Privacy policy

Last updated: 7 October 2026. Applies to the Sable TV app (Android package app.sabletv).

Sable TV is a bring-your-own-content IPTV client. There is no bundled or demo content, no account system with an email address or password, and no analytics.

Who we are and how to reach us

Sable TV is published by an independent developer. Questions about privacy, or a request to delete data: privacy@sabletv.app.

Summary of the data we handle

Collected by us by default: nothing. The app makes no network request of its own until you ask it to.
Collected only if you turn sync on: encrypted records (favorites and resume positions) stored under anonymous IDs, plus an anonymous sync account. We cannot read those records. Details below.
Sold or shared with third parties: nothing.
Advertising, tracking and analytics: none. No telemetry SDKs are linked into the app.

What stays on your device, and never leaves it

Your playlists, provider addresses (M3U and Xtream URLs) and credentials. They are stored only in the operating system's secure keystore (Android Keystore on Android, Keychain on iOS).
Your full channel, movie and series catalog, categories, and the TV guide (EPG). They are stored in a database on the device.
Search, pagination and catalog browsing. All of it is computed on the device, over the local database. No search query, category or catalog listing is ever sent anywhere.
Your favorites and playback and resume history, in readable form.
The camera, when you choose to pair a phone with a TV. The camera is used only to read the pairing QR code shown on your TV. The image is processed on your phone, is never recorded, stored or sent anywhere, and the camera is off as soon as you leave that screen. If you prefer not to allow it, you can type the TV's code instead.
Playback itself. Video is requested directly from your provider by the platform's native player (Media3/ExoPlayer on Android, AVPlayer on iOS). Nothing is proxied, relayed or cached through any server this app talks to.

None of the above is readable by, or ever transmitted to, our servers.

What can leave your device, and in what form

The only thing that ever leaves the device is optional cross-device sync (favorites, and resume position), and only if you turn it on. When you do:

The record is encrypted on the device, before it is sent anywhere.
Its server-side record ID and account ID are keyed-MAC (HMAC) outputs derived from a sync key that also never leaves your devices. They are not a hash of the content and not the content itself.
Our server stores only that opaque ID, the ciphertext, and generic metadata: timestamps, a revision counter, a deleted flag, and a byte size padded to a fixed block so that even the size of a resume position cannot be read off the wire.

Our server cannot tell which IPTV provider, account, channel, movie or series a synced record is about, cannot decrypt it, and cannot link two records (say, a favorite and a resume position) for the same item to each other. Sync traffic goes to https://api.sabletv.app over HTTPS.

What our server can and cannot store

Allowed, and limited to generic app and sync infrastructure, never IPTV content:

an anonymous app user ID and authentication metadata (an anonymous cryptographic public key generated on your device; no email, username, password or device name)
opaque sync record IDs, collection names (for example favorites) and ciphertext
created, updated and deleted timestamps, a revision counter, a deleted flag and byte size
a coarse last-seen marker for the account, used only for storage quotas and cleanup

Forbidden, unconditionally: playlist bodies; provider, M3U or Xtream URLs, hostnames or credentials; stream URLs; channel, movie, series or category titles; provider, stream, VOD, series or EPG IDs; artwork references; EPG/XMLTV data; search queries or history; readable favorites; and unkeyed hashes of any of the above (a hash is still a fingerprint of the content it was made from).

Your IP address is used only as a short-lived, in-memory key for rate limiting abusive requests. It is not stored, not logged and not linked to any account.

Logging

Server-side logs never contain playlist bodies, stream URLs, provider identifiers, catalog titles or categories, favorites or search queries. The web server that fronts our API keeps no access log.

Retention and deletion

On your device: everything above is deleted when you uninstall the app or clear its data.
On our server: synced records are kept until they are deleted. Deleting a synced item (or clearing history) publishes a deleted marker, the same way any other device's deletion would, which is the only way our server, which cannot read the payload, learns that an item was removed.
If you turn sync off: this stops new records from being pushed or pulled on that device. It does not by itself delete already-synced ciphertext from the server.
Delete your sync account in the app: open Settings, then Sync, then Delete sync account, and confirm. The app deletes your anonymous sync account and every record stored for it on our server, then removes the sync key and sign-in on that device and turns sync off. Your playlists, favorites and resume positions stay on the device. The action appears once the device has a sync account. If it fails (for example offline), nothing changes on the device and you can try again.
Without the app: if you can no longer open the app (for example you uninstalled it), email privacy@sabletv.app to ask for deletion of your sync account and its records. Because the account is anonymous and our server holds no name or email for it, we can only act on an account you can identify. Uninstalling the app also discards the encryption key, so any records left on the server can no longer be decrypted by anyone, including us.

Playlists and the content you play

Sable TV is for content you are permitted to access. We do not provide, host, proxy or recommend any content or provider. What your provider learns about you when you play from it is governed by that provider's own policy.

Platform notes

Android: no telemetry SDKs are linked in. The optional camera permission is used only for scanning the pairing QR code, as described above.
iOS: the camera permission is used only for scanning the pairing QR code. The app's privacy manifest declares no tracking, no tracking domains and no collected data types.

Children

Sable TV is not directed at children.

Changes

If this policy changes, this page is updated and the date at the top changes with it.