Privacy policy
1. Who processes your data
The controller is Arxon Labs ("we"). Contact for data protection questions: arxonlabs1@gmail.com.
This policy applies to the Arxon Player app on all platforms (Android TV, Android mobile, iPhone/iPad, Samsung Tizen, LG webOS, Windows and others), the websites arxonsite.com and arxonlabs.eu, the app portal, the Arxon Admin app and the reseller panel.
We have not appointed a Data Protection Officer, as the law does not require one for the scale of our processing.
2. In short
- Arxon is only a player. We do not sell or provide any channels or content.
- You don't need an account, name or e-mail. A device is identified by a MAC address generated by the app and a secret device key.
- Playlists are stored on the server encrypted with your device's key – without it, not even we can read them.
- We use no advertising, no analytics and no tracking cookies. We do not sell data.
- Card details are seen only by Stripe (or the Google / Apple store), not by us.
3. What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Device: MAC address generated by the app, device key (stored only as a hash), platform, registration and last-connection time, last IP address, licence status and validity, optional device name and note | pairing, licence, trial, abuse prevention, support | performance of contract (Art. 6(1)(b) GDPR); legitimate interest in security (f) |
| Playlists: name, server address, username and password for the service you add yourself (M3U / Xtream), EPG address | delivering the playlist to your device | performance of contract |
| Cloud backup (only if you turn it on): hash of your phone number, place name (e.g. "living room"), encrypted backup of licence, playlists, favourites and settings; sync of watched movies and series | restore after reinstalling, continue watching on another device | consent / your request ((a), (b)) |
| Favourites across devices: encrypted favourites list | downloading favourites to another device | performance of contract |
| "Send to TV": link between phone and TV (MACs and device names), one-time code, temporarily encrypted stream address | sending a channel or video from phone to TV | performance of contract |
| Voice and video calls (only if enabled for the device): contacts (MAC and the name you enter), auto-answer, call record (who, to whom, audio/video, state, time), technical data to set up the connection | connecting the call | performance of contract |
| Web payments: e-mail, product, amount, currency, language, device MAC or reseller account, consent to immediate performance, payment time | selling the licence, receipt, accounting, complaints | performance of contract; legal obligation (c) |
| Resellers: username, password (hash only), display name, credits and their history, assigned devices | managing resellers and licences | performance of contract |
| Support: e-mail, message, possibly device MAC, language and the IP address of the form sender | answering your question | legitimate interest / performance of contract |
| Technical data: IP address and time in server logs, attempt counters (IP or MAC as a hash) | security, protection against attacks and key guessing | legitimate interest |
We do not process your name, address, location, phone contacts or live-TV viewing history. The cloud-backup phone number is not stored in readable form – only its hash.
4. What stays only on your device
- Camera and microphone – used only during a call you start or accept. We do not record or store video or audio.
- Parental lock, favourites, settings, last channel – stored on the device (sent to the server only for backup or favourites sharing, encrypted).
- Detailed log (diagnostics) – if we enable it to troubleshoot, it writes only to the device's system log and is not sent to the server.
5. What the app connects to directly
The app connects directly to servers that are not ours and for which we are not responsible. Their operators see your IP address and process data under their own policies:
- Your playlist provider – the service whose address and credentials you added. Arxon has no contract with it.
- Programme guide sources (EPG) – by default epgshare01.online and open-epg.com, or a source you enter.
- STUN servers (Google, stun.l.google.com) – only during calls, to discover the public address needed for the connection. The call itself is encrypted (WebRTC) and runs directly between devices or via our TURN relay; we do not store call content.
6. Who we share data with
- Hosting – [HOSTING PROVIDER, e.g. Webhouse s.r.o., Slovakia]: server, database and e-mail.
- Stripe Payments Europe, Ltd. (Ireland) – web payments. Stripe acts as an independent controller for payment processing.
- Google Play, Apple App Store, Samsung, LG and other stores – if you buy a licence in a store, the store handles payment under its own terms; we only receive a purchase confirmation.
- Reseller – if a reseller activated your licence, they see your device's MAC, name and status (not playlists or passwords).
- Accountant and authorities – accounting records only, or where required by law.
We do not sell data, use it for advertising or profiling, or make automated decisions with legal effects.
7. Transfers outside the EU
We store data on a server in the EU. Some providers (Stripe, Google) may also process data in the USA, based on the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.
8. How long we keep data
- Device and playlists – as long as you use the device. A device without a licence that has not connected for [12 months] may be deleted. A playlist whose provider subscription expired more than 7 days ago is deleted by the app.
- Cloud backup – until you delete it or ask us to.
- "Send to TV" – stream address for a few minutes, one-time code until it expires.
- Calls – connection data 10 minutes, ended-call record 7 days, contacts until you delete them.
- Payments and accounting records – 10 years (Accounting Act).
- Support correspondence – [2 years] after resolution.
- Server logs – per hosting settings, usually up to [30 days].
9. Security
All communication uses HTTPS. Playlists, backups and shared favourites are encrypted (AES-256-GCM) with a key known only to your device or derived from your phone number and PIN. Device keys and reseller passwords are stored only as hashes. Attempts are rate-limited.
10. Cookies
The websites use only strictly necessary cookies: lang (chosen language, 1 year) and, on arxonlabs.eu, the login session. We use no analytics, marketing or third-party tracking cookies, so no consent is needed. When paying you are redirected to Stripe, which uses its own cookies.
11. Children
The app is not intended for children under 16 and we do not knowingly collect their data. Only adults may purchase a licence.
12. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interest, and to withdraw consent at any time.
How to request deletion: write to arxonlabs1@gmail.com with your device's MAC address (shown in the app). We delete the device, playlists, backup and favourites within 30 days. Accounting records must be kept as required by law. You can also delete a playlist yourself on the My device page and your cloud backup in the app.
If you believe we handle your data incorrectly, you can lodge a complaint with the Slovak Data Protection Authority (Úrad na ochranu osobných údajov SR, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk) or the authority in the EU country where you live.
13. Changes
For a material change (e.g. a new provider we share data with) we will update this page and the effective date and let you know in the app or on the website.