TTV Privacy Policy

This policy covers TTV: Car TV & IPTV Cast Player for iPhone, iPad, Mac, Apple TV and Apple Watch, with its CarPlay app, widgets and notification extension, published by Turbo Ventura of Dubai, United Arab Emirates. It is the policy referenced by the app’s App Store listing.

The company and this website are covered by our general privacy policy; where the two overlap, this page is the more specific and it governs the app.

For anything here, write to [email protected].

TTV includes no channels, playlists, subscriptions or streams, and it sells none. It plays what you add to it: a playlist or login from a provider you chose, or your own Jellyfin, Emby or Plex server. We have no relationship with your provider, and we cannot see what your playlist contains.

Everything TTV knows about what you watch is kept on the device, and none of it is sent to us:

• Your playlists, their addresses, the channels, films and series in them, and their guides.
• Your favourites, history, resume points, reminders, hidden categories and recent searches.
• Your downloads.
• Your provider and server logins.

Where each thing is kept

• Passwords and sign-in tokens — Xtream Codes passwords and media-server tokens are held in the iOS Keychain, on this device only; they are not synced to your other devices.
• Playlists — each source’s name, server or playlist address, user name and guide address are kept in the app’s own storage. An M3U link is kept as you entered it, so any login written into the link is kept with it. A downloaded playlist and the last catalogue and guide built from it are kept in the app’s cache, so the app opens on them at once; channel logos and posters are cached for up to thirty days.
• Xtream Codes stream addresses are put together when you press play and are not stored.
• Downloads stay in the app’s Documents folder and are left out of your iCloud backup.

Deleting the app removes all of it, apart from the identifiers described in section 5.

A stream travels from your provider or your server straight to the screen you chose. It does not pass through anything of ours.

• Playback — the device requests the stream, the guide and the artwork from the addresses in your playlist. Your provider sees those requests, with your IP address, as it would from any player.
• Chromecast — while the Cast screen is open, TTV looks for Chromecast devices on your local network. When you cast, the TV is sent the stream’s address (which, for an Xtream Codes channel, contains your user name and password, because that is how such addresses are built), the title and the artwork address, and fetches the stream itself. Before casting, the app asks your provider’s server whether it allows Chromecast playback. The receiver app on a Chromecast is Google’s, and runs under Google’s terms.
• AirPlay uses Apple’s system picker and sends the picture to the device you choose.
• CarPlay shows your favourites, channels, recents and playlists on the car’s screen and plays through it. What is playing is shown on the Lock Screen, in Control Center and on the car, as for any media app. Nothing is sent to us.
• Screen mirroring sends what is on your screen to the car display or TV you choose, directly, for as long as you leave it on. It is not recorded, and nothing is sent to us.

TTV talks to one server of ours, app.turbocloud.systems, for what a player cannot do alone: notifications, support conversations, messages inside the app, telling an old version that an update is needed, and recording a purchase. There is no account on it and nothing to sign in to. It never receives your playlists, your logins, the channels or titles you watch, or anything else about your viewing.

How the app is known to it

The app creates random identifiers on the device. None is derived from you, your hardware or the advertising identifier:

• a device ID, kept in the iOS Keychain. It stays the same if you delete and reinstall the app, and our other apps on the same device use the same one;
• an account ID, which iCloud Keychain, if you use it, carries to your other devices so they are recognised as one owner. It is not your Apple Account and says nothing about who you are;
• an installation ID, new with every install, and a secret that proves later requests come from this installation.

What is sent, and when

• An installation record, each time you open the app, when one of the values below changes: the identifiers above; Apple’s identifier for vendor (IDFV); the advertising identifier (IDFA) only if you have allowed tracking, and the answer you gave; device model (never the device’s name), iPhone, iPad or Apple TV, OS version, app version and build, the app’s language and your time zone; the notification token Apple issues for this device and whether notifications are allowed; and, for our other apps that have run on this device, which ones, when each was first and last opened, its version and whether it is still installed.
• App settings — which version is current. This request carries the app version, language, OS version and device type, and no identifier.
• Messages inside the app — once each time you open it, the app asks whether we have one, sending the device ID, app version, language, OS version and device type. When one is shown, it reports that it was seen, which button you pressed, or that you closed it. Messages never appear over the player, the lock or a screen you are using.
• Notification events — when you tap one of our notifications or one of its buttons, the app reports which; when one arrives, the notification extension reports that it was delivered.
• Purchases — see section 8. Support conversations — see section 7.

Like any server, ours sees the IP address a request comes from, and works out from it the country the installation is in. The app never sends your name, e-mail address, phone number, contacts or location.

When nothing is sent

• Until our server confirms that this version of the app is one we released and have left switched on. That first question carries only the app version.
• While the app’s passcode lock is on. What was waiting is sent after you unlock; the only exception is the notification extension, which can report a notification as delivered while the app is locked.

We send two kinds of notification: replies to your support conversations, and occasional notices about the app. The app asks for permission only when it is useful to you — after you send a support message, or when you set a programme reminder — and never when it opens. The Apple TV app never asks; it only updates its badge.

A notification can carry a picture: the notification extension downloads it from the secure address in the notification, without cookies, and the server that hosts it sees your IP address. You can turn notifications off at any time in Settings › Notifications › TTV.

Programme reminders are local. The reminder, with the programme’s title and channel, is scheduled on the device by iOS and never sent to us.

On iPhone and iPad, Contact Us opens a conversation inside the app. What you write — the topic you pick, a subject for the first message, your message, and a picture if you choose to attach one — goes to our own server over HTTPS, and our reply comes back to the same screen. The picture is chosen with the system photo picker, which gives the app only the one you pick, and it is re-encoded on the device so its location and other metadata are removed before it is sent. No e-mail address is asked for, and the app adds nothing to your message; we read it alongside this installation’s record (section 5), which is how a reply finds its way back. Please never send us your provider password — we will never ask for it.

When the conversation cannot be offered — no connection the first time the app runs, or this version has been switched off — Contact Us opens your own mail app instead, addressed to [email protected], with the topic and message you wrote. The app version, OS version, device model and language are added only if you leave that switch on. You send that mail yourself; we receive only what you send.

On Apple TV, support points you to the app on your iPhone or iPad.

Purchases are made through Apple’s In-App Purchase system using StoreKit. Apple takes the payment and holds the payment details; we never see your card, your billing address or your Apple Account credentials. Refunds are handled by Apple at reportaproblem.apple.com.

When a purchase moves money — a new subscription or lifetime unlock, a renewal, or a refund — the app reports it to our own server: the product, its price and currency, Apple’s transaction number and whether it was a real or a test purchase, together with this installation’s identifiers. Restoring a purchase, reinstalling and Family Sharing are not reported. A report waits, encrypted on the device, until the app is unlocked and online. It carries nothing that names you.

• Jellyfin and Emby — your user name and password, or the Quick Connect code, go only to the server address you entered, and the token it returns is kept in the Keychain.
• Plex — signing in uses Plex’s own PIN flow at plex.tv, which is told the app’s name and a random identifier for this installation of TTV, and returns your servers. Plex handles that under its own privacy policy.
• As every client of these servers does, TTV tells your own server when you start, pause and stop a title, so it can keep Continue Watching, Next Up and what you have watched. Those reports go only to your server.

These run on your own devices and send nothing to us.

• Apple Watch — the phone passes the watch what is playing, up to eight favourite channels with now and next, what is live and your downloads’ progress, and the watch sends back only remote-control presses. While the app is locked, the watch is told only that it is locked.
• Widgets — the app leaves a small summary for its widgets in storage shared only with them: favourite channels with now and next, live programmes, Continue Watching titles, downloads and the playlist’s name. Widgets on the Lock Screen can be seen by anyone holding the phone; choose them with that in mind.
• Control Center — the Live TV control only opens the app.

The passcode and the parental PIN are held in the iOS Keychain on the device, and Face ID, if you turn it on, is matched inside iOS. The recovery code is shown to you once, when you set the passcode, and is not sent anywhere — keep it somewhere safe.

To understand which parts of the app are used and where it fails, TTV sends usage events through Google Analytics for Firebase, and crash diagnostics through Firebase Crashlytics. Google acts as our processor for both.

What is sent

• That the app was opened, which screens are used, and feature events carrying only counts and kinds — that a playlist was added and of which type, that casting or CarPlay was used, that a download finished, and a coarse reason when something failed.
• Device model, OS version, app version, language and country, plus a pseudonymous app-instance identifier generated by Firebase.
• For a crash: the stack trace, the app state at that moment, and the same device fields.

What is never sent

No playlist or server addresses, user names or passwords, channel names, programme or film titles, and nothing you have typed. We never call Firebase’s user-identifier API, so events cannot be tied to a person. Google retains this data for a bounded period and processes it under its own terms.

The free version can show advertising supplied by Google AdMob, and by the mediation partners AdMob may pass a request to when it does not fill an ad itself: AppLovin, Pangle, Liftoff Monetize, DT Exchange and InMobi. Each is an independent controller of the data it receives, under its own policy:

• Google (AdMob)
• AppLovin
• Pangle
• Liftoff Monetize
• DT Exchange (Digital Turbine)
• InMobi

To request, show and measure an ad, these SDKs may process your device’s advertising identifier (IDFA, only if you allow it), the IDFV, IP address, device and operating-system information, a coarse location derived from that IP address, and your interaction with the ad. Nothing from your playlists or your viewing is ever part of an ad request. If you allow tracking, the advertising identifier also goes to our own server with the installation record (section 5).

• App Tracking Transparency. iOS asks your permission before the advertising identifier may be used. Decline and ads are non-personalised. You can change the answer in Settings › Privacy & Security › Tracking.
• Consent in the EEA, the UK and Switzerland. Where required, Google’s consent form (UMP) is shown before personalised advertising is enabled, and your choice is passed to the partners above.

Each request happens only when you use the feature that needs it, and declining one disables that feature and nothing else.

• Local network — to find televisions on your Wi-Fi to cast to.
• Notifications — for support replies, our notices and programme reminders; see section 6.
• Face ID / Touch ID — only if you add them to the app lock.
• Tracking — see section 13.

A picture for a support message is chosen with the system picker, so the app never asks for your photo library. TTV never asks for your location, contacts, calendar, camera or microphone.

• Playlists, viewing data and downloads — on your device until you delete them or remove the app.
• Our server — the installation record, support conversations and purchase reports are kept for as long as they are needed to provide those features, and purchase records for as long as accounting and tax law requires. Write to us, or use Contact Us, to have them deleted.
• Media-server reports — on your own server, under your control.
• Analytics and crash events — retained by Google for a bounded period (section 12).
• Advertising data — retained by each partner under its own policy.

TTV is a general-purpose player and is not directed at children under 13, or the equivalent minimum age where you live. We do not knowingly collect personal data from them. The parental PIN and hidden adult categories exist so a family can share a screen.

Depending on where you live you may have the right to access, correct or delete personal data we hold about you, to restrict or object to its processing, to withdraw a consent you gave, and to complain to your supervisory authority — under the GDPR (EEA and UK), the KVKK (Türkiye), the CCPA/CPRA (California) and the UAE Personal Data Protection Law, among others.

We do not sell personal data. To exercise a right, write to [email protected], or use Contact Us inside the app: a request sent there arrives attached to this installation’s record, so we can find it. By e-mail alone, with no account, we may not be able to match a request to data we can identify as yours — that is a consequence of collecting so little, not a refusal.

Our server, Apple, Google (for Firebase, AdMob and Chromecast), the advertising partners in section 13 and Plex operate across borders and may process data outside your country, including in the United States, under the transfer mechanisms set out in their own policies, such as the EU Standard Contractual Clauses.

When this policy changes materially — a new processor, a new category of data — the date at the top changes with it, and the App Store privacy labels for TTV are updated to match.

Privacy questions and data requests: [email protected]
Help with the app: [email protected]
Legal notices: [email protected]

Turbo Ventura
Dubai, United Arab Emirates