Legal

Privacy policy

What Telyqro collects when you use its apps and this website, why, who else sees it, and how to get it deleted.

Effective 1 November 2026

Who we are

Telyqro is run by Nativ, Israel (“we”, “us”). We are responsible for the personal data described here. Telyqro consists of the Telyqro apps (Android, Android TV, Fire TV, Windows, macOS, Linux, Samsung and LG TVs), this website (telyqro.com) and the service behind them (api.telyqro.com).

For anything about privacy, write to [email protected]. Please include your Device ID (shown in the app) when your question is about a device.

What we collect and why

The app registers your device with us the first time it starts. From then on it contacts our servers to check your trial or plan, receive playlists you added on this website, check for app updates and back up your preferences. This is everything our servers keep:

Data	Why	Where it’s kept
Device ID (looks like a MAC address, e.g. `a1:b2:c3:d4:e5:f6`) and Device key	Identify your device, attach your trial and plan to it, and let you sign in on this website.	Our database. The Device key is encrypted.
Device fingerprint: a one-way SHA-256 hash of your device’s platform ID, with the platform (e.g. Android TV) and the store the app came from	Recognize the same device after a reinstall, so it keeps its Device ID, playlists and plan, and the free trial runs only once.	Our database. The platform ID itself never leaves your device.
Device public key	Check that requests really come from your device. The matching private key stays on the device.	Our database.
Device details: model, operating system version, app version and build, when the device first and last contacted us	Compatibility, app updates, support, and notices meant for certain devices or app versions.	Our database.
IP address	Security and abuse prevention: rate limits, sign-in protection, investigating misuse, support.	The device record keeps only the latest one. It is also part of security log entries (registration, sign-ins), website sessions and server logs. See retention.
Trial and plan: trial dates, plan (Yearly or Lifetime), start and end dates, how it was activated (PayPal, crypto, a reseller or us)	Decide whether the app is unlocked, and show your status in the app and on this website.	Our database.
Playlists you sync: name, type, Xtream server address, username and password, M3U and EPG URLs, a PIN-protection flag, and M3U files you upload	Deliver the playlists you add on this website (or in the app) to your device.	Our database. Passwords, M3U URLs and EPG URLs are encrypted; the server address and username are not. Uploaded files are kept on our own file storage. We never download your playlists or channel lists.
Preferences backup: app settings, favorites and favorite groups, parental locks, lineup changes (renamed, hidden or moved channels and groups) and your parental PIN as a salted hash	Restore your setup automatically after a reinstall of the app on the same device.	Our database, encrypted. Favorites and locks are stored as catalog keys, not channel names or URLs. Our admin tools show only its size and date.
Website sessions: a sign-in token (stored only as a hash), its expiry, your IP address and browser name (user agent)	Keep you signed in on this website, and spot sign-ins that aren’t yours.	Our database, and an httpOnly cookie in your browser.
Your account (only if you create one): email address, password (stored only as an Argon2 hash, never readable), whether the email is confirmed, when the account was created and last used, and which devices are in it. Confirm and new-password links are stored only as a hash and stop working after 48 hours and 1 hour.	Let you sign in with your email, see and manage all your devices in one place, and set a new password if you forget it.	Our database. The emails go out through Amazon Web Services (see Who else receives data).
Plan moves: when a plan moved from one device to another, and whether you, your account or our support moved it	Allow one move a day, and help when a plan seems to have gone missing.	Our database.
Payment records: provider, order and transaction IDs, plan, amount, currency, status, dates, and the device the purchase was for	Activate the plan you paid for, and handle refunds, disputes, accounting and tax.	Our database, together with the payment notifications PayPal and our crypto checkout send us. See Payments.
Security log: what happened, when, by whom (a device, a reseller or our staff) and from which IP address, for events such as registration, sign-in, playlist changes, purchases and plan changes	Investigate abuse and errors, and keep an accountable record of changes to licenses and payments.	Our database.
Messages you send us: your email address and what you write	Answer you.	Our mailbox.

We use this data only to run Telyqro: register and license your device, deliver your playlists, keep the service secure, provide support and meet our legal obligations (such as keeping payment records). We don’t use it for advertising, we don’t build profiles of what you watch, and we don’t sell it.

If you buy through a reseller, the reseller gives us your Device ID to activate your plan. A reseller can look up a device by its Device ID and see its platform, model, app version, when it was first and last seen, and its trial or plan status. Resellers never see your playlists, preferences or IP address. For reseller accounts themselves, we keep the reseller’s name, email address, password (as a hash), two-factor secret (encrypted) and credit history.

What stays on your device

The following is stored by the app on your device only. It is never sent to us:

Your device’s platform ID (for example Android ID, Windows MachineGuid, or the TV’s unique ID). The app sends only its one-way hash.
The device’s private key, used to sign requests, kept in the platform’s secure storage where there is one (Android Keystore, Keychain, Windows DPAPI, libsecret).
Channel lists, movies, series and the TV guide downloaded from your provider, and cached channel logos.
Watch history, Continue watching and episode progress.
Playlists you add only in the app while it can’t reach us (normally playlists you add in the app are also synced through us, see the table above).
The app’s log file (logs/telyqro.log, about 2 MB at most) for troubleshooting. Provider logins in stream addresses are masked before anything is written. The app never uploads it; you can choose to send it to us when you ask for help.

Favorites, parental locks, lineup changes and settings are stored on your device and also backed up to us as described above. Your parental PIN is never stored or sent in readable form, only as a salted hash. Uninstalling the app (or clearing its data) deletes what it stored on the device.

Your provider and your streams

Telyqro provides no TV channels, films or other content, and we have no relationship with your IPTV provider. When you watch something, the app connects directly to your provider’s servers to fetch channel lists, the TV guide, logos and the streams themselves. That traffic does not pass through Telyqro, and we don’t see what you watch.

Your provider therefore receives your IP address, your login and the requests your device makes, under the provider’s own terms and privacy policy. Please make sure you have the right to use the playlists you add.

The website and cookies

Cookies. Signing in with your Device ID and Device key sets one session cookie (tg_portal). It is httpOnly (page scripts can’t read it), sent only to our own address, expires after 12 hours and is removed when you sign out. Signing in to your account with your email sets a similar cookie (tg_customer) that lasts 7 days. Resellers and our staff get a similar cookie when they sign in. The Google Analytics, Cloudflare and PayPal components described below may set their own. Your answer to the cookie question is kept in your browser’s storage (tq_consent).
Analytics. The public pages of this website use Google Analytics 4 to count visits and see which pages and downloads people use: the page address (without anything after the ?, so never a Device ID), the page before it, your browser, device type, approximate location derived from your IP address, and clicks on download buttons and completed purchases (plan and price). Google Analytics does not log or store IP addresses. It sets cookies named _ga and _ga_… that last up to two years. In the EU, the EEA, the UK and Switzerland it sets them only if you choose Accept; elsewhere it sets them unless you choose Decline. Without cookies it sends only cookieless pings with no identifier. Advertising features, Google signals and ad personalization are off. The account, admin and redeem pages send nothing to Google Analytics. Google processes this data for us as a processor; reports are kept for 14 months. You can change your choice by clearing this site’s data in your browser, or block it with Google’s opt-out add-on.
Fonts. The website loads its fonts from Google Fonts. Your browser then sends Google its IP address and browser details, as with any web request.
Bot check. The sign-in form uses Cloudflare Turnstile to tell people from bots. Turnstile collects technical information from your browser, and we pass your IP address to Cloudflare to check the result.
Checkout. The PayPal buttons load from PayPal only when you buy a plan with PayPal.

Like any web server, ours also log requests (see retention).

Payments

You buy plans on this website; the apps contain no in-app purchases. We never see or store your card number, bank details, PayPal login or crypto wallet keys.

PayPal. You pay on PayPal’s own forms. PayPal processes your payment details under its own privacy statement. We send PayPal the plan, the price and your Device ID (in the order description). PayPal sends us the order and transaction IDs, the amount and the status, including later refunds or disputes. We keep these notifications as received.
Crypto (Bitcart). Crypto payments go through a Bitcart checkout. We send it the plan, the price and your Device ID, and read back the invoice status. Payments on a public blockchain are visible to anyone, permanently; that is how blockchains work and outside our control.
Resellers sell plans under their own terms. What a reseller learns about you when you pay them is up to them and is not covered by this policy.

How long we keep it

Device record, plan, synced playlists and preferences backup: as long as you use Telyqro on that device, or until you ask us to delete them. We don’t delete inactive devices automatically.
Playlists: until you remove them on this website or in the app. Removing an uploaded M3U playlist also deletes the file.
Trial record (fingerprint hash and trial dates): kept, so the free trial can’t be restarted by reinstalling.
Website sessions stop working after 12 hours (7 days for an account, 8 hours for resellers and staff) or when you sign out. Sign-ins (with IP address and browser) stay in our security log.
Your account: until you delete it. Your devices then keep their plans and playlists.
Replay protection and rate limits: short-lived counters, gone within an hour.
Security log: kept for security and fraud investigation. We don’t yet delete it on a fixed schedule.
Payment records: as long as accounting and tax rules, refunds and disputes require.
Google Analytics reports: 14 months.
Server logs (IP address, the address requested, browser or app name, time): kept only as long as our hosting’s log rotation keeps them, and used only to run and secure the service.
Backups of our database may hold deleted data until they are replaced by newer backups.
Emails: as long as needed to handle your request.

How we protect it

All traffic between the apps, this website and our servers is encrypted with HTTPS.
Playlist passwords, M3U and EPG URLs, Device keys, preferences backups and two-factor secrets are encrypted at rest with AES-256-GCM, each value with its own key. Those keys are in turn protected by a key held in Amazon’s key management service (AWS KMS).
Your device’s hardware or platform ID never leaves the device; we only receive a one-way hash of it.
The app signs its requests to our API with the device’s private key, and a signed request can’t be replayed. Website sessions are stored only as hashes and live in httpOnly cookies.
Sign-in is protected by a bot check and rate limits. Staff accounts require two-factor authentication, and resellers can turn it on. Our logs filter out passwords, keys and playlist URLs.
Uploaded M3U files sit in private storage, reachable only through links that expire after an hour.

No system is perfectly secure. If a breach affects your data, we will act on it and notify the authorities, and tell affected users through the app or this website, as the law requires.

Your rights

Depending on where you live, you can ask us to:

access the data we hold about your device, and get a copy of it;
correct data that is wrong;
delete your data (see below);
object to or ask us to restrict how we use it.

Under Israel’s Privacy Protection Law, 5741-1981, you may ask to see the information about you held in a database and to have it corrected or deleted. If you are in the European Union, the European Economic Area or the United Kingdom, you have the rights given by the GDPR (or the UK GDPR), including the ones above and data portability.

To make a request, email [email protected] with your Device ID. Requests are handled by email; there is no self-service export. Because there are no accounts, we may ask you to show that the device is yours, for example by signing in on this website with its Device key. Never send us your Device key or provider password by email. We aim to reply within 30 days.

You can also complain to a data protection authority: in Israel, the Privacy Protection Authority at the Ministry of Justice; in the EU or EEA, the authority where you live or work; in the UK, the Information Commissioner’s Office (ICO). We’d appreciate the chance to fix the problem first.

Deleting your data

Playlists: sign in with your device and remove them under Playlists, or delete them in the app.
Your account: sign in with your email and choose Delete the account under Password and account. Your devices leave it and keep their plans.
Data on your device: clear the app’s data or uninstall it.
Everything we hold about a device: follow the steps on Delete your data: email [email protected] from any address, with the Device ID and Device Key. Uninstall the app first: a running app registers the device again. We then delete, or make anonymous, the device record, its playlists and uploaded files, its preferences backup and sessions.

We may keep what we must or need to: payment records for accounting, tax and disputes; the trial record so the free trial isn’t repeated; security log entries; and a reseller’s record of credits spent on the device. A plan bought for a deleted device can’t be restored afterwards.

Children

Telyqro is not directed at children under 16, and we don’t knowingly collect personal data from children under 13 (or under 16 in the EU and UK). The app has parental locks so families can share it. If you believe a child has given us personal data, write to [email protected] and we will delete it.

International transfers

We operate from Israel, and our servers are run by our hosting provider. Cloudflare, Google, PayPal and AWS may process data in the United States or other countries. The European Commission recognizes Israel as providing adequate protection for personal data. Where data goes to other countries, we rely on our providers’ safeguards, such as the EU’s Standard Contractual Clauses.

Changes to this policy

When Telyqro changes what it collects, we update this page and the effective date at the top. If a change matters, we will also say so on this website or in the app before it takes effect.

1 November 2026: the website’s public pages now use Google Analytics, with a cookie choice. The apps are unchanged.

1 November 2026: optional accounts (email and password) to manage several devices, with emails sent through Amazon SES, and moving a plan to another device once a day.

This version took effect on 1 November 2026.