This is a translation for your convenience. Only the German version is legally binding.

Privacy policy

Last updated: October 2026

• 1. Controller
• 2. The key points in brief
• 3. Visiting this website
• 4. App: activation
• 5. App: storage and connections
• 6. Recipients and third countries
• 7. Storage period
• 8. Your rights
• 9. Security
• 10. Changes

1. Controller

The controller responsible for data processing on this website and in the FIDA Player app is:

Firat Öztürk
Querstr. 41
74343 Sachsenheim
Germany
Email: firat.oeztuerk@mail.com
Phone: +49 157 38796544

2. The key points in brief

• Your playlist stays with you. Playlists, logins, favorites, “continue watching” positions and settings are stored exclusively on your device. We do not receive or store them.
• This website is frugal. It sets no cookies, embeds no fonts, scripts, maps or trackers from third parties and does not measure reach.
• Our server only knows the activation. The app reports a device ID, the device model and the app version (section 4).
• Everything else goes directly from your device – to your playlist provider, to image sources, optionally to OMDb and, when you watch a trailer, to YouTube (section 5). Without your action, none of this flows through us.
• We do not carry out profiling and do not pass on any data for advertising purposes.

3. Visiting this website

3.1 Hosting and server log files

The website is hosted by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. With every request the server processes technically necessary data: the IP address, date and time, the requested address, the previously visited page (referrer), the amount of data transferred as well as browser and operating system (user agent). They are needed to deliver the page, for security and for troubleshooting. We do not analyse these logs ourselves; the host deletes them after a short period set by the host.

The legal basis is Art. 6(1)(f) GDPR – our legitimate interest in the secure and stable operation of the website. A data processing agreement pursuant to Art. 28 GDPR is in place with the host. The same applies when you download an app file (APK): only these server log data are processed.

Name resolution for the domain (DNS) also runs via STRATO AG’s name servers. For technical reasons STRATO processes the address of the requesting server (usually your provider’s DNS resolver), not the content of your requests to our website.

3.2 No cookies, no tracking

The public pages set no cookies and use no analytics or advertising services. Fonts, images and scripts come from our own server. Only the non-public administration area, where the operator logs in, uses a technically necessary session cookie (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG) that expires when the browser is closed. This does not affect visitors to the website.

3.3 “Check device”

If you enter a device ID on the home page, it is sent to our server and compared with the device entry described in section 4. The activation status of this device is displayed. We do not store your input separately. Legal basis: Art. 6(1)(b) GDPR (usage relationship with the app) or (f) (information about the status of your own device).

3.4 Contact by email

If you write to us, we process your details (email address, content of the message) in order to answer your request. The legal basis is Art. 6(1)(b) GDPR where it concerns the app, otherwise (f). We delete the message once the matter has been dealt with and no statutory retention obligation applies.

4. App: activation

At start-up and then roughly every six hours while it is running, the app asks our server (fida-player.com) whether the device may use the app. The following is transmitted for this purpose:

• the device ID – a value calculated from the Android device ID in the format of a MAC address (e.g. A6:3F:0C:91:5E:D2). The real MAC address is not read, and the device ID cannot be derived from it;
• a secret check value that is only valid between app and server and prevents anyone from taking over someone else’s ID;
• the app version, the device model (e.g. “AFTMM”) and the checksum of the app signature, which lets us detect whether the app has been modified;
• the IP address, which is technically processed with every connection.

The device entry on the server contains: ID, check value, status (trial, active, expired or blocked), where applicable the term and a note by the operator, app version, model, signature checksum including the result of the check, the time of the first and the last request, the number of requests and the most recently used IP address. The server’s response is digitally signed so that it cannot be forged.

Purpose: checking whether the device is activated; detecting misuse (modified or copied apps, takeover of other people’s IDs); operating the service; answering status enquiries. Legal basis: Art. 6(1)(b) GDPR (provision of the app) and (f) GDPR (protection against misuse and manipulation, proper operation of the activation).

Rejected requests – for example with a wrong check value or from a modified app – are logged with ID, reason, IP address and time in order to trace misuse (Art. 6(1)(f) GDPR). These entries are deleted after 30 days.

The request is necessary to operate the app: if it fails for a longer period, the app can no longer be used after a grace period. Whether and what the app costs is stated on the home page. If it becomes chargeable, we will add the necessary information to this policy (for example about the payment service provider) before any data is processed for that purpose.

Update check (only the version from our website): shortly after start-up and then roughly every twelve hours, the app retrieves the file “version.json” from our server to see whether a newer version is available. No device or user data is sent; only the usual server log data are processed (section 3.1). If you decide to update, the app downloads the new file from our server, verifies it using a checksum, and you confirm the installation in Android. The legal basis is Art. 6(1)(f) GDPR – our interest in keeping the app up to date and secure. The versions from Google Play and the Amazon Appstore do not check for updates themselves – the store delivers them.

5. App: storage and connections

5.1 What stays on your device

The app stores on your device: playlists (name, link and, where applicable, login details), imported channels, movies and series, favorites, recently watched channels, “continue watching” positions, selected languages, settings (including an optionally entered OMDb key) and – after a crash – an error report. All of this is kept in the app’s protected storage and is not transmitted to us; you are the only one who sees the error report, under Settings › About. You delete the data by removing it in the app, clearing the app data in the Android settings or uninstalling the app.

5.2 Your playlist provider

The app loads playlists, streams, channel logos, posters and descriptions directly from the addresses you enter or that are listed in your playlist – that is, from your provider and the servers it names. These parties learn your IP address, the app identifier (user agent) and – via your login details – who you are as a customer. The connection does not run through our servers; we have no influence on it and are not responsible for it. Your provider’s privacy policy applies.

5.3 Optional: IMDb ratings via OMDb

If you enter your own key for omdbapi.com in the settings, the app queries the title and year of a movie or series there to display the IMDb rating; the service receives your key and your IP address. Without a key, no connection is made.

5.4 Trailers via YouTube

If you choose “Trailer” for a movie or series, the app plays the trailer with YouTube’s embedded player directly in the app. Only then does your device connect to YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; for users outside the European Economic Area Google LLC, USA). Google receives, among other things, your IP address, device and browser data and the ID of the video, and may set cookies or similar technologies in the browser embedded in the app (WebView). We do not receive any data from this. If you do not choose “Trailer”, there is no connection to YouTube.

If a trailer cannot be embedded or the provider does not supply one, the app offers to open it in the YouTube app; YouTube’s terms then apply. The legal basis is Art. 6(1)(b) GDPR – the processing takes place at your express request in order to play the trailer. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023). More information: policies.google.com/privacy.

5.5 Installation via Google Play or the Amazon Appstore

If you download the app via Google Play, Google Ireland Limited processes data under its own responsibility, for example about the download, updates and your Google account (policies.google.com/privacy). If you download it via the Amazon Appstore, the same applies to the Amazon company operating the Appstore and your Amazon account (amazon.com/privacy). From Google or Amazon we only receive aggregated statistics, e.g. installation figures and anonymous crash reports. They do not allow any conclusions to be drawn about you. The activation described in section 4 works the same way in these versions, only with the additional information from which store the app comes.

5.6 Sending a playlist from your phone

While “Add playlist” is open (and shortly afterwards), a small web server runs in the app that can only be reached on your own Wi-Fi network. The link or file goes directly from the phone to the TV; it does not pass through our server.

5.7 Terms of use at first start

When you start the app for the very first time it shows the terms of use. Only once you accept them do the requests from section 4 (activation and update check) begin; if you decline, the app closes without anything having been sent to our server. The app remembers that you accepted the current version only on your device – we do not receive this information.

6. Recipients and third countries

• STRATO AG (hosting and domain name servers, Germany) – as a processor, for the data described in sections 3 and 4.
• Google (YouTube) – only if you play a trailer in the app (5.4).
• OMDb – only if you enter your own key (5.3).
• Google (Google Play) or Amazon (Amazon Appstore) – only if you install the app via that store (5.5).
• Your playlist provider and the servers it uses – at your choice (5.2).

Beyond this, we do not pass on or sell any personal data.

7. Storage period

• Server log files: deleted by the host after its short period (3.1).
• Device entries: as long as the device uses the app or the activation exists. We automatically delete entries of devices that were never activated and have not checked in for 12 months. On request, we delete an entry at any time (section 8); the app creates a new one at the next start.
• Log of rejected requests: 30 days.
• Emails: until the matter has been dealt with, beyond that only if required by law.
• Data in the app: until you delete it or uninstall the app.

8. Your rights

You have the following rights towards us, provided the legal requirements are met:

• access to the data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• receiving your data in a common format (Art. 20 GDPR),
• objection to the processing (Art. 21 GDPR).

Right to object: if processing is based on Art. 6(1)(f) GDPR (legitimate interest), you may object to it at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

How to exercise your rights: write to us at firat.oeztuerk@mail.com. So that we can find your device, please state the device ID; you’ll find it in the app under Settings › Device & playlists. Without it, we cannot assign requests to a device entry.

Right to lodge a complaint: you can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.

9. Security

The connection between your browser or the app and our server is encrypted via HTTPS. The app only connects to the server in encrypted form, and the server’s responses are digitally signed. The administration area is password-protected.

10. Changes

We adapt this policy when the website, the app or the legal situation changes. The version published here at any given time applies.