Media player only — no content included

OTOO does NOT provide, host, or sell any channels, movies, or streams. It only plays the M3U or Xtream playlist you add yourself — you are responsible for the content you play.

Privacy Policy

Last updated: 10 September 2026

OTOO is an IPTV player. You supply your own playlist or provider login; OTOO plays it. This policy describes what OTOO does and does not collect. It reflects the actual behaviour of the service.

Who is responsible for your data

The data controller is:

Covic 3D, owner Katarina Čović
Ul. Matije Gupca 6, 32253 Komletinci, Croatia
Personal identification number (OIB): 92455343627
Email: [email protected]

What we do not do

  • We do not sell, share, or profile your data.
  • We do not host, sell, or provide any channels, media, or subscriptions.
  • We never receive or store your card or payment-card details.
  • We do not track you across other companies' apps or websites.

What we process

  • Device identity: a random identifier created on your device the first time you open the app. It is not your hardware MAC address and not a device serial number, but the app displays it in MAC-address format so you can register the device. It is kept on the device (it can survive reinstalling the app) and stored on our servers so we can link your playlist and your access period to that device.
  • Playlist details: if you (or your reseller) attach a playlist to your device, we store its address and, for Xtream services, the username and password. These are stored encrypted at rest and are used only to load your channel list into the app. We do not use your provider account for anything else.
  • Pairing: a short-lived, one-time code and an encrypted payload used only to move your provider details from your phone/browser to your TV. The payload is deleted after delivery or expiry.
  • Technical data: the platform you use (for example iOS, tvOS, Android), the approximate country and network operator derived from your IP address when your device registers, and the time your device last contacted us. We use this for support and to detect abuse. We do not store a history of your IP addresses.
  • Purchases (optional): if you buy the OTOO Lifetime Pass, the store (Apple App Store or Google Play) verifies the purchase. We store the fact that the purchase exists and the store transaction identifier, so that one purchase is not reused on an unlimited number of devices. If you pay by bank transfer or coupon, we store the payment record required for invoicing.
  • Playback positions: the title and the position where you stopped watching, so the app can offer to resume. This is tied to your device, not to your identity.
  • Contact details (optional): an email address if you provide one for your device or when you open a support ticket, together with the messages you send us.
  • Diagnostics (optional): only if you explicitly send a report, with provider URLs and credentials redacted.

Why we are allowed to process it

Under the GDPR our legal bases are:

  • Performance of a contract (Art. 6(1)(b)) — running the player, loading your playlist, keeping your access period and purchases.
  • Legitimate interests (Art. 6(1)(f)) — preventing abuse and fraud, limiting how many devices share one purchase, keeping the service secure.
  • Legal obligation (Art. 6(1)(c)) — keeping invoices and accounting records.
  • Consent (Art. 6(1)(a)) — optional diagnostic reports, which you send only if you choose to.

How long we keep it

  • Pairing payloads: minutes — deleted on delivery or expiry.
  • Devices whose trial lapsed and that never completed a purchase: deleted automatically 90 days after the access period ends. The attached playlist details are deleted with the device.
  • Devices with active access: kept while the service is provided to you, and deleted on request.
  • Payment and invoice records: kept for the period required by accounting and tax law, even after the device is deleted.

Who else is involved

We use a small number of service providers who process data on our behalf: our hosting provider (servers located in the European Union), an email delivery provider for transactional messages, and the app stores (Apple, Google) which verify purchases. Where a provider processes data outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses. We do not sell your data and we do not give it to anyone for their own purposes.

Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to processing, and to receive it in a portable format. Where processing is based on consent, you can withdraw it at any time.

You can delete your local data from within the app at any time, and request removal of any server-side data via the data deletion page, or by emailing us. We answer within one month.

If you believe we handle your data unlawfully, you may lodge a complaint with your local supervisory authority. In Croatia this is the Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.

Children

OTOO is not directed at children and is rated for adult users. We do not knowingly collect data from children.

Changes to this policy

We may update this policy; the date at the top always shows the current version.

Contact

Questions about this policy: [email protected].