Legal
Privacy Policy
Last updated:
This policy explains what the Vero Player Pro app (Android TV, Google TV, Fire TV and Android devices) and the website www.veroplayer.com collect, why, and what you can do about it. In short: we collect the minimum needed to link the playlist you provide to your device and to check its license. We do not sell, rent or share your data for advertising, and the app contains no advertising or analytics SDK.
1. Who we are
The service is operated by Vero Player Pro (“we”). Contact for anything privacy-related: noreplay@veroplayer.com, or the contact form.
2. What the app sends to us
| Data | What it is | Why | How it is stored |
|---|---|---|---|
| Device ID (“MAC address”) | A pseudonymous identifier the app creates on first launch, written like a MAC address (AA:BB:CC:DD:EE:FF). It is derived by hashing (SHA-256) a random key generated by the app (on installs from older versions, Android’s per-app device ID). It is not your network card’s hardware address and cannot be reversed to it. | Solely to link the playlists you add to your device and to look up its license. | On our server, as the device’s lookup key. |
| Device key | A random secret generated and kept on your device (Android Keystore). | Proves to our server that a request comes from your device and not from someone who only knows its ID. | We store only its SHA-256 hash, never the key itself. |
| Device model | Brand and model name, e.g. “Xiaomi MiBOX4”. | So you, and the partner who activated it, can recognise the device. | On our server. |
| Your playlists | The name and the URL of each playlist you add (which may include your own media server login). | To deliver them to your device — and only to your device. | The URL is encrypted (AES-256-GCM); it is never displayed on the website. |
| License status | Trial, 1-year or lifetime device license, its expiry date, and the authorised partner who activated it. | To unlock the app software. | On our server. |
| Optional PIN | The 4–8 digit PIN you may set on the website. | Protects your playlists on the website. | Stored as a one-way hash (bcrypt). |
The app does not collect your name, email, phone number, location, contacts, photos, microphone or camera, the list of apps you have, or what you watch. It needs only the Internet permission.
3. What stays on your device
Your viewing progress (“continue watching”), favourites, settings, the downloaded playlist catalogue and cached artwork are stored on your device only. They are never sent to us. Uninstalling the app, or clearing its data, deletes them.
4. The website
- Playlist and license console: what you type (device ID, playlist name and URL, optional PIN) is handled as described above. The connection check contacts the server address you entered, from our server, and returns only “reachable / not reachable”.
- Contact form: your name, email, subject and message, with your IP address and browser type to fight spam.
- Partner accounts: name, email, optional phone, and a ledger of license credits.
- Security logs: IP address, browser type and time of sign-ins, license activations, playlist changes and failed attempts, to prevent abuse and fraud.
- Cookies: only the ones the site needs to work — a session cookie and a security (CSRF) token. No advertising or tracking cookies.
5. Who else receives data
- Our hosting company, which stores the server and its database on our behalf.
- The servers in your playlist: when you play something, your device connects directly to the addresses in the playlist you supplied. We are not part of that connection.
- Artwork: posters and logos referenced by your playlist are loaded from the addresses in it. If one cannot be loaded directly, the app may load it through the image service wsrv.nl, which then receives the image address and your IP address.
- WhatsApp, only if you choose to contact us there.
- Authorities, only when the law requires it.
We never sell personal data, and we never share it with advertisers or data brokers.
6. Security
- All traffic to our server is encrypted (HTTPS).
- Playlist URLs are encrypted at rest; device keys and PINs are stored only as hashes.
- Repeated wrong attempts are blocked, with increasing waiting times.
- Access to the administration panels is limited by role and every sensitive action is logged.
7. How long we keep data
- Device and playlist data: until you delete it (see below) or ask us to.
- Security and audit logs: up to 365 days, then deleted automatically.
- Contact messages: until your request is handled, and at most 12 months.
- Partner accounts and credit records: as long as the account exists and as long as accounting law requires.
8. Your choices and rights
- Delete your playlists or your whole device record yourself at Delete my data, with the device ID and device key shown on your TV.
- Remove a single playlist at any time from the console on the home page.
- Depending on where you live (for example under the GDPR), you may ask us for access, correction, deletion, restriction, portability, or object to processing. Write to us; we answer within 30 days. You may also complain to your data protection authority.
9. Children
The service is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their data.
10. Changes
We will post any change on this page and update the date at the top.