Last updated: October 2026
By default, provider credentials and playlist settings are stored locally on your device. If you choose to save an Xtream Codes configuration in your customer account, the server URL, username and password are transmitted over HTTPS and stored only as encrypted data. They are decrypted only to return the configuration to your paired device. You can delete the synced configuration from your account at any time.
When the app starts or signs in, it may report your app version, device/TV model, platform, a one-way device identifier hash, and — for Xtream Codes accounts — the provider server URL and username. Device pairing uses a random token stored only as a hash. We use this information for compatibility, aggregate usage statistics, device authorization, configuration sync and service management. We do not collect your viewing history or channel lists.
When you purchase a device license, we process your email address, device hash, plan, order status, amount and payment timestamps to provide the license, receipt and customer support. Payment card details are handled by the configured payment gateway and are never sent to or stored by Tavren Player. For card payments, the billing address and contact details you enter are transmitted to the payment gateway for fraud prevention but are not stored in the Tavren Player order database. Transactional email and customer sign-in codes are delivered through ZeptoMail. Customer accounts use a secure session cookie after email verification. The website sets no advertising or analytics cookies; server logs and download counts are used for security and service operation.
We do not sell or rent personal data. Content you watch is streamed directly between your device and your provider's servers; it does not pass through our infrastructure. Limited order, device and contact data may be processed by our hosting provider, payment gateway and ZeptoMail only to operate, secure and support the service.
Uninstalling the app removes locally stored app data, including credentials. For questions about this policy or to request deletion of server-side device and account-management records, contact [email protected].
This policy may be updated from time to time; the date above reflects the latest revision. Continued use of the app after an update means you accept the revised policy.