Privacy policy

What this policy covers

This policy covers the İlcan TV app and this website. The data controller is the company identified above.

The IPTV provider you connect to inside the app is not covered here: that is a separate company with a separate relationship with you, and its privacy notice is theirs, not ours.

What we never collect

This section comes first on purpose, because it is what most people actually want to know:

• Your provider details — your Xtream username, password and M3U list address stay on your device. They are never sent to our servers; the app connects straight to your provider.
• What you watch. Viewing history, favourites, resume positions and channel ordering are stored on your device and are not transmitted to us.
• Advertising and tracking cookies. There is no third-party analytics, pixel or ad network on this site.
• Your card details. Payment is taken on Stripe’s own page; the card number never touches our server.

What we do process

When you use the app and buy a licence, the following is recorded:

• Device record: a random device identifier generated by the app, the short code shown on your TV, the platform (Samsung, LG, Android…), device model, app version, first and last seen time, and IP address. On televisions also the network hardware address (MAC) — its only job is to stop a factory reset being used to claim a second free trial.
• Licence record: the licence key, the e-mail address you gave at checkout, the status of the licence and which device it is bound to.
• Payment record: Stripe’s payment and session identifiers, the amount, the currency, and the status and date of the payment.
• Site usage: your language preference and a form-security cookie, plus short-lived counters used to limit abuse (tied to your IP address).
• When you write to us: the e-mail correspondence itself.

Why we process it

• Performance of a contract: issuing the licence, binding it to the right device, sending you the key, and moving it when you change device.
• Legitimate interests: preventing abuse (one licence used on unlimited devices, the free trial claimed over and over, keys guessed to reach someone else’s licence) and keeping the service running.
• Legal obligation: retaining sales and VAT records for the period the law requires.

How long we keep it

• Payment and invoicing records: six years, as UK tax law requires.
• Licence and device records: for as long as the licence is valid. Because the licence does not expire this record is permanent — if you ask us to delete it, the licence stops working too.
• Records of administrative actions: two years.
• Abuse counters: a few hours at most.
• E-mail correspondence: two years.

Who we share it with

We do not sell data and we give it to nobody for marketing. The following providers are involved in making the service work:

• Stripe — taking payment. Your name, e-mail and card details go directly to Stripe; only the outcome of the payment comes back to us.
• TMDB — film and series metadata (posters, summaries, cast). Only the title is looked up; nothing identifying who asked is sent.
• Our e-mail and hosting providers — delivering your key and running the site.
• Competent authorities, where the law requires it.

International transfers

Stripe may process data outside the United Kingdom and the European Economic Area. Those transfers are made under the standard contractual clauses recognised by the UK and equivalent safeguards.

Your rights

United Kingdom data protection law (UK GDPR) gives you the following rights:

• To ask for a copy of the data we hold about you.
• To have inaccurate data corrected — if you mistyped your e-mail address, we fix that in a minute.
• To ask for erasure (except where we must keep records by law).
• To object to processing and to ask for it to be restricted.
• To receive your data in a portable format.
• To complain to the supervisory authority. In the United Kingdom that is the Information Commissioner’s Office (ICO), ico.org.uk.

To exercise any of these, simply write to the address below. We reply within one month.

Cookies

There are three cookies on this site and all three are strictly necessary: one that remembers your language, a security cookie that stops forms being submitted by forged requests, and a session cookie that only exists for people who sign in to the admin panel.

Because we use no advertising, measurement or profiling cookies, there is no cookie consent banner either.

Children

The product is not aimed at children and we do not knowingly collect data from anyone under 16. The kids profile feature in the app is a setting a parent configures on their own device; it sends us nothing.

Changes

If this policy changes, the effective date above is updated. For a material change we notify licence holders by e-mail.

Contact

For any privacy question or request, write to the e-mail address below.