Privacy policy

1. Who we are

This policy explains how BITVIRE, a sole proprietorship (eenmanszaak) registered with the Netherlands Chamber of Commerce (KvK) under number 97211699, VAT ID NL005257300B03, trading as ZiroTV (“we”, “us”) handles personal data when you use the ZiroTV app, this website and the account portal at app.zirotv.com. We are the controller of that data.

For anything about your data, email info@bitvire.com.

2. This website and the account portal

zirotv.com sets no cookies and stores nothing on your device. Its fonts come from our own server, so no font service sees your visit.

We count visits with Ahrefs Web Analytics, which works without cookies. With each page view it receives your IP address, the page, the page you came from and your browser and device type. We only see totals, such as views per page and visitors per country, never data about you as a person.

app.zirotv.com sets two cookies. One keeps you signed in, and expires after 60 days or when you sign out. The other keeps the language you arrived with from this website, for one year. Both are strictly necessary, so they need no consent.

Our server logs each request to zirotv.com, app.zirotv.com and api.zirotv.com: the IP address, the time, the request, its status, your browser or app (its user agent) and the page you came from. Cookies and sign-in credentials are not logged. The server the app talks to also keeps its own log of each request: the IP address, the time, the method, the address asked for (without its query), the status, how long it took, the platform and version the app reports, its user agent, and which device and account made the request, if any. We use these logs to keep our systems secure, to find faults, to look into misuse of an account or of our service, to help you when you contact us, and to count per hour how many devices and accounts use ZiroTV. We do this on the basis of our legitimate interest in each of these (art. 6(1)(f)). Only our own admins can see these logs, and we share them with no one. How long we keep them is in section 15.

3. The app

When ZiroTV first opens on a device, it registers the device with our server. We store:

• A random identifier the app creates when it is installed. It is not your device’s own ID, and it changes if you reinstall.
• On Android, a hardware hash: a SHA-256 hash of the app’s name and the Android ID your device gives ZiroTV. On an LG or Samsung TV, it is made the same way from the TV’s own device ID. On Windows, Mac and Linux, it is made the same way from the machine ID the computer’s system keeps. Unlike the random identifier, it stays the same when you reinstall. We use it only to give each device one free trial. iPhone and iPad send none.
• The device code shown on the screen. It stays the same until the app is reinstalled or its data is cleared.
• The pairing key shown with it, as a hash. From version 1.1.10, the app gets a new key for every pairing, and each key stops working after 10 minutes. Version 1.1.9 and earlier show one key that stays the same, and it keeps working after an update to 1.1.10 for a transition period.
• The type of device: TV, Android phone or tablet, or iPhone or iPad
• When your free trial started and ends, and when the device was first and last seen

We use this to run the free trial, to link the device to your account and to check your plan.

Your playlists, favourites, profiles, settings and watch progress are kept in the app on your device. Without an account, none of them leave it.

The app connects straight to your IPTV provider to load your playlist, the TV guide and the streams. That traffic does not pass through us. Your provider receives your IP address and your login, and its own privacy policy applies. A trailer opens on YouTube, where Google’s privacy policy applies.

The phone app can cast to a Chromecast on your own network. The stream then goes to the Chromecast straight from your device or your provider; none of it passes through our servers, and we store nothing about it.

In every ZiroTV app, the channel logos and posters your playlist names load through our own image server. The app asks it for an image by its address, with a key that names your device. Our server then fetches the image from the host in that address, which is often your provider’s, sending none of your cookies, headers or IP address, and converts it to a smaller format. It keeps the converted image for up to 7 days, in memory and on disk, filed under a code made from the address and not under your device or account, so one copy serves everyone who loads the same image. Because an image address can hold your playlist login, we never write the address itself to our logs or to disk.

4. How many people use the app

The app already contacts our server to check your trial or plan. With those requests it tells us its platform (Android TV, which includes Fire TV, Android, iOS, LG webOS, Samsung Tizen, Windows, macOS or Linux) and its version. From them, our server keeps one record for each day a device used the app: the device’s random identifier, the date, the platform and the app version.

We store no IP address with these records, no location or country, and nothing about which screens you open or what you watch. They only let us count how many devices use ZiroTV each day, how many are new, and which platforms and versions they run. Only our own admins see those totals. If you sync with an account, how far you got in each title is stored apart from these records and used only for sync (section 6).

The TV app sometimes asks whether you would rate ZiroTV. It reports to our server when it shows that question and what you chose (rate, later or never), with the device’s random identifier, its platform, the app version and the time. We use these reports only to count how often the question is shown and answered. The phone app asks through the App Store or Google Play instead, and reports nothing to us.

We do this on the basis of our legitimate interest in knowing how many people use ZiroTV and on which devices, so we can maintain and improve it (art. 6(1)(f)). We share these records and reports with no one, and we do not use them for profiling or advertising. Each daily record is deleted automatically 16 months after the day it describes, and straight away when the device record or your account is deleted. Each report on the rating question is deleted 16 months after it was made. When the device leaves your account, or its record is deleted, before then, the report stays in our counts but no longer names the device.

5. Adding a playlist from your phone

The QR code your TV shows for this works for 10 minutes. When you enter a playlist on your phone, we hold it on our server until the TV collects it: the playlist’s name and type, the server address, user name and TV guide link, and the password or M3U link, encrypted.

The TV deletes it from our server as soon as it has collected it. A playlist no TV collects is deleted within 24 hours.

6. Your account

You can create an account in the app or on the account portal at app.zirotv.com. We then store:

• Your email address, and your name if you give it
• Your password, as a hash that cannot be turned back into the password
• When you confirmed your email address and when you last signed in
• Short-lived codes for confirming your email address and resetting your password
• The language you chose, so we can email you in it
• When you accepted our terms, and which version and language of them
• Your plan: its type, status, renewal date and the number of devices it covers
• Which devices are signed in to your account

With an account, the app syncs what you set up in it to your other devices. Cloud sync is on by default, and you can turn it off on the account screen in the app. While it is on, we store:

• Your playlists: their names and types, with their server addresses, user names, passwords, M3U links and TV guide links encrypted
• Your profiles: their names, colours and whether they are kids profiles, and their PINs, encrypted
• Your favourites
• The categories and channels you hid or renamed, and the order of your categories
• Some settings: whether channel logos show, merged channels, how a title resumes, whether channels that do not play are hidden, and each profile’s audio and subtitle languages
• Your watch progress: which film or episode, how far you got and whether you finished it

When you delete something, your other devices delete it too. For a playlist, a favourite, watch progress or a hidden or renamed item, our server then keeps only a mark of the deletion, and removes that mark after 90 days. An account created by a purchase in the app, without an email address (section 15), does not sync: the phone keeps its data until it signs in to an account with an email address.

We email you only about your account and your purchases: codes to confirm your address or reset your password, a confirmation of each purchase with its receipt and what it means for your right of withdrawal, a confirmation when your account is deleted, and notice at least 30 days before a change to our prices, our terms or this policy that affects you. Apart from the launch email you can ask for (section 11), we send no newsletters or marketing email.

7. Sharing a playlist

With an account, you can share one of your playlists with other ZiroTV accounts, through an invitation to an email address or a link. We then store which playlist you share and with which accounts, each open invitation with the address it was made for, and how many people your provider lets watch at once.

An invitation to an address is emailed to it, with your name, your email address and the playlist’s name. The people you share with see the playlist’s name and type and your name, and you see theirs. Here an account’s name is the name it gave, or, if it gave none, the part of its email address before the @.

Someone you share with never sees the playlist’s server address, user name or password in ZiroTV. Their app does receive them, because it connects to your provider itself, just as your own devices do, so your provider receives their IP address.

So that no more people watch at once than your provider allows, our server keeps track of who is watching a shared playlist: the device, the account and since when. Someone who finds it full sees who is watching, on which type of device and for how long, and can ask one of them to make way. We store who asked whom and the answer.

8. Friends and watching together

With an account, you can add friends: by a request to their email address, or by typing the code a friend’s screen shows. We store:

• Each friend request: who sent it, the email address it was sent to, and when. Only the sender sees that address. We send no email for it; if a confirmed account has that address, it sees the request with the sender’s display name, or the part of the sender’s email address before the @ if the sender set none.
• Your friendships: which accounts are friends, and since when
• Whether you show your friends what you are watching
• The accounts you have blocked, and since when

Other accounts, your friends included, see you by your display name. If you have not set one, they see the part of your email address before the @, never the whole address. While the app is open, it tells our server that you are online and what you are watching: the name of the channel, film or episode, and whether you watch it in a room, never your playlist or its login. Only your friends see this. With Show friends what I’m watching off, your friends see you as offline and cannot ask you to watch along. While a kids profile is in use, the app tells your friends nothing.

In a room, people watch the same live channel, film or episode together, each from their own playlist. Anyone with the room’s code can join it, and everyone in it sees each member’s name and type of device. Your friends can also find a room you are in, unless you hide what you are watching; from outside, they see by name only those of their friends who show it, and the others as a number. To bring everyone to the same moment, each member’s app sends our server a fingerprint of the sound its player plays, where the app can follow that sound, not the sound itself and nothing from a microphone, and our server compares them. A live room holds the channel’s name and its guide (EPG) id and, of each member, the last 90 seconds of fingerprint. When you ask a friend to watch along, they see your name and what you are watching.

A film or episode room holds the title: the film’s or show’s name, its year, its catalogue number (TMDB) where the playlist gives one, and the season and episode, never a stream address or a login. Each play, pause and seek sends a position in the title, which the room keeps as its shared playhead. Each member’s app also tells our server how long its copy is. Of each member the room holds the length of their copy, how their copy lines up with the starter’s (an offset and a speed), whether their player is ready, and the last 90 seconds of fingerprint.

You can block another account. The block keeps the two accounts apart, both ways: it ends any friendship, friend request, shared playlist and invitation between you, and from then on neither of you can add the other as a friend, share a playlist with the other or be in the same room. That is all we use it for. Only you see whom you have blocked. The person you block is not told: they see only what they would see if you had ended the friendship, declined their request or stopped sharing.

What you are watching, rooms, friend codes and requests to watch along are held only in our server’s memory, never in its database or backups (section 15).

9. Payments

Payments on app.zirotv.com go through Mollie B.V. For a monthly or yearly plan, we register you as a customer at Mollie with your email address and, if you gave one, your name. You enter your card or bank details at Mollie, which handles them, and we never see them.

We keep a record of each payment: the Mollie payment ID, the plan, the amount, the VAT, the currency, the status, the date and the country of the card or bank account, which Mollie tells us. Your account also holds your Mollie customer and subscription IDs. Mollie processes payment data as a controller in its own right, under its own privacy statement.

When you order, we keep evidence of what you agreed to: the exact sentence you agreed to, when and in which language, your IP address, your browser’s user agent, the country you told us you buy from and the country your IP address is registered in. We look that country up in a database on our own server, so no other company sees your IP address for it. Tax law decides the VAT by your country, so we keep the countries and your IP address as proof of the VAT. The rest proves what we told you and what you agreed to, should a claim about your purchase ever arise (section 15).

Plans bought in the phone app, on iPhone or Android, go through Apple or Google. The store tells us which plan you bought and gives us its reference for the purchase (Apple’s transaction ID or Google’s purchase token), which we store to keep your plan active. We also keep the notifications the store sends us about the purchase, such as a renewal or a refund. Buying in the app needs no account. Apple and Google handle the payment and its refunds themselves, each under its own privacy policy.

10. Support email

When you email us, we keep your message, your email address and our reply, so we can help you and handle any follow-up. Please never send us your playlist password.

11. Launch emails

On the page of an app that is still in development, you can ask us to email you when it launches. We then store your email address, the app you asked about, the language and address of the page you signed up on, and when you signed up and confirmed.

We first send one email with a link to confirm the address. Only a confirmed address is on the list, and an address nobody confirms is deleted after 30 days. We use the list for one thing: a single email when that app launches. Once that email has gone out, we delete that app’s list. Every email has a link to unsubscribe, which deletes your address from the list sooner, and you can also ask us at info@bitvire.com.

12. Why we use your data

We use personal data only for these purposes, each on the legal basis the GDPR gives for it.

To have an account, you must give an email address and a password; without them we cannot create one. To buy a plan on the website, you also give your payment details, to Mollie. The app must send its random device identifier, device type and trial or plan-check data; without them we cannot run the trial or check a plan. Server logs are created automatically when you connect. Everything else is up to you, such as your name and the launch list, and buying in the app needs no account.

Where we rely on our legitimate interest, you may object (section 17). Where we rely on your consent, you may withdraw it at any time, as easily as you gave it. That does not make anything we lawfully did before then unlawful. We send no marketing email beyond the launch email you ask for (section 11); if we ever want to, we will ask for your consent first.

13. Who receives your data

We share personal data only with these companies, and only what each of them needs.

A processor works only on our instructions, under a data processing agreement. A controller decides for itself how it uses the data it receives, under its own privacy policy. We do not sell personal data, and we do not share it with advertisers. We disclose it to others only where the law requires it, for example to the tax authority.

14. Transfers outside the EU

Ahrefs Pte. Ltd. (Singapore) and Cloudflare, Inc. (United States) are established outside the European Economic Area, and those transfers are covered by the EU standard contractual clauses; email info@bitvire.com for a copy. The other recipients are established in the EU.

15. How long we keep data

• Account data and everything you sync: until your account is deleted. They then leave our database straight away, and our backups within 14 days, as we keep each nightly backup for 14 days.
• Accounts created by a purchase in the app: a purchase in the phone app on a device signed in to no account creates an account with no email address and no password, holding only the device and its store purchases. Such an account is deleted automatically once it has had no device and no running purchase for 90 days.
• Payment records: seven years, as Dutch tax law requires. When your account is deleted, they are no longer linked to it.
• Order evidence: what you agreed to at checkout, with your IP address, user agent and countries, for seven years, also after your account is deleted (section 9). It is kept with the payment record it proves, for as long as tax law keeps that record.
• Purchase confirmation emails: the address we sent each one to and the whole email, for seven years, also after your account is deleted. The email proves we confirmed your purchase and what it means for your right of withdrawal, and is kept with the payment record it belongs to.
• Store purchase records: a purchase in the App Store or Google Play is kept as the store’s reference for it, the product and its state, such as active, renewed or refunded. When your account is deleted, the record is no longer linked to it, so that a refunded purchase cannot be used again and a purchase that is still running can be restored. Once it is linked to no account, it is deleted seven years after the store last reported on it. Each notification the store sends us about a purchase is kept for seven years.
• Device records: as long as the device is linked to an account. A device on no account, including one you removed or one whose account was deleted, is deleted 12 months after it last contacted our server. Device records hold no name or email address.
• Daily usage records: 16 months after the day they describe, or until the device record or your account is deleted, if that comes first (section 4).
• Rating question reports: 16 months after they were made (section 4).
• Playlists sent from your phone: until the TV collects them, and never longer than 24 hours (section 5).
• Shared playlists: a share lasts until either of you ends it, the playlist is deleted or either account is deleted. An invitation nobody accepts ends after seven days and is then deleted. Who watched a shared playlist, and requests to make way, are deleted within a few hours after the watching ends (section 7).
• Friends: a friend request until it is accepted, declined or withdrawn, and never longer than 30 days. A friendship until either of you ends it or either account is deleted. A block until you lift it or either account is deleted.
• What you are watching, rooms and friend codes: only while they are in use, in our server’s memory. What you are watching is dropped soon after your app stops telling us, a room ends once its last member has left, and a friend code ends when it runs out or you make a new one. A restart of our server forgets all of it (section 8).
• Email and password codes: a code works for 15 minutes. A used code is deleted straight away, and an unused one within a day of expiring, because wrong tries on it count until then.
• Wrong-password counts: for each account email address and the internet address a sign-in came from, the number of wrong passwords and any lock they caused, deleted within 24 hours of the last wrong one.
• Sign-in protection: to protect accounts against password guessing, we keep a one-way keyed hash of the account’s email address and of the IP address a correct password was entered from, for 30 days, plus short-lived counts of attempts.
• Sign-ins to your account: for each one, when it began and when it was last renewed, with its sign-in token kept only as a hash. It ends and is deleted when you sign out, sign out everywhere, reset your password or delete your account, and otherwise once it has gone unused for 60 days.
• Server logs: the log of requests to our website, account portal and server, at most 90 days. The server’s own request log is kept for at most 30 days.
• Image cache: each converted logo or poster, filed under a code made from its address and not under your device or account, up to 7 days from when it was converted, in memory and on disk. The address itself is never stored.
• Launch list: until that app’s launch email has gone out, or earlier if you unsubscribe. An address nobody confirms is deleted after 30 days (section 11).
• Support email: two years after our last reply.

16. How we protect your data

• Every connection to this website, the account portal and our server is encrypted with TLS.
• Playlist logins and links, and profile PINs, are encrypted with AES-256-GCM before they are stored.
• Passwords are stored as scrypt hashes, and pairing keys as hashes too. A one-time code is stored as a hash, with an encrypted copy so that asking again sends you the same code.
• The database keeps each account’s data apart with row-level security, so one account cannot read another’s, apart from a playlist its owner shares with it (section 7).

17. Your rights

Under the GDPR, you have the right to:

• See the personal data we hold about you
• Have it corrected
• Have it deleted, including your whole account
• Limit how we use it
• Receive it in a portable format. The app’s backup also exports your playlists and settings to a file.
• Object to our use of it on the basis of legitimate interest

To use any of these rights, email info@bitvire.com. You do not need an account email: if we reasonably need more to find your data, we ask only for what is necessary.

You can also delete your account yourself: in the phone app under Account, in the TV app under Settings › Account › Account & sync › Delete account, or by signing in at app.zirotv.com, choosing Delete account and confirming with your password. Whichever way you choose, we cancel any payments set up through Mollie, delete the account and confirm by email. Your payment records and order evidence are kept for seven years, no longer linked to your account, and so are your purchase confirmation emails, which hold your email address (section 15). If you bought a subscription in the phone app, it keeps running until you cancel it with Apple or Google, so cancel that as well.

We answer within one month. If a request is complex, we may take two more months, and we tell you so within the first month.

If you think we handle your data wrongly, please tell us first. You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in the EU country where you live.

18. Children

ZiroTV is not meant for children under 18, and we do not knowingly collect their data. Kids profiles in the app are a tool for parents. Without an account they stay on the device; with cloud sync on, they sync like any other profile (section 6).

19. No profiling, no selling

We do not use your data for profiling or advertising, we make no decisions about you by automated means that have legal or similarly significant effects, and we never sell personal data.

20. Changes to this policy

We update this policy when what we do with personal data changes. The date at the top of this page shows the current version. If a change affects you, we email you at least 30 days before it applies.

21. Contact

Questions about this policy or your data go to info@bitvire.com. For help with the app, email support@zirotv.com. Our full company details are on the contact page.