Privacy Policy

Last updated: 17 June 2026

1. Who we are

Paw Player ("we", "us") operates the Paw Player media player application and the website at pawplayer.app. This Privacy Policy explains what data we collect, why, and how we protect it.

2. What we collect

We collect only the minimum data needed to operate the App and process payments:

• Device identifiers: the MAC address and device key of the device running Paw Player. These are used solely to identify your device for activation and playlist sync.
• Playlist data: the M3U URLs or Xtream credentials you add through our website, so the App can sync them. Stored encrypted at rest.
• Payment record: the fact that you completed a payment (timestamp, processor reference, amount, currency). We do not receive or store your card details — those are handled by Lemon Squeezy (web) or Google (Play Store).
• Email address: only if you contact support. Used to reply.

We do not collect: your viewing history, the channels you watch, your IP address (beyond standard server logs retained for 7 days for abuse prevention), your location, advertising IDs, contacts, photos, or any other personal information.

3. Why we collect it

Each piece of data serves a specific, narrow purpose:

• Device MAC + key: to check if your device is activated and to sync your playlists.
• Playlist data: so it appears in the App after you add it via the Website.
• Payment record: to honor your activation and process refunds.
• Email: to respond to support requests you initiate.

4. Legal basis (GDPR)

For users in the EU/EEA, we process data on the following bases:

• Contract (Art. 6(1)(b)): we need your device key and playlist data to perform the service you paid for.
• Legitimate interest (Art. 6(1)(f)): minimal server logs for fraud prevention.
• Consent (Art. 6(1)(a)): for any optional features that go beyond the core service.

5. Third parties

We share data with these processors strictly to deliver the service:

• Lemon Squeezy — processes website payments as merchant of record. Sees your billing details, not your playlists. Their privacy policy.
• Google Play Store — processes Play Store subscriptions. Governed by Google's terms.
• RevenueCat — manages subscription state for Play Store purchases. Their privacy policy.
• Cloudflare — DNS, CDN, and basic DDoS protection for our website. Sees standard HTTP request data.

We never share your data with advertisers, data brokers, or marketing networks.

6. Data retention

• Active device records: kept while your activation is valid (lifetime activations: indefinitely; subscriptions: until cancellation + 30 days).
• Server logs: 7 days.
• Payment records: 10 years (required by Turkish tax law).
• Support emails: 24 months from last reply.

7. Your rights

You have the right to:

• Access the data we hold about you;
• Correct any inaccurate data;
• Request deletion of your data (subject to the legal retention requirements above);
• Export your data in machine-readable form;
• Withdraw consent for any optional processing.

To exercise these rights, contact [email protected]. We respond within 30 days.

8. Children

Paw Player is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us data, contact us and we will delete it.

9. Security

All connections to our website and API use TLS 1.3. Playlist data is encrypted at rest. We follow industry-standard practices to protect your data, but no system is perfectly secure. In the event of a breach affecting your data, we will notify you and the relevant authorities within 72 hours, as required by GDPR.

10. Changes to this policy

If we make material changes to this Policy, we will notify you on the Website at least 14 days before they take effect. Minor clarifications may be updated without notice.

11. Contact

Privacy inquiries: [email protected]
Support: [email protected]