Privacy statement

Who is responsible?

Stream Nova, the provider of StreamNova Player, is responsible for the data described in this statement. Stream Nova is a trade name registered in the Netherlands (Dutch Chamber of Commerce, KvK number 80651267).

You can always reach us at [email protected].

Which data do we process?

This is the data we need to make the app and your licence work:

• Device account: instead of an account with an email address, each device gets its own account. For that we store an installation ID, a public key of your device, a protected check value (HMAC) of your recovery code, and the date your trial started. We never store the recovery code itself.
• Installation ID: this is derived from your device's ANDROID_ID and the app's package name (the first 40 bits of a SHA-256 hash). The ANDROID_ID cannot be calculated back from it. It stays the same after a reinstall and changes after a factory reset. We use it to enforce the one-time trial and to prevent abuse.
• Origin of your device: when you first use the app, and occasionally afterwards, we store on your device account the country, the network provider (for example your internet provider) and a shortened IP address with its last part removed. This lets us prevent abuse of the trial period, help you when you run into problems and see in which countries StreamNova is used. We never store your full IP address. This data is kept for as long as your device account exists and is deleted together with the account. We determine the country and provider on our own server, using the IP database of DB-IP.com. IP data: DB-IP.com (CC BY 4.0).
• Licences: which licence belongs to your device, with its status and term.
• Payments: you pay through Google Play or Stripe. We only receive the status and the amount of your payment, never your card details. Stripe asks for your billing address so it can work out the VAT of your country.
• Product analytics (usage statistics without name or content): if your device region is set to the Netherlands, the "Help improve the app" switch is on by default; in other countries, or if the region is unknown, we collect nothing until you turn it on yourself. This is pseudonymised usage data, such as which screen or feature you use and what kind of error occurred. We only recognise your device by a hashed version of your installation ID (see above); we do not link the statistics to your account, we do not collect your IP address or email address, and we share nothing with third parties. We keep it for 90 days. If you turn the switch off, collection stops and we delete your device's data right away.
• Web session: when you open My device on this website, you exchange a TV code or your recovery code for a token that is valid for 30 minutes. The token is kept in an httpOnly cookie named sn_web. We use your IP address only temporarily, to slow down too many attempts (rate limiting): shortened to /24 (/48 for IPv6) for the counter of wrong codes and hashed for the general limit. Both expire automatically after a short time.

What do we not process?

We do not ask for or keep an email address, a name, a precise location (only the country, see above) or an advertising ID. We do not collect your viewing habits (which channel or programme you watch).

Your sources, such as playlist addresses and logins, stay on your own device and can never be read by us. If you transfer them to your TV with your phone or via this website, that happens end-to-end encrypted: we only see encrypted data that we cannot open.

There are no third-party cookies and no advertising or tracking services. There are only two cookies, both functional: the session cookie sn_web, which we use only when you open My device, and the cookie sn_lang, which remembers your chosen language for 1 year; and we read the country from the connection only to choose the language, without storing it.

On what basis may we do this?

For the device account, the licence and the payment, we use your data to carry out our agreement with you. We also keep payment records because tax law requires it.

We enforce the trial and prevent abuse based on our legitimate interest: without it, anyone could repeat the trial endlessly. We also process the origin of your device (country, network provider and shortened IP address) based on our legitimate interest (Article 6(1)(f) GDPR): preventing abuse, helping you with problems and statistics on use per country.

For product analytics, the legal basis depends on your device region. In the Netherlands it is our legitimate interest (Article 6(1)(f) GDPR): improving the app and tracking down faults. Storing and reading data on your device is covered there by the exemption for analytics with little impact on your privacy (Article 11.7a(3)(b) of the Dutch Telecommunications Act). In other countries, or if the region is unknown, we first ask for your consent (Article 6(1)(a) GDPR), which you withdraw just as easily by turning the switch off.

How long do we keep data?

We keep your device account and licence for as long as the account exists. If you delete the account, we anonymise the account data and revoke the sessions. When you delete the account, we also erase the origin data (country, network provider and shortened IP address) of your device.

We keep payment records for 7 years, because tax law requires it.

We keep analytics events for 90 days. After that only summed daily figures remain, in which no device or person can be recognised.

A web session lasts 30 minutes. A TV link is active for 24 hours at most and is then deleted.

What can you do yourself?

You may view, correct and delete your data, and object to its use. You do not need to log in with an email address: go to My device on this website and use your recovery code or TV code. There you can see your data and delete your account.

You have the right to object to product analytics (Article 21 GDPR). You do this directly in the app: turn off the "Help improve the app" switch or choose "Erase all data" in the settings. We then stop right away and delete the data collected from your device. With "Erase all data" you additionally remove everything on your device.

Does that not work, or do you have another question? Email [email protected]. If you disagree with how we handle your data, you can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or with the data protection authority of the country where you live.

Who helps us, and where is the data?

Our systems run on our own servers in Frankfurt (EU). Regional servers elsewhere contain no personal data.

For payments we work with Stripe and Google (Google Play). They are themselves responsible for processing your payment details and may process them outside the EU under their own safeguards. We share no other data with third parties.

Changes and contact

If what we do changes, we will update this statement and the new date appears at the top. For major changes we also tell you in the app.

Questions? Email [email protected].