GOOD
← Good IPTV Player

Good IPTV Player — Privacy Policy

Version 1.1 · Last updated and effective date: 26 September 2026

Data controller and service operator: Gökhan Altıncı (listed under the developer name "Gokhan Altinci" on the App Store and "GA Yazılım" on Google Play)

Website: goodiptvplayer.com

Privacy and user requests: support@goodiptvplayer.com

Copyright notices: copyright@goodiptvplayer.com

1. Purpose and scope of the Policy

This Privacy Policy explains how personal data is processed in connection with Good IPTV Player's supported iPhone, iPad, Apple TV, Android phone, Android tablet and Android TV applications (the "App"), the Good IPTV Player account, cross-device syncing (synchronisation), Premium verification, support services and the goodiptvplayer.com website.

Good IPTV Player is solely a media player and synchronisation service. It does not provide channels, movies, series, IPTV subscriptions, playlists or broadcast servers. The media source added by the user and the Good IPTV Player account servers are separate from each other.

For users in Türkiye, this Policy must be read together with the separately published KVKK Information Notice.

2. Brief summary

  • Good IPTV Player servers do not host, record, analyse or rebroadcast the media stream being played. Media is transmitted directly between your source and your device.
  • When you use the App on a phone or tablet without an account, your playlists, profiles, favourites, watch history and settings remain only on your device.
  • When you create an account and sign in, this data is processed on our server so that it can be synchronised between your devices.
  • Playlist name, server address, username, IPTV source password and M3U link, as well as profile names and the titles of content you watch, are stored encrypted on the server. IPTV source passwords cannot be viewed in the administration panel; other playlist information may be viewed by the authorised administrator for support purposes.
  • All communication between the App and the server is encrypted.
  • Downloaded movies and series episodes remain only in the app-specific area on the device; they are not sent to the server, the cloud or other devices.
  • IP addresses in server access logs are kept for up to 14 days for security purposes; no location information is derived from IP addresses.
  • GPS or location services are not used.
  • The App contains no third-party software libraries for advertising, analytics or tracking purposes; personal data is not sold.

3. Use without an account and with an account

On phones and tablets, you can use Good IPTV Player without creating an account. In this case, your playlists, profiles, favourites, watch history and settings remain only on your device; your IPTV passwords are kept in the device's secure storage (the Keychain on iOS, encrypted storage on Android) and are not sent to Good IPTV Player servers.

When you sign in with Apple or Google, the data described below is sent to our server so that your data can be used on your supported devices. Synchronisation, QR code sign-in and device linking require an account. The TV versions connect to our server for device pairing and the trial entitlement.

Even when the App is used without an account, your device may connect directly to the IPTV source you select, to TheTVDB and TVmaze for missing images, to YouTube for trailers, and to Apple or Google store services for purchases. When the App connects to our server for functions such as a support request, your IP address appears in the server access logs as a technical necessity of the connection.

4. Categories of data we process

4.1 Account and sign-in data

  • the user ID generated by Good IPTV Player;
  • account name and e-mail address (if "Hide My Email" was selected with Sign in with Apple, the relay address generated by Apple);
  • the sign-in method used (Apple or Google), the account ID issued by the provider and the date on which the sign-in method was linked to the account;
  • account creation and last seen time;
  • an irreversible hash of the session token and the necessary authorisation records.

Your Apple or Google account password never reaches Good IPTV Player. The account ID issued by the provider is stored only for secure sign-in and account linking.

4.2 Device and session data

  • device name or model, and platform;
  • operating system version and Good IPTV Player app version;
  • the device's region and language setting;
  • the device ID generated by the App;
  • the time the device was linked to the account and last used, and the list of linked devices;
  • QR code and one-time pairing records, and playlist addition or password requests sent from the TV to the phone;
  • the trial entitlement usage record in the TV versions;
  • the Apple (APNs) or Google (FCM) notification token, if you have granted notification permission.

The operating system and app version are processed on each linked device for compatibility, device management, security and support.

4.3 Playlist, profile and synchronisation data (when used with an account)

  • playlist name and type (Xtream or M3U);
  • server address, source username and M3U link;
  • IPTV source password (encrypted on the server);
  • profile name, colour, icon, whether it is a child profile, and an irreversible hash of the profile PIN;
  • if you add a profile photo, the photo itself (the photo is collected only if you select it);
  • favourites;
  • watch progress: the content's name, ID, type, poster address, the second at which you left off and the total duration;
  • app settings: audio and subtitle preferences, home page layout, hidden categories, parental control settings and an irreversible hash of the parental PIN;
  • for deleted playlists, a deletion record that ensures consistency between devices (playlist ID and deletion time).

Playlist name, server address, username, IPTV source password and M3U link, as well as profile names and the titles and artwork links in watch records, are stored on the server encrypted with AES-256. IPTV source passwords cannot be viewed in the administration panel. Playlist, profile and watch records are kept in a database to which access is restricted by authorisation; they may be viewed by the authorised administrator for support and security purposes (see section 10).

4.4 Premium and purchase data

  • the store where the purchase was made (App Store or Google Play) and the product ID;
  • the transaction ID or purchase token issued by the store and the verification result (the Google Play purchase token is stored encrypted on the server);
  • start and end time; automatic renewal, cancellation, refund and expiry status;
  • information on whether the purchase environment is test (sandbox) or live;
  • the purchase country reported by the store;
  • promotional or gifted Premium periods defined by Good IPTV Player.

Card numbers and payment information do not reach Good IPTV Player; payment is taken by Apple or Google.

4.5 Region information

Good IPTV Player does not use GPS or similar location services and does not store city information. Country or region information comes only from the store country reported by Apple or Google with the purchase transaction and from your device's own region and language setting. No location is derived from IP addresses.

4.6 Support, notification and administration records

  • messages you send through the in-app support form and the replies given to them;
  • support, copyright, objection and personal data applications you submit by e-mail;
  • diagnostic logs or crash reports you send of your own accord (passwords and stream addresses are masked in these logs);
  • the account's creation date and status; suspension status, reason and date (the reason for suspension is shown to you in the App);
  • records of notifications sent to you (support replies, service announcements, TV pairing requests);
  • a record of the actions taken on your account by the authorised administrator.

Do not include unnecessary passwords, full M3U addresses or payment information in support messages and diagnostic logs.

4.7 Security and access logs

The IP address, date and time of requests made to our server, and the requested address, are kept in server access logs for up to 14 days for the purposes of security, troubleshooting and preventing misuse, and are then automatically deleted. Rate limiting of App requests is based not on IP address but on account or device ID. IP records belonging to the administrator are additionally kept for administration panel sign-in security.

4.8 Device permissions

  • Camera: Used only when you scan a QR code; the image is processed on your device and is not stored or sent.
  • Photos: Only the image you select as a profile photo is accessed; your entire photo library is not accessed.
  • Notifications: If you grant permission, used for TV pairing requests, support replies and service announcements; you can turn the permission off at any time in the operating system settings.

4.9 Data we do not collect or do not send to the server

  • the video or audio stream being played; live broadcast recordings or DVR data;
  • offline download files on the device and the download list;
  • GPS-based location and city information;
  • contacts, microphone or health data;
  • advertising identifier (IDFA or Android advertising ID);
  • device fingerprinting; your device is recognised only by the device ID generated by the App and described above;
  • card numbers and payment information; Apple or Google account passwords.

5. Why do we process data?

  • to create an account, provide secure sign-in and link Apple and Google sign-in methods to the same account at your request;
  • to recognise devices and to manage TV sign-in by QR code, the device limit and active sessions;
  • to synchronise playlists, profiles, favourites, watch progress and settings across your devices;
  • to verify and restore Premium purchases and reflect them on the supported platforms in your account;
  • to ensure app compatibility, version support and service security;
  • to respond to support requests; to deliver support replies, TV pairing requests and service announcements (updates, maintenance, security) as notifications;
  • to prevent abuse of the TV trial entitlement, fraud, unauthorised access and excessive requests;
  • to examine copyright notices, objections and personal data applications;
  • to fulfil legal obligations and to establish, exercise or defend legal rights.

No commercial electronic messages (marketing notifications or e-mails) are sent; if sending them is ever considered, your consent will be obtained separately in advance. Watch history, favourites, profile or playlist data are not used to create advertising profiles, to perform scoring, or to infer special category information such as health, political opinions, religion or sex life.

6. Legal bases for processing

  • Establishment or performance of a contract (Art. 5(2)(c) of Law No. 6698 on the Protection of Personal Data (KVKK); GDPR Art. 6(1)(b)): account, sign-in, synchronisation, device management, Premium and support services.
  • Legal obligation (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)): retention required by legislation and requests from competent authorities.
  • Establishment, exercise or protection of a right (KVKK Art. 5(2)(e)): copyright, objection and legal dispute processes.
  • Legitimate interest (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)): server access logs, account and service security, prevention of misuse and of abuse of the trial entitlement, service announcements.
  • Explicit consent (KVKK Art. 5(1); GDPR Art. 6(1)(a)): only if there is an optional processing activity that requires consent, separately and in a revocable manner.

Ticking on the consent screen that you have read this Policy or the KVKK Information Notice does not constitute explicit consent; it only shows that you have been informed.

7. Offline downloads on the device

Offline downloads of movies and series episodes start only on your explicit command and are stored in the app-specific area on the device. These files:

  • are not uploaded to the Good IPTV Player server and are not synchronised to other devices;
  • are not included in iCloud backups or Android device backups;
  • are not made available in the App with any function for exporting or sharing them to Files, the gallery or another app.

Downloads are deleted from the device when the relevant playlist is deleted, together with your account's playlists when signing out of the account, when they are deleted from Settings › Storage & Cleanup, when the Reset the App option is used, or when the App is removed.

8. Parties to which data is transferred

Personal data is not sold and is not shared for advertising purposes. To the extent necessary to provide the Service, data is processed by the following parties.

8.1 Apple and Google

The relevant platform provider processes data for Sign in with Apple, Sign in with Google, App Store and Google Play purchase verification, store notifications, the Apple (APNs) and Google (FCM) notification infrastructure, and the AirPlay and Google Cast screen mirroring functions. These parties' own privacy terms also apply.

8.2 Hosting, e-mail and backup providers

The account and synchronisation server runs in a data centre in Istanbul, Türkiye. The website and the e-mail service are hosted on Hostinger infrastructure. These providers process data in their capacity as data processors and only to the extent necessary to provide the service, keep data secure and back it up.

8.3 TheTVDB and TVmaze

When poster, cover or credits information is missing from your source, limited search information such as content name, type and actor names is sent directly from your device: to TheTVDB in the background while the playlist is loading, and to TVmaze when a movie or series details screen is opened. These queries are not associated with your account; Good IPTV Player servers do not act as intermediaries for these queries and do not store the results on the server. The relevant service may see your device's IP address as a necessity of the connection. Images are kept in the device cache.

8.4 YouTube (Google)

If your source indicates a trailer link, the trailer is shown with the YouTube player; in some versions, the trailer may start automatically without sound when the details screen is opened. Good IPTV Player uses YouTube API Services. When a trailer is loaded, YouTube may process information about your device and your use in accordance with its own policies. YouTube Terms of Service: https://www.youtube.com/t/terms Google Privacy Policy: https://policies.google.com/privacy

8.5 Demo mode in the TV versions

When you open the demo mode on Apple TV and Android TV, the test video is loaded directly to your device from Mux's public test server, and the sample images from the Lorem Picsum stock image service. These services may see your IP address as a necessity of the connection; the demo mode is not associated with your account.

8.6 Your own IPTV or media provider

When a playlist is refreshed or media is started, your device connects directly to the source you selected. The source provider may see your IP address, the connection time, your username and access credentials with that provider, and the requested media address. This provider is not a data processor acting on behalf of Good IPTV Player and is responsible for its own privacy practices.

8.7 Mirroring devices

When you send a broadcast to another screen with AirPlay or Google Cast, the media address is transmitted to the mirroring device you select, and that device receives the broadcast directly from the source.

8.8 Competent authorities and legal advisers

Data may be shared with competent public authorities, courts or legal advisers where there is a legally valid and proportionate obligation.

8.9 Transfer of the Service

If the Service is transferred to a company or another operator, account data may be transferred to the new operator, provided that the level of protection in this Policy is maintained and you are notified in advance.

9. IP addresses and network logs

On Good IPTV Player servers, IP addresses are kept only in server access and security logs, for up to 14 days. They are not stored as part of the playlist, profile or watch records belonging to your account, and no location profile is created from IP addresses.

When connecting to a service over the internet, the IP address is a natural part of network communication. Your IPTV provider, Apple, Google, TheTVDB, TVmaze, YouTube and hosting providers may process your IP address in their own technical logs. Security logs relating to the administrator's sign-in to the administration panel are not IP records belonging to a user account.

10. Administration panel: who can see what?

In order to provide support and prevent misuse, the authorised administrator (the data controller) can view account, device, playlist, profile, subscription and support records through an administration panel protected by a username, a password and two-step verification, and can make corrections to playlist information upon a support request. The data that cannot be viewed in the panel is as follows:

  • IPTV source password (only whether one is saved is visible);
  • profile and parental PINs (kept only as irreversible hashes; they cannot be read);
  • the profile photo itself (only the file size is visible);
  • session tokens (only a shortened identifier is visible);
  • Google Play purchase token.

E-mail addresses are masked in panel listings. Every administrative action taken in the panel is recorded together with the person who took it and the time. No general or continuous review of users' catalogues or of the content they watch is carried out.

11. Security measures

  • All communication between the App and the server is encrypted with TLS.
  • Playlist information (name, server address, username, password, M3U link), profile names, the titles of watched content and Google Play purchase tokens are encrypted on the server with AES-256.
  • Profile and parental PINs are stored as salted, irreversible hashes; session tokens are stored as hashes.
  • On the device, IPTV passwords are kept in the iOS Keychain or in Android encrypted storage.
  • The database is closed to access from external networks; administrator access to the server is possible only with a cryptographic key, not with a password.
  • The administration panel is protected by two-step verification and a limit on failed attempts; actions are recorded.
  • Passwords and stream addresses are masked in app logs.
  • Downloaded files are kept in the App's private area.

No internet or storage method provides absolute security. You must protect your own source password, your QR codes and pairing codes, and your linked devices. If a data breach affecting your personal data occurs, the notifications required by the KVKK and applicable legislation are made.

12. Retention periods

  • Account, playlist, profile, favourite, watch and settings data: for as long as your account is open or until you delete the relevant record.
  • When the account is deleted: account data on the server is deleted immediately; it may remain in server backups for up to 14 days.
  • Deletion records for deleted playlists: 90 days.
  • QR code, pairing and request codes: deleted when they expire.
  • Notification records: 90 days.
  • Server access and security logs: up to 14 days.
  • Premium verification records and in-app support messages: for as long as the account is open; deleted when the account is deleted. Your purchase history remains with Apple or Google.
  • TV trial entitlement record: even if your account is deleted, only the device ID and trial usage information are retained, with the link to the account removed, in order to prevent the trial entitlement from being used repeatedly.
  • Account merge safety copy: if you have merged two accounts, the copy taken so that the operation can be reversed is retained for a limited period.
  • Support, copyright, objection and KVKK correspondence conducted by e-mail, and administrator action records: for as long as necessary to conclude the request and for service security, and for the applicable limitation periods.

Data whose retention purpose has ended is deleted, destroyed or irreversibly anonymised.

13. Account and data deletion

You can delete your account via Settings › My Account › Delete My Account in the App; the action takes place immediately after confirmation and cannot be undone. If you cannot access the App, you can use the methods on the goodiptvplayer.com/account-deletion page or the address support@goodiptvplayer.com. The scope and exceptions are explained in the Account and Data Deletion Policy.

Account deletion:

  • does not delete your Apple or Google account;
  • does not automatically cancel your App Store or Google Play subscription;
  • does not delete the stores' own purchase history;
  • cannot remotely delete local files on a device that remains offline.

14. Your privacy rights

Depending on the applicable law, you have the right to:

  • learn whether your data is processed and request a copy of it;
  • request the correction of inaccurate or incomplete data;
  • request erasure or restriction of processing where the conditions are met;
  • object to processing based on legitimate interest;
  • withdraw your consent where processing is based on consent;
  • request data portability to the extent applicable;
  • lodge a complaint with the competent data protection authority (in Türkiye, the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu); in the European Union, the supervisory authority of the country where you are located).

Requests can be sent to support@goodiptvplayer.com from the e-mail address registered to your Good IPTV Player account. Only necessary and proportionate identity verification information is requested in order to conclude the request securely; applications are answered within 30 days at the latest. The rights of users in Türkiye under KVKK Art. 11 and the application procedure are explained separately in the KVKK Information Notice.

15. Children's privacy

Good IPTV Player is not directed at children; to create an account, you must be at least 18 years old or be considered an adult in the country where you are located. The child profile in the App is a viewing profile under parental control that the adult account holder manages within their own account; it is not a separate child account.

The account holder must not add unnecessary information or photos that directly identify a child to the profile fields and must supervise the use of the account. A parent or guardian who believes that a child's data has been processed without authorisation may request deletion or review at support@goodiptvplayer.com.

16. International data processing

The data controller is located in Türkiye. The account and synchronisation server is also located in Türkiye. Hostinger, which provides the website and the e-mail service, as well as Apple, Google (including YouTube), TheTVDB, TVmaze and other technical service providers may process data in various countries, in particular the United States of America and countries of the European Union. The data recipient roles, the data categories and the transfer mechanisms provided for in Article 9 of the KVKK and, where applicable, in the GDPR in relation to transfers of data abroad are assessed on a provider-by-provider basis. The standard contract published by the Personal Data Protection Board will be cited as the appropriate safeguard basis for the relevant transfer only after it has been duly signed by the parties to the transfer and notified to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) within the statutory period; this text does not imply that a standard contract that has not yet been signed or has not been notified to the Authority is in place.

Your connecting directly to your own IPTV provider is not a server transfer directed by Good IPTV Player; the country and data processing practices of the source provider fall within the scope of the relationship between you and that provider.

17. Automated decision-making, advertising and analytics

Good IPTV Player does not make decisions about you, based solely on automated processing of watch history or playlist data, that produce legal or similarly significant effects. In situations such as excessive requests or suspicious sign-ins, automated security measures may temporarily restrict access.

No advertising network or third-party software library for analytics or tracking purposes is used in the App; the advertising identifier is not accessed and personal data is not sold. Apple and Google operate store and operating system services independently and, depending on your platform settings, may provide aggregate store metrics or crash and performance diagnostics. This platform data is not used to create content viewing profiles.

18. Website

goodiptvplayer.com does not use cookies, analytics, advertising or externally loaded third-party resources (for example, external fonts or tracking code). When you visit the site, the hosting provider Hostinger may process your IP address and request information in its own server logs as a necessity of the connection.

19. Changes to the Policy

This Policy may be updated when the App's features, data flows, service providers or legislation change. Material changes are notified in the App or through an appropriate electronic channel; where necessary, the current text is presented again on the consent screen. If a new processing activity requires explicit consent, consent is obtained separately.

20. Prevailing text

This Policy has been prepared in Turkish. In the event of any discrepancy between language versions, the Turkish text prevails. This provision does not limit your mandatory rights arising from the legislation of the country where you are located.

21. Contact

Data controller and operator: Gökhan Altıncı

Privacy and user requests: support@goodiptvplayer.com

Copyright notices: copyright@goodiptvplayer.com

Website: goodiptvplayer.com