Privacy Policy

OnTiv ("OnTiv", "we", "us") is a browser-based media player. This Privacy Policy explains what information is collected when you use it, how it is used, and the choices available to you. OnTiv's Free tier does not require an account, does not sell personal data, and does not host or provide any TV channels, streams, or playlists — everything you watch comes from a playlist URL, uploaded file, or Xtream Codes login that you supply yourself. Creating an account is only needed to unlock Premium or sync your data across devices, as described in Section 3 below.

1. Information Stored Only In Your Browser

The following is saved using your browser's local storage and never leaves your device or is transmitted to us:

• Your dark/light mode preference
• Your favorited channels (stream URLs)
• The last channel you were watching, so playback can resume on your next visit

Clearing your browser's site data or using a different browser/device will remove this information and reset these preferences.

2. Playlist & Xtream Codes Requests

When you load an M3U playlist URL or sign in with Xtream Codes, the URL (and, for Xtream Codes, the server address, username, and password you enter) is sent to our server-side proxy so it can retrieve the playlist on your behalf — this avoids browser CORS restrictions and keeps the request from exposing your device directly to third-party IPTV servers. We do not log, store, or retain playlist URLs or Xtream Codes credentials beyond the time needed to complete that single request.

The M3U URL field on our homepage is pre-filled with a public demo playlist (https://iptv-org.github.io/iptv/index.m3u) from the free, open-source iptv-org project so you have something to try immediately. That default is provided purely for convenience — iptv-org is an independent third party unaffiliated with OnTiv, we do not host, curate, or vouch for its content, and loading it is treated the same as loading any other playlist under this Privacy Policy. You are free to replace it with your own M3U URL, uploaded file, or Xtream Codes login at any time.

3. Accounts & Authentication

Creating an account is optional and only needed to unlock Premium or sync your favorites, watch history, and settings across devices. Sign-in (email/password or Google) is handled by Firebase Authentication (Google). If you create an account, we store your email address and the entitlement data described in Section 4 in our database (Firebase Firestore) — we do not store your password, which Firebase Authentication handles directly.

4. Premium Subscriptions & Payment Processing

OnTiv Premium subscription payments are processed by Stripe. When you subscribe, we receive limited billing information from Stripe — such as your Stripe customer ID, subscription status, and renewal date — so we can grant and maintain Premium access on your account. We never see or store your full card number or other payment credentials; those are handled entirely by Stripe. See Stripe's Privacy Policy for how Stripe handles your payment data. Our separate PayPal donation button (unrelated to Premium) is covered under Section 7.

5. Newsletter

If you subscribe to our email updates, your email address is stored with our email provider, Kit, so we can send you product news and release notes. This is entirely optional, separate from creating an account, and requires your explicit consent at signup. You can unsubscribe at any time using the link in any email we send.

6. Analytics, Cookies & Bot Protection

We use Google Analytics (GA4) to understand how OnTiv is used — for example, page views and general usage patterns. Google Analytics uses cookies and may collect information such as your IP address, browser type, device information, and pages visited. We do not use this data to identify you individually.

Sign-in, sign-up, and the newsletter form are protected by Cloudflare Turnstile, a bot-verification widget. Solving a Turnstile challenge sends your browser signals and IP address to Cloudflare so it can confirm you're not an automated script — see Cloudflare's Privacy Policy.

You can opt out of Google Analytics tracking using the Google Analytics Opt-out Browser Add-on, or block cookies entirely through your browser settings (this may not affect functionality, since OnTiv does not rely on cookies to operate).

Advertising. Our written guides and blog posts (pages under ontiv.app/guides/ and ontiv.app/blog/) may display ads served by Google AdSense. The OnTiv player itself — loading playlists, browsing channels, and playback — shows no ads. Google and its advertising partners use cookies and similar technologies to serve and measure ads, and may use your IP address, browser information, and the pages you visit to show ads based on your prior visits to this and other websites. Where the law requires it (for example in the EEA and the UK), a consent message is shown before ads are personalized.

You can manage personalized advertising in Google's Ads Settings, learn how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites, or opt out of personalized ads from participating vendors at aboutads.info.

7. Third-Party Resources

Playing a channel loads the stream directly from the third-party URL in your playlist; media-session artwork (used for lock-screen/notification controls) is loaded from a placeholder image service. Voluntary donations (separate from Premium) are handled entirely by PayPal after you click the PayPal button — we never see or process your payment details, and PayPal's own privacy policy governs that transaction. We are not responsible for the privacy practices of any third-party stream, server, or service you choose to connect to through OnTiv.

8. Data Security

Playlist and Xtream Codes requests are proxied over HTTPS through our serverless functions, which validate the target host before making any request. Account and entitlement data (Section 3 and 4) is stored in Firebase Firestore, access-controlled so that only server-side code can write to it. If you never create an account, the primary data at rest is what your own browser stores locally, as described in Section 1.

9. Children's Privacy

OnTiv is not directed at children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to remove it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page. Continued use of OnTiv after changes are posted constitutes acceptance of the revised policy.