Your privacy, in your control.

This policy applies to the UR-EY Player website (ureyplayer.com) and the Android, Android TV, Meta Quest and Samsung Tizen apps. UR-EY Player is a media player; it does not provide streams, channels, movies or series. It only plays the stream sources you add.

Data controller and contact

Data controller: UR-EY Player. For privacy questions and requests to access, correct or delete data: [email protected].

Data we collect

Account details: username, email address, an irreversible hash of your password, optional passkeys, the time you accepted the membership terms and your language choice.
Stream profiles: the Xtream Codes server address, username and password, or the M3U link you add. They are encrypted on the server with AES-256-GCM.
App activity: favorites, watch progress and history, searches, category and channel order, app settings and the name of the channel being watched.
Device and security details: an app-specific hashed device ID, device name, session times, IP address and browser/app details (user agent), and a log of sign-ins and security actions.

We do not collect location, contacts, photos, microphone, camera or payment data. We use no ads, no advertising ID and no analytics or tracking tools. We do not sell data or share it for advertising.

Why we process data

To create your account and sign you in, pair your devices with a QR code, sync your profiles, favorites and progress across your devices, protect your account and devices against misuse, and send service emails such as password resets.

Where data goes

Your stream provider: the app and web player connect to the server you add with your details. That connection is subject to the provider's own privacy terms.
The Movie Database (TMDB): to show posters, synopses and ratings, the app sends content titles to TMDB. No account details are sent.
YouTube: when you watch a trailer it opens through youtube-nocookie.com.
Infrastructure: the site runs through the Cloudflare network and on a server at our hosting provider. All connections are encrypted with HTTPS.

How it is protected

Stream profiles and app records are encrypted on the server with AES-256-GCM; the encryption key is kept apart from the database. Account ownership is checked on every request. The QR code does not contain your password; it starts a short-lived pairing. This is not end-to-end encryption: the server can decrypt your records to serve them to you. We never write your passwords or provider details to logs. Profiles saved in the app are encrypted with the Android Keystore.

Retention and deletion

Account data is kept until you delete your account. Sessions expire after 30 days without use. You can delete your account at any time following the steps on the account deletion page: your account, profiles, watch history, device connections and security logs are deleted immediately. Deleted data leaves the limited set of server backups as those backups are renewed. The app's local data on a device is removed when you uninstall the app.

Your rights

You have the right to access, correct and delete your data and to object to its processing (KVKK art. 11 and GDPR). You can manage your profiles, layout and open sessions yourself in your account panel; for other requests, email us.

Children

The service is not intended for anyone under 18.

Changes

When we update this policy we change the version date above.

If a translation differs from the Turkish original, the Turkish text applies.