Last updated: 13 October 2026
This policy explains what personal data Zapvo processes, why, and what your rights are. It covers the Zapvo app on phones, tablets and TVs. It is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR, the Turkish Personal Data Protection Law No. 6698 (KVKK) and the California Consumer Privacy Act (CCPA).
1. Who is responsible
The controller of your personal data is Solace Works, e-mail support@zapvo.app.
2. The short version
- •Your sources stay on your device. Server addresses, user names and passwords are stored only on your device; passwords are encrypted with your device's secure key store.
- •We do not see what you watch. Your favorites, history and settings stay on your device.
- •No account, no e-mail address, no advertising, no analytics, no tracking.
- •If you turn on sync, your data is encrypted on your devices before it reaches our server. We cannot read it.
- •What our server does keep is listed below; most of it is a one-way code that cannot be traced back to you by itself.
3. Data on your device
The app stores on your device: the sources you add (passwords encrypted), the channel, movie and series lists and the program guide loaded from them, your profiles, favorites, watch history and positions, followed series, reminders, parental control settings (the PIN is stored only as a secure hash), your settings, and the list of phones you allowed to control your TV. This data does not leave your device unless you use sync (section 5) or send something to your TV from your phone yourself (section 6).
The app connects directly to the servers of the sources you add. Those providers receive the requests your device makes to them, as with any app or browser; their own privacy policies apply.
4. Free trial and purchases
To give each device one free trial, and to check purchases, the app talks to our server:
- •A one-way code derived from your device's Android ID. The ID itself never leaves your device; our server stores only a keyed hash of a hash. Why: so that the free trial can be used once per device. Legal basis: our legitimate interest in preventing abuse (GDPR Art. 6(1)(f), KVKK Art. 5(2)(f)). Kept until 24 months after the device was last seen.
- •A random code kept in your Google backup (Google Block Store). Why: to recognize the device after the app is reinstalled. Legal basis and retention as above.
- •Trial start and end, the last check, and whether the device passed Google Play's integrity check. Why: to run the trial. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b), KVKK Art. 5(2)(c)). Retention as above.
- •A hash of your Google Play purchase token, the product, its expiry and status. Why: to confirm that a purchase is real and valid. Legal basis: performance of contract. Kept until 24 months after the purchase ended.
When you buy, Google Play handles the payment; we never see your payment details. When the trial starts, Google Play Integrity may confirm that the app is genuine and comes from Google Play.
5. Sync (optional)
If you turn on sync (Settings › Sync), your sources (including passwords), profiles, favorites, watch history and followed series are encrypted on your device with a key that exists only on your devices. Our server stores only:
- •the encrypted data, which we cannot read;
- •a group ID and a hash of an access code, both derived from that key;
- •a version number and the time of the last change.
Legal basis: your request and our contract with you (GDPR Art. 6(1)(b), KVKK Art. 5(2)(c)). The data is kept until you delete it (Settings › Sync › Delete sync data, or Delete my data). A group nobody has synced for 12 months is deleted automatically. If you lose all your devices, the data cannot be recovered by anyone, including us.
6. Phone remote, connecting with a code and casting
- •Phone remote on the same Wi-Fi: your phone and TV talk to each other directly and encrypted. No server is involved.
- •Connecting with a code from another network: our server passes encrypted messages between your two devices for as long as they are connected (at most 3 hours). It cannot read them and does not store them. Part of the code never reaches our server.
- •Casting to a Chromecast: when you cast, the address of the stream you play is sent to your Cast device and to Google's Cast receiver, which play it. Stream addresses can contain your provider account details; only cast to your own devices.
7. Our server and its providers
Our server runs on Cloudflare. Like any server, it receives your IP address when your device connects. We do not store request logs. To limit abuse (for example guessing connection codes), we keep a keyed hash of the IP address with a counter for at most one hour.
We use these processors: Cloudflare, Inc. (server hosting) and Google (Google Play, Play Billing, Play Integrity, Block Store, Cast). Their servers may be outside your country, including in the United States. Transfers are protected by the European Commission's standard contractual clauses and, for transfers from Turkey, by the safeguards under KVKK Art. 9.
We do not sell or share your personal data, and we do not use it for advertising.
8. Your rights
You have the right to access, correct and delete your data, to restrict or object to processing, and to data portability; and, under KVKK Art. 11, to learn whether your data is processed and to whom it is transferred. Most of your data is only on your device, where you control it fully: Settings › About and legal › Delete my data removes it (see the Data Deletion page for what remains and why).
To use your rights, write to support@zapvo.app. Because we hold no names or e-mail addresses, we may need information from your device to find data that relates to you. You may also complain to a data protection authority, in Turkey the Personal Data Protection Authority (KVKK).
California residents: we do not sell or share personal information as defined by the CCPA.
9. Children
The app is not directed at children under 13, and we do not knowingly collect their data.
10. Security
Passwords and the sync key are encrypted with your device's secure key store. Everything between the app and our server is encrypted (HTTPS); the phone remote, connecting with a code and sync are encrypted end to end.
11. Cookies
The app uses no cookies and no tracking technologies.
12. Changes
We will update this policy when the app or the law changes, and tell you in the app if a change is important.
13. Contact
Solace Works, support@zapvo.app
The website zapvo.app
This section covers our website, zapvo.app. The controller is the same as for the app, named at the top of this policy.
Cookies and analytics. Only if you agree (the banner on your first visit; “Cookie settings” at the bottom of every page to change your choice), the website uses Google Analytics by Google Ireland Limited to see how its pages are used. It then sets cookies, and Google receives data about your visit, such as your IP address and browser details, possibly also in the USA; Google keeps it for at most 14 months. The legal basis is your consent, which you can withdraw at any time. Without it, nothing from Google is loaded. Apart from this, the website counts views per day, page, language, country, device type and where the visit came from, without cookies and without storing IP addresses or browser details; these counts are deleted after 400 days.
Messages to us. When you use the contact form, we store your email address, your message and its topic, your name if you give it, the page's language and the country the message was sent from, so that we can answer you. The legal basis is your consent, which you can withdraw at any time by writing to us. We delete messages when they are no longer needed, and after two years at the latest.
Protection against abuse. To stop spam, the contact form counts each visitor's messages for a short time. The visitor is known only by a code made from the IP address and a secret that changes every day; these counters are deleted when they expire.
Hosting. Like the app's server, the website runs on Cloudflare, Inc., which receives your IP address when your browser connects. We do not store request logs.