Sofalo
Privacy Policy
1. Who we are
Sofalo is provided by Northernaut-AI, 1906-33 Davisville Ave., Toronto, ON M4S 2Y9, Canada (“we”, “us”). We are the organization responsible for personal information under this policy, including under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, the EU/UK General Data Protection Regulation (GDPR). Privacy contact: [email protected].
2. What the app is
Sofalo is a video player. It does not include any channels or content. You add your own playlist (M3U or Xtream login) and TV guide (EPG). Streams are fetched directly by your device from the addresses in your playlist — they do not pass through our servers.
3. What we store and why
| Data | Why | Can we read it? |
|---|---|---|
| Device names (e.g. “Living room TV”) and a random device ID | To show your linked devices and deliver sync data to them | Yes |
| Encrypted sync data: playlists, logins, EPG links, favorites, watch history, settings | To keep your devices in sync | No — encrypted end-to-end; only your linked devices hold the keys |
| Technical logs (IP address, request time) kept by our hosting provider, Cloudflare | Security, abuse prevention, operating the service | Yes, for a short period (Cloudflare's standard log retention, measured in days) |
We do not ask for your name, email address or phone number, and we do not sell personal information.
4. What we cannot see
Your playlist links, provider logins, TV guide links, favorites and what you watch are encrypted on your device before being sent. The keys stay on your linked devices and are exchanged when you scan a QR code. Our server only stores scrambled data it cannot open. This also means we cannot recover your data if you lose all of your devices.
5. No ads, no analytics, no purchases
Sofalo shows no advertising, contains no analytics or tracking SDKs, sends no crash reports and has no in-app purchases. The app only connects to the addresses in your playlist, to your TV guide link, and to our sync service when you link devices.
6. Service providers and transfers
Sync data is hosted on Cloudflare and the website on Railway. They may process data outside Canada or your country, including in the United States. We use contractual safeguards (such as Standard Contractual Clauses where GDPR applies) to protect it.
7. Legal bases (GDPR)
Running sync: performance of our contract with you. Security logs: our legitimate interest in a reliable, secure service.
8. How long we keep data
Encrypted sync data and device names are kept while at least one device stays linked. When you unlink a device (Settings → Devices → Unlink), its name and ID are deleted immediately; when the last device of a household is removed, everything stored for that household is deleted immediately. Hosting logs are kept by Cloudflare for a short period, measured in days.
9. Your rights
Under PIPEDA you can ask to access or correct personal information we hold about you and withdraw consent. Under GDPR you can also request erasure, restriction, portability, and object to processing. Because we have no accounts, the simplest way to delete everything is to unlink your devices under Settings → Devices. You may also email [email protected]. You can complain to the Office of the Privacy Commissioner of Canada or, in the EU/UK, your local data protection authority.
10. Children
Sofalo is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their personal information.
11. Security
We use end-to-end encryption for sync data, encryption in transit (HTTPS) for all connections, and limit who can access our systems. No system is perfectly secure; if a breach creates a real risk of significant harm we will notify you and regulators as the law requires.
12. Changes
If we change this policy, we will update the date above and, for significant changes, tell you in the app.