choose to sign in with them, or buy Premium through their stores.
  • RevenueCat keeps the record of Premium purchases (RevenueCat's privacy policy), and Stripe handles card payments in the browser and desktop app (Stripe's privacy policy).
  • Plex, only if you add a Plex server: signing in happens on plex.tv.
  • Your IPTV provider or media server, which you chose yourself and which handles your viewing under its own terms. The app connects to it directly from your device.

We don't sell your information, show ads, or use analytics or tracking tools.

How long we keep it, and deleting it

Your account information is kept until you delete your account. In the app, go to Settings → Delete account: your account, profiles, watch progress, list and sources are deleted from our server straight away. Information on your devices is removed when you remove the app or the source.

You can also ask us at support@embertv.app for a copy of your information, or to correct or delete it. If you are in the EU or UK you have these rights under the GDPR, and you can complain to your data protection authority.

Children

The app has kids profiles, which only show categories without adult content, but it is not directed at children under 13 and we don't knowingly collect their information. An account is meant to be created by an adult.

Security

Connections to our server are encrypted (HTTPS). Passwords and PINs are stored only as hashes. Every request to your account's information is checked against your signed-in session, so one user can never read another's.

Changes

If this policy changes, we'll update the date above and, for important changes, tell you in the app.

Back to the home page