Sofalo
Privacy Policy
1. Who we are
Sofalo is provided by [Company legal name], [Street, City, Province, Canada] (“we”, “us”). We are the organization responsible for personal information under this policy, including under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, the EU/UK General Data Protection Regulation (GDPR). Privacy contact: [email protected].
2. What the app is
Sofalo is a video player. It does not include any channels or content. You add your own playlist (M3U or Xtream login) and TV guide (EPG). Streams are fetched directly by your device from the addresses in your playlist — they do not pass through our servers.
3. What we store and why
| Data | Why | Can we read it? |
|---|---|---|
| Device names (e.g. “Living room TV”) and a random device ID | To show your linked devices and deliver sync data to them | Yes |
| Encrypted sync data: playlists, logins, EPG links, favorites, watch history, settings | To keep your devices in sync | No — encrypted end-to-end; only your linked devices hold the keys |
| Premium status of a household (whether a purchase is active, store transaction ID) | To remove ads on every linked device | Yes (no payment details) |
| Crash reports (app version, device model, OS version, error details) | To find and fix bugs | Yes. Crash reports are designed not to include playlist links, logins or viewing history |
| Technical logs (IP address, request time) kept by our hosting provider | Security, abuse prevention, operating the service | Yes, retained for a short period [confirm: e.g. 30 days] |
We do not ask for your name, email address or phone number, and we do not sell personal information.
4. What we cannot see
Your playlist links, provider logins, TV guide links, favorites and what you watch are encrypted on your device before being sent. The keys stay on your linked devices and are exchanged when you scan a QR code. Our server only stores scrambled data it cannot open. This also means we cannot recover your data if you lose all of your devices.
5. Advertising (free version)
The free version shows ads on browse screens only — never during video playback. Ads are served by [ad partner name], which may collect device information such as an advertising identifier, IP address, and device type to show and measure ads. Ad partners never receive your playlist, logins or viewing history. Where required, we ask for your consent before personalized ads (for example, Apple's App Tracking Transparency prompt on iOS, or a consent screen in the EU/UK). You can reset or limit your advertising identifier in your device settings. Household Premium removes ads.
6. Purchases
Purchases are processed by Apple, Google, Amazon or [desktop payment provider]. We receive confirmation that a purchase is active, not your payment details.
7. Service providers and transfers
We use service providers to host sync data ([e.g. Cloudflare]), collect crash reports ([crash reporting provider]) and serve ads ([ad partner]). They may process data outside Canada or your country, including in the United States. We use contractual safeguards (such as Standard Contractual Clauses where GDPR applies) to protect it.
8. Legal bases (GDPR)
Running sync and Premium: performance of our contract with you. Crash reports and security logs: our legitimate interest in a reliable, secure app. Personalized ads: your consent, which you can withdraw at any time.
9. How long we keep data
Encrypted sync data and device names are kept while your devices stay linked. When you unlink a device or choose Delete my data in the app, we delete the related data from our servers within [30] days. Data for households with no activity for [12 months] is deleted automatically. Crash reports are kept for up to [90 days].
10. Your rights
Under PIPEDA you can ask to access or correct personal information we hold about you and withdraw consent. Under GDPR you can also request erasure, restriction, portability, and object to processing. Because we have no accounts, the simplest way to delete everything is Delete my data in the app's settings. You may also email [email protected]. You can complain to the Office of the Privacy Commissioner of Canada or, in the EU/UK, your local data protection authority.
11. Children
Sofalo is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their personal information.
12. Security
We use end-to-end encryption for sync data, encryption in transit (HTTPS) for all connections, and limit who can access our systems. No system is perfectly secure; if a breach creates a real risk of significant harm we will notify you and regulators as the law requires.
13. Changes
If we change this policy, we will update the date above and, for significant changes, tell you in the app.