Privacy Policy

Last updated: 30 October 2026 · applies to all Sidstuga versions: Google Play, Amazon and sideload.

One-line summary

Everything you add to the player, credentials, URLs, favourites, settings, stays on your device by default. No ads, no sign-up required to use the app. Anonymous diagnostics (crash reports and coarse usage metrics) are sent by default and are described below under Diagnostics. Two opt-in features send more: Cloud Sync (encrypted backup) and the Source manager (web pairing for your playlists / sources).

Cloud Sync (Premium) is an optional feature. If you choose to enable it, we collect your email address and use it only to identify your account. Your password never leaves the device: keys are derived locally via Argon2id. Favourites and watch history are end-to-end encrypted before leaving the device; we cannot read them. The sync backend runs on Cloudflare Workers (region: Western Europe) atsync.sidstuga.app. Sign out from the app to remove local sync data; the encrypted vault on the server is removed when you delete the account.

Source manager (web pairing)

Optional. If you open sidstuga.app/cloudsyncand pair it with your device, the device sends, and the web page later reads, a list of source URLs you have added (M3U playlist URLs and Xtream Codes provider URLs). Pairing is anonymous: there is no account, only a randomly generated 6-character code that exchanges for an opaque group token.

• What we store, per group: a device label, device model, app version, and an SHA-256 hash of the IP that requested pairing. M3U URLs are stored in plaintext. Xtream Codes URL + username + password are stored AES-256-GCM encrypted at rest under a key derived from the group token (the server can decrypt while the token is in transit; the encryption defends against database dumps, not against compromised server code).
• Region: Cloudflare D1, Western Europe.
• Retention: rows stay until you tap "Unpair" on the web manager or in the app. Unpair tombstones the row and the server hard-deletes it after a 7-day grace window.
• What we never store: stream content, channel lists pulled from your provider, watch progress, or anything outside what is needed to manage source URLs.

What we DO NOT do

• We don't run our own server collecting your data by default: the only data that leaves the device automatically is the diagnostics, metrics and ad-attribution data described below. Cloud Sync is opt-in and end-to-end encrypted.
• No third-party advertising or attribution SDKs: no AppsFlyer, Adjust or Branch. (The Google Play build measures Google Ads campaign conversions through Firebase, see Diagnostics below, but shows no ads.)
• No ads in the app: no advertising SDKs are bundled, and no personalized advertising inside the app. (This website is separate: if you accept the cookie banner there, Google's advertising cookies include personalisation see Cookies on this website.)
• No account or sign-up required to use the app: you only create an account if you opt in to Cloud Sync.
• We don't access your calendar, contacts, photos, or microphone: the app doesn't request those permissions.

What the app stores on your device

Sidstuga stores locally, encrypted where applicable:

• The Xtream Codes credentials or M3U URL/file you add (encrypted via EncryptedSharedPreferences, native Android keystore).
• App preferences (language, channel order, favourites, reminders, parental PIN hashed with SHA-256 + salt).
• "Last channel watched" history to resume on reopen.

This data never leaves the device. When you uninstall the app or clear data via Settings → Apps → Sidstuga → Storage → Clear data, it's all gone. We have no copy anywhere.

Diagnostics & anonymous metrics we collect

To keep the app stable and understand how it's used, Sidstuga sends a small amount of anonymous diagnostic data. None of it can identify you, and it never includes your playlists, credentials, or what you watch.

• Firebase Crashlytics (Google Play build only): on a crash, an anonymous report: stack trace, device model, Android version, app version. No credentials, no playlist URLs, no personal identifiers.
• Firebase Analytics (Google Play build only): basic aggregate usage events tied to an anonymous, app-generated instance ID. To measure which Google Ads campaign brought an install or purchase, this build also allows Google's advertising identifier and ad-conversion measurement (Consent Mode: ad_storage and ad_user_data granted). Ad personalization stays OFF (ad_personalization denied) and the app shows no ads: this data is used only to attribute conversions to our own Google Ads campaigns.
• Sidstuga anonymous metrics (all builds): the app sends coarse operational and product metrics to our own server (metrics.sidstuga.app): a random install ID generated on your device (not your Advertising ID, no fingerprinting), the device type (TV / phone / tablet), app version, an approximate country (from your IP at the network edge: the IP itself is never stored), app-open / session / heartbeat liveness pings, a fixed set of product events (e.g. "paywall shown", "checkout started"), coarse error codes, and: once verified with Google or Amazon: your subscription status (trial / active / expired). We never receive your card or billing details. Install counts are approximate; the official figures are in Google Play / Amazon.
• Ad attribution (installs from Google Play): when the app is installed from a Google Ads ad, the Play Install Referrer tells the app which ad click brought the install. If you accept the measurement request, the app sends that click ID (gclid) and the raw referrer text to our server, together with a one-way hash of the device identifier (SHA-256 of the Android ID and the package name; the Android ID itself never leaves the device). Our server then also tells Google Ads, once, that this click led to a free-trial start or a purchase (an opaque order ID, the time and the click ID: no name, email, account, playlist or viewing data). If you decline, the click ID and the referrer text are not sent to us, the measurement does not carry the hash, and nothing is sent to Google Ads. The same hash is still used, separately, to run the free trial and to check a subscription, because both need to recognise the device; without a click ID it cannot be tied to any ad. If you accepted, the click ID and the hash stay in our analytics database while the install is active and you can ask us to delete them at any time. If you declined, the only identifier we keep is the device code of the trial and the subscription, a pseudonym that we cannot link back to you ourselves, so we may not be able to find it in order to delete it.
• Crash & app-freeze reports (all builds, including sideload): if the app crashes, freezes ("app not responding"), or is closed by the system for running low on memory, it sends us an anonymous technical report the next time it opens: what kind of error it was, a technical trace of where it happened (credentials and personal data are stripped before it ever leaves your device, and the internal class names in that trace are scrambled by our build's code-shrinking step in every build we ship, not just Play Store, so they are not human-readable), device model, Android version, and how much memory/ storage was free at the time. This is separate from Firebase Crashlytics above: it exists so we also get crash data from the Amazon and sideload builds, which don't have Firebase at all.

Google processes the Firebase data as a data processor: see Firebase's privacy documentation. The Sidstuga metrics and crash reports are processed by Cloudflare on our behalf and stored in the EU. All of it is anonymous. Crash data reported through Firebase is retained by Firebase for up to 90 days; our own crash reports are retained for 90 days as well. Raw Sidstuga metrics are deleted automatically (heartbeats after 7 days, events after 30 days, error logs after 90 days) and only anonymous daily aggregates are kept longer.

Network traffic

The app talks directly to whichever IPTV server you configure. That traffic is between your device and your provider: we are not intermediaries for your streams, playlists or credentials, and we don't see or log any of it.

Titles, artwork, ratings and subtitles go through our server. When you browse movies and series, the app shows posters, descriptions, cast, ratings and subtitles. In the newest version of the app these lookups go through our server (sync.sidstuga.app, Cloudflare Workers, Western Europe) instead of straight from your device to each provider. This way no provider key is inside the app and the results are shared and cached for everyone. The providers behind it are TMDB (artwork and descriptions), MDBList (ratings), Fanart.tv (logos and artwork), OpenSubtitles, SubDL, SubSource and Gestdown (subtitles) and, only if you connect your account, Trakt.

• What our server receives: the title identifiers or the search text, the language, and for subtitles the title, episode and release name. If you connect Trakt, it also receives the sign-in token that Trakt itself issued to you, which is passed on to Trakt in the same request and is never stored or cached by us. Your IPTV credentials, playlist URLs and channel lists are never sent.
• What we keep: public results (a poster, a rating, a subtitle list) are cached by title for hours or days, with no link to you. We do not log these requests. To block abuse, the server keeps a counter per IP address that deletes itself within about two minutes.
• What the providers see: our server, not your device. They never receive your IP address or any identifier of yours, with two exceptions: Trakt, which knows the account you connected, and the optional setting "Covers with ratings", which still loads the cover images straight from the RPDB service, so RPDB sees your IP address while it is on.

Optional exceptions:

• Update checksthe public version uses Google Play's official In-App Updates API; the Android system makes the call, not us.
• EPG / catch-up / VODwhen you browse, the app asks your IPTV server for those resources. Traffic strictly between your device and your provider.
• Purchases & subscriptionshandled entirely by Google Play Billing. Google processes the payment; we never see your card details or billing address.
• Diagnostics & metricsthe anonymous Firebase reports (Google Play build) and the anonymous Sidstuga metrics described above, sent to metrics.sidstuga.app.
• Subscription verificationafter a purchase, the app asks our server to confirm the subscription with Google/Amazon so your access survives network or store outages. Only the purchase token and your anonymous install ID are sent: never card or billing data.

Permissions

• INTERNETto play streams.
• ACCESS_NETWORK_STATEto detect connection drops and auto-reconnect.
• POST_NOTIFICATIONS (Android 13+): only if you enable reminders.
• SCHEDULE_EXACT_ALARMonly for exact-time reminders.
• RECEIVE_BOOT_COMPLETEDonly if you have reminders, so the app can re-arm them after a device reboot.
• SYSTEM_ALERT_WINDOWheld only as a background-activity-launch exemption for the optional "auto-start on boot" feature (Android TV). The app draws no overlay windows.
• com.android.vending.BILLINGrequired by Google Play to process subscription purchases.
• CameraWhen you choose to link a TV, the app uses your device's camera only to scan the pairing QR code shown on your TV. The image is processed on your device and is never stored, uploaded, or shared.

We don't request the contacts, calendar, location, photos, or microphone permissions. Firebase Analytics and our metrics server infer your approximate country from your IP address (see Diagnostics above): that's all the location information we ever see, and only if you haven't opted out.

Cookies on this website

This section is about sidstuga.appthe website you are reading right now. The app itself uses no cookies at all.

Strictly necessary. sidstuga_locale holds the language this site is showing you. On your first visit it is a guess made from your approximate location, not a choice you made; from the moment you pick a language yourself it holds that instead. First-party, expires after one year, and set on the language-specific pages whatever you answer to the banner without it the site cannot keep showing you the language you are reading.

Measurement and advertising: only with your consent. We use Google Analytics 4 to see which pages are actually useful, and Google Ads to know which advert brought someone who went on to buy. Both run through Google's gtag.js under Consent Mode v2.

Before you answer the banner, and if you decline: nothing is stored on your device and no advertising identifier exists. Your browser does send Google a measurement signal that carries no cookie and no identifier: enough to count that a page was visited, never enough to recognise you, here or on any other site.

If you accept: Google sets its analytics and advertising cookies (typically _ga, _ga_* and _gcl_*), which is what lets us tell one visit from another and match a purchase to the advert that produced it. Advert personalisation is part of that consent.

We show no adverts on this website, and we sell your data to nobody.

Kept by the site itself, and never sent to us. These live in your browser's local storage, on your device: sidstuga_consent, your answer to the banner, so it is not asked again on every page; sid-lang-routed and sid-lang-manual, which stop the language redirect fighting a language you picked by hand; sidstuga_purchase_…, written on the confirmation page after a purchase, only if you accepted, so that reopening that link does not count the same sale twice; and, on the reseller pages only, sid_reseller_token, which keeps you signed in there.

Changing your mind. Reopen the cookie banner and answer again: it takes the same one click the first answer took, and the new answer applies immediately.

What Google does with what it receives is set out in How Google uses information from sites that use its services.

Data deletion

Almost everything stays on your device. To wipe it:

1. Go to Settings → Apps → Sidstuga → Storage.
2. Tap Clear data.
3. (Optional) Uninstall the app.

For the anonymous Firebase diagnostics, email support@sidstuga.app and we'll delete your records from the Firebase console; otherwise crash data expires automatically after 90 days.

For the anonymous Sidstuga metrics (including our own crash/app-freeze reports), e-mail support@sidstuga.app with your app version, your device model and, if you subscribed, your Google Play order number (the app does not display the anonymous install ID), and we'll find the rows we can link to you and erase them; otherwise the raw data expires automatically as described above.

Third-party content & user responsibility

Sidstuga is a media player. It is not a content provider, host, distributor or aggregator. The app does not include, recommend, index or distribute any IPTV streams, channel lists or media files of any kind.

To use the app you supply your own credentials (Xtream Codes) or playlist (M3U/M3U8) of a service you are independently authorised to access. You are solely responsible for ensuring such use complies with applicable law, the terms of your IPTV provider, and any relevant copyright. To the extent permitted by law, the developer disclaims all liability for any third-party content streamed via user-supplied sources.

Children

The app is not directed at children under 13. We don't collect personal data, and the Firebase diagnostics described above are anonymous.

Changes to this policy

If we change this policy, the date at the top changes. For a copy of a previous version, email support@sidstuga.app.

Contact

support@sidstuga.app