What we know about you.

The short version

There is no third-party analytics tool on this site or in any of the apps. The site counts its own visits, without cookies and without keeping your address (below), and the one thing Google Play’s Data safety form files under “analytics” is the fault report described below. No tag manager, no advertising pixel, no third-party font, no session recorder, no crash-reporting service, no advertising identifier. We do not follow what you watch: the channels, favourites, positions and locks live on your television and are not reported to us. They leave it only in a backup you take, which passes through our server on its way to your phone and stays there only if you choose to keep it in your account. The address of your IPTV provider, pasted to pair a television, is erased from our side the moment your television has collected it; what we keep of it is the host name, for support. When something fails to play, the television tells us what kind of failure it was and your provider’s host name, never which channel or film; when the Android app closes by itself, it tells us where in its own code, the next time it starts.

What is left is what a licence needs in order to belong to someone: an account, a payment, and a way for a television to prove it is entitled to play. Everything the television plays comes straight from your provider. Two things come from elsewhere: pictures come from wherever your provider’s own data says they are, and trailers come from YouTube. On the home screen a trailer starts by itself, and YouTube then receives your network address, the television’s user-agent and which trailer it is (how to turn that off). To delete an account or what a television left with us, see Deleting your account or your data.

Who is responsible

The controller of this processing is the publisher of Lumen·TV, the app of that name for LG televisions and for Android TV and Google TV: a sole trader (micro-entrepreneur) established in France.

For anything in this notice, including a request to exercise a right below, write to support@lumentv.app. There is no data protection officer: the processing here does not meet the conditions of article 37 GDPR that would require one.

What is collected, and why

Your television

The same for both apps unless a line says otherwise.

Field	Why it exists	Legal basis
A device identifier	A SHA-256 hash computed on the television. On an LG television it is made from the set’s network (MAC) address and its model. On Android TV and Google TV it is made from the model and the ANDROID_ID, a random number Android gives this app on this device, which changes after a factory reset. Where the television will not give the app that address or that number, the app draws a random number once and keeps it instead. A second hash of the same facts, the hardware signature, is sent with it when the television asks for its trial and when it enrols: a request that names a television we know, with a signature that does not match, is refused and recorded. The identifier is what a licence seat is attached to, and what tells a trial it has already been used on this set. We never receive the ANDROID_ID, only the hashes.	Contract
Model, system version and app build	The manufacturer and model, the system version (webOS, or Android and its API level) and the build of the app, sent when the television starts its trial. They say whether the set can run the app, and they make a support conversation possible without asking you to read numbers off a menu.	Contract
An LG television’s network address	When an LG television starts its trial, the app also sends the set’s network (MAC) address itself, if the television lets the app read it. It is kept with the television’s record, and support can look a set up by it. An Android television sends nothing of the kind.	Legitimate interest — support
A device secret	Thirty-two bytes that prove a request comes from this television and not from someone who learned its identifier. Our server issues random ones to an LG television. An Android television derives them from its ANDROID_ID and proposes them, so that it finds its way back after a reinstall. They travel only inside requests to our API, over HTTPS, and we store only a hash of them.	Legitimate interest — securing your licence
A six-character support code	Derived from the identifier, not issued, and shown in the television’s Settings → About and Settings → Licence, and on the screen that says the app could not start. It is what you read out to support so that a set can be found without you reciting a hash.	Contract
First and last seen	When the television first reached us, and when it was last in touch. The date moves when the television starts its trial, sends a fault report or checks its licence, which it does every time the app starts; a licence check moves it at most once every ten minutes. It is how a seat that no set has used for a long time is recognised, and how we count, for a partner, how many of the televisions they brought are still in use.	Legitimate interest — support, and the partner programme
The partner who installed it	Only when a partner set the television up for you and attached it to their partner account, from their own phone, by scanning the code the television showed within its first seven days: which partner, and when. If the television is then put on a licence, that partner is recorded on the licence too, so that their commission can be calculated. The partner sees counts of the devices they attached and of the customers they became, never who those customers are.	Legitimate interest — the partner programme
What failed to play	When a channel, a film or a playlist fails to play, or the app fails to start, the television reports what kind of failure it was and whose fault it judged it to be (provider, network, television, a mistyped entry, or unknown). It also sends the error code, which player engine was in use, the kind of playlist and your provider’s host name, and, when your provider refused a stream, the status number it answered with (such as 404). When a stream your provider refused then played because the app asked for it differently, the television reports that too, with the status the provider had answered and what made it play: another file type, the other live format, which player the app introduced itself as, or a short wait. The host only: never the full address, the username or the password, and never which channel or film. The same report is sent at most once a minute. If the Android app closes by itself, it writes down what went wrong in its own code and sends it the next time it starts: the kind of error, its message with every address, host name, email address and credential removed, the names of the app’s own functions it was in, the app’s version, the Android version, the model and how much memory the app was allowed. Deleted after ninety days.	Legitimate interest — support
The update check	Shortly after its home screen appears, the app asks our server which version of it is the latest, so that it can put a dot in Settings when yours is older. The request carries no identifier, no code and no account. Our server sees only what any request shows: the network address it came from and the television’s user-agent, which names its system version and usually its model. Nothing about it is written to the database. Like every request, it passes through the API’s request log (below).	Legitimate interest — keeping the app up to date

What stays on your television. Your playlists and the credentials in them, the programme guide, favourites, positions in films and series, the parental lock and its PIN (as a salted hash), profiles, settings and recordings are kept on the television and are not sent to us, except inside a backup you take (below). Recordings are written to the television or to a drive plugged into it. The Android app opts out of Android’s own device backup, so none of this is copied to a Google account either. It asks the system whether Google Play installed it, to know whether to offer a button to its Play page, and that answer stays on the television.

Your account

Field	Why it exists	Legal basis
Email address	A licence belongs to a person, and that person has to be reachable and recoverable. It is where a password reset is sent. A television linked to the account shows it, partly masked, in Settings → Account.	Contract
Password, hashed	Stored as a one-way hash. Nobody here can read it, including us.	Contract
A password reset	Only if you ask for one: a hash of the link we email you, when it was asked for, and the network address that asked. The link works once, for an hour. The row is deleted a month after the link expires, because “did somebody ask for a reset on my account” is a question support is asked.	Contract; the address, legitimate interest — security
When the account was made and last used, and failed sign-ins	The date the account was created, and a last-activity date, set when the account is made. It moves when you sign in with Google, and when a payment made without signing in, such as one on a television’s own payment page, is matched to the account by its email address. Signing in with a password, or paying while signed in, does not move it. Failed password attempts are counted, and after too many the account refuses sign-in for a while; the count and that time are kept on the account and reset when a sign-in succeeds. The account also keeps the moment from which older sign-in cookies stop working, which moves when you set, change or reset your password.	Contract; failed sign-ins, legitimate interest — security
Google account identifier, email address, name and picture	Only if you choose to sign in with Google. It is the identifier, the email address, the display name and the avatar URL Google returns, nothing else, and no access to anything in your Google account. The email address becomes the account’s address, or finds the account that already has it. The picture is never shown on this site, so your browser does not fetch it from Google here. A television linked to the account shows it with the name in Settings → Account, and fetches it from Google to do so.	Contract
Licence, plan and seats	What you bought, which televisions are using it, and which have used it before and when. A seat that is given back is marked, not erased, because “which sets has this licence been on” is what support is asked.	Contract
Backups	Only if you keep one. A backup is a copy of a television’s setup: every playlist with its full address, provider username and password included; the favourites, hidden and reordered channels; parental locks with the PIN’s salted hash; the films or episodes being watched with where you stopped (the last five, from Android), each with its address, which for an Xtream account carries the credentials too; recently watched channels (LG); scheduled recordings, and from an LG television every recording on its list, the ones already made or missed included, with their programme, channel and times; and the language and buffer settings. It is stored as the television wrote it and is not encrypted separately. You can keep one television’s copies per licence seat (one without a licence), three versions each; keeping a fourth replaces the oldest.	Contract

Your payment

Payment is handled by Stripe. Your card number never reaches this site or our servers: the fields you type are served by Stripe and go to Stripe. What we store is what a licence needs to be matched to its payment and a refund to be found later: the identifiers Stripe gives you as a customer and gives each payment or subscription, the plan, the amount and currency, what was refunded, and when a subscription’s paid period ends. We also keep the identifiers of the events Stripe has sent us for ninety days, so that the same event is not applied twice.

Pairing a playlist, and backups

When you add a playlist from your phone, the address you paste is held in a single row for at most ten minutes and erased the moment your television collects it. The same is true of a backup sent from your phone to a set. Both hold credentials (an Xtream address carries your provider username and password in its path), which is why neither is kept and why the audit log records only the host name, never the credentials, and never the full address.

A backup taken on the television goes the other way. The set uploads it under a code that lives ten minutes, and your phone opens that code to download the copy as a file. If you are signed in and choose to keep it, or later upload that file from your account page, it is stored in your account, with the credentials it contains, until you delete it there, newer copies push it out, or the account is closed. Nothing is kept in an account unless somebody signed into it asked for that.

Trailers, pictures and your provider

The television plays what your provider sends, straight from your provider. When it plays, the app connects to the addresses in your playlist, and neither the streams nor your credentials pass through us; your credentials reach our server only inside a playlist sent from your phone or a backup, as described above. Channel logos, posters and backdrops are fetched from wherever your provider’s data says they are, and those servers see your network address, as with any request.

When your provider’s catalogue names a trailer for a film, the app plays it from YouTube, through its privacy-enhanced player (youtube-nocookie.com). On the home screen, a trailer starts by itself behind the title after a moment. That is the Autoplay previews switch, which is on unless you turn it off (an Android television short of memory starts with it off). Whenever a trailer loads, by itself on the home screen or because you asked for one on a film’s page, YouTube receives your network address, the television’s user-agent, which names its system and often its model, and which trailer it is. From that address YouTube can tell roughly where the television is, as any site can. Once a trailer has played, YouTube may keep identifiers of its own in the app’s web storage, under Google’s privacy policy.

To stop trailers loading by themselves, open Settings → Home screen on the television and turn off Autoplay previews. A trailer then loads only when you ask for one. The legal basis we rely on for playing trailers is legitimate interest.

Logs and abuse prevention

The API keeps an audit log of what happens to a licence and to a television, because that is what makes a dispute answerable. It records events such as a trial started, a television enrolled, a licence checked, a playlist or backup delivered (the host name only), a seat taken or given back, a payment, a refund, and an account closed. Most entries carry the network address the request came from and its user-agent; a television’s user-agent names its system version and usually its model. Both are removed after ninety days. An entry recording a purchase also holds the email address given at payment, which is removed when the account is closed; a payment that reaches a closed account is recorded without it. Requests are rate limited, which requires holding a network address briefly in memory.

The web server in front of the site and the API keeps no access log. For each request it answers, the API writes the time, the network address it came from, the method, the path and the status of the answer, but not the content. The path is written without the query string that can follow it, and with a password-reset link, or one of the ten-minute codes that pass a playlist or a backup between a phone and a television or add a television to a licence, replaced by a placeholder. What is left of it can still name a television by its identifier, a partner by the name in their links, or a record of ours by its number. When something goes wrong it also writes a line saying what failed. The lines our code writes name an account, a television or a payment by its identifier rather than by an email address; an unexpected error is written as it was raised, with its own message. All of these lines go to log files of a fixed size that are overwritten as they fill.

Writing to support

Mail sent to support@lumentv.app is received by OVH’s mail service. We keep the conversation so that the next question does not start from nothing, and delete it from the mailbox when you ask. Support may also write a short note of it against your account or your television in our console. Notes about an account are deleted when the account is closed, and a note about a television alone when what that television left with us is deleted (below).

Partner links

If you arrive through a partner’s link, and only if you agree on the page that asks you, a cookie named lumen_aff records which partner sent you, for ninety days, so that their commission can be calculated. The click itself is recorded with your network address, the browser’s user-agent string and the referring page the browser reports. If you decline, no cookie is set and nothing about you is recorded. The cookie page covers this in full.

If you are a partner, your application and, when you give them, the bank details your monthly payment is sent to are kept to run the programme, and are never written to our logs. Your partner space is linked to the account you accepted your invitation with, whether you sign in to it with Google or with an email address and a password: your partner record names that account, and we note whether its address is the one you applied with and how the account signs in. You sign in to it like any account, and signing out is all it takes to stop a phone being yours. Closing that account, or asking us, unlinks it; the partner record and what you earned stay with the programme.

Visits to this website

To know how many people visit this site and press Download, the site counts page views itself, without cookies and without storing anything on your device. Each visit sends this site’s own server the page, the website you came from (its domain only), your browser’s language and, when you press a download button, which one. Our server adds one to daily totals and keeps nothing else: not your IP address, not your browser’s description, and no identifier. To count a visitor once a day, it combines your address and browser description with a random value that changes every day and is never written down, and forgets the result at midnight. If your browser sends Do Not Track or Global Privacy Control, your visit is counted as a page view but never as a visitor. No third party receives any of it, and the daily totals are deleted after 25 months.

Network addresses of your devices and account

To protect accounts and licences against fraud and unauthorised sharing, and to help you when you contact support, we record the IP address that each of your devices, and your account on this website, connects from, together with its approximate location (country and city). The location is looked up on our own server in a geolocation database (DB-IP); your address is not sent to anyone to do this. The legal basis is our legitimate interest in preventing fraud and licence sharing and in supporting you. Each address is deleted 90 days after it was last used, and straight away when you close your account or ask us to forget a device. It is not shared with anyone.

Who else sees it

Five, and this is the whole list. Stripe and Google also serve a script to the pages that need it, so opening one of those pages tells them your network address and which page it was.

Who	What for	Where
Stripe Payments Europe, Ltd.	Taking the payment and issuing refunds. On the card payment page, Stripe’s script loads from js.stripe.com, takes the card details directly, and may set cookies of its own to detect fraud.	Ireland, with transfers outside the EU governed by the European Commission’s standard contractual clauses.
Google Ireland Limited	Signing in with Google, if you choose to. Its sign-in script loads from accounts.google.com on the sign-in page, on the account page until Google is linked, on the page that adds a television to your licence, and on a partner’s invitation page, whether or not you then use it. If you do, Google tells us the identifier, name, email address and picture listed above. Google also serves that picture to a television linked to the account.	Ireland; Google also processes data in the United States, under the safeguards its own privacy policy sets out.
YouTube, a service of Google Ireland Limited	Playing trailers, including the ones the home screen starts by itself. It receives the network address, from which it can tell roughly where the television is, the user-agent and which trailer, as described above.	Ireland; Google also processes data in the United States, under the safeguards its own privacy policy sets out.
OVH SAS	The virtual server this site, the API and the database run on, and the mail service that receives what is sent to the support address.	France (Hauts-de-France)
Resend	Sending the only two emails we send: a password reset, and a partner’s invitation. It receives the address it goes to and the message, which carries the reset or invitation link.	Sent from Resend’s European Union region, in Ireland. Resend itself is based in the United States, and its access from there is covered by the safeguards its data processing agreement sets out.

Two others are not ours to list, but the television talks to them directly. One is your IPTV provider, with the servers its playlist names for streams, the guide and pictures. The other is the place you installed the Android app from: Google Play, which installs and updates it under Google’s own terms, or our own website, lumentv.app, which serves the file from our server like any other page. If you use the short code in the Downloader app, Downloader and its maker AFTVnews look up that code and send your device to lumentv.app; that lookup is theirs, under their own terms.

The database is not a third party’s: it runs on the same server as the rest of it, and it is not shared with anyone. It has no copy anywhere else today. If one is set up, the copies will be encrypted on our server before they leave it, and this page will name where they go before the first one does. Nothing is sold, rented, or handed to an advertising network, because there is no advertising network in this product.

How long it is kept

What	How long
A playlist address or a backup on its way between your phone and a television	Ten minutes at most, and less when the television collects it sooner. One nobody collected is erased within a minute of its code expiring. The copy of the database kept today leaves them out (below).
An expired pairing code	Emptied within a minute of expiring: a playlist address, guide address or backup the television had not collected is erased. What is left says which television asked for the code, when, and whether and when it was used. For a playlist it also holds the name typed for it on the phone, if one was. For a code that added a television to a licence, it says which account did it. That row is deleted when the same television next asks for a code to add a playlist, restore a backup or join a licence. It is also deleted once it is a day past expiry, the next time any television asks for one of those. It is deleted on the first night after thirty days at the latest. The code a television shows to send its own backup to your phone is kept apart and deletes none of them.
A television’s record: its identifier and hardware signature, model, system and build, an LG television’s network address, support code, the secret’s hash, first and last seen, its trial and the seats it has held	For as long as the service runs, because it is what a seat is attached to and what stops a free trial from being taken twice. What the television reported about itself can be deleted on request. The hashes and dates that stop that second trial and keep its identity secure stay, and so do the seats it has held, which are part of a licence’s record (below).
Your account and licence	For as long as the account exists. A lifetime licence has no end, which is the point of it. When the account is closed, your email address, name and sign-in details are erased at once; the licence and payment rows stay, without them, as the rows below say.
A backup kept in your account	Until you delete it, three newer copies of the same television push it out, or the account is closed. Closing the account deletes every backup kept there.
A password reset	A month after its link expires, which is an hour after it was sent.
The record of a purchase: the licence, its plan, what was paid and refunded, and the identifiers Stripe gave the payment, the subscription and you as a customer	Kept. French accounting law requires the records of a sale to be kept for ten years (article L123-22 of the Commercial Code). Nothing deletes them after that today, so they are kept for as long as the service runs.
Which televisions held a licence, and a block put on one	Kept with the licence, for as long as its record is kept: it is how support answers “which sets has this licence been on”. It is not an accounting record and no law requires it to be kept; nothing deletes it today.
Stripe event identifiers	Ninety days.
The network addresses your devices and account connect from, with their approximate location	Ninety days after each was last used, and at once when the account is closed or a device is forgotten.
The website’s daily visit totals	Twenty-five months, then deleted. They name no one.
The audit log	The entries stay, because “what happened to this licence” is what support is asked. The network address and user-agent in each are removed after ninety days, and the email address in a purchase’s entry when the account is closed. A payment that reaches a closed account is recorded without it.
Reports of what failed to play	Ninety days, then deleted.
Partner click records	Ninety days, the same as the cookie. The address, user-agent and referring page are then removed.
The API’s log of requests and errors	Until it is overwritten: the files have a fixed size, not a fixed lifetime.
Mail to support	In the support mailbox until you ask for the conversation to be deleted.
Support’s notes	A note about an account, until the account is closed. A note about a television alone, until what that television left with us is deleted on request. A note about both goes when the account is closed.
Copies of the database	None is made automatically today. A copy taken by hand before maintenance stays on the same server, is read only to restore the service, and is deleted by hand, on no set date. The ones there today, taken on 26 September and 19 October 2026, are readable only by the server’s administrator; the first leaves out the playlist addresses and backups that were on their way, the later ones may hold one that was in transit at that moment. Something erased from the live database since a copy was taken (an address after ninety days, a fault report, a closed account’s email) survives in that copy until the copy is deleted.

What you can ask for

Under the GDPR you may ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, ask for the processing to be restricted, ask for it in a portable form, and object to processing based on legitimate interest. Where processing rests on your consent, you may withdraw it at any time, and withdrawing it is as easy as giving it was.

Write to support@lumentv.app from the address on the account. For a television, quote the six-character support code shown in its Settings → About. We answer within one month, which is the limit article 12 sets.

If you think this processing breaks the law, you may complain to the supervisory authority. In France that is the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr/fr/plaintes. You may also complain to the authority of the country you live in.

Deleting your account or your data

This is how to delete a Lumen·TV account, or what our server holds about a television, whether you use the app on an LG television or on Android TV and Google TV.

Your account. Sign in at www.lumentv.app/account and choose Close this account at the bottom. If you pay monthly, cancel the subscription first, under Invoices, card and cancellation on the same page: closing the account does not stop Stripe from charging, and once the account is closed that page is out of reach. Closing is immediate and cannot be undone.

• Erased: your email address, name, picture, Google link, password and sessions, the account’s last-activity date and failed sign-in count, support’s notes about you, and every backup kept in the account. Your email address also goes from the records of your purchases, and a password-reset link you asked for stops working. A payment you started from the account and that is only paid after the closure is recorded without your email address. One started on a television’s own payment page names no account, so when it is paid it is recorded like any payment made there: under the address it was paid with, which opens a new account.
• Ended: every television comes off each of the account’s licences and every licence is withdrawn, so the televisions stop at their next launch.
• Kept, without your name or email address: the record that a licence was bought, its payments and refunds with the identifiers Stripe gave them, the customer identifier Stripe gave you, and which televisions held each licence; and, if a licence came from a reseller’s key, the record that the key was used. The records of a sale are kept at least the ten years French accounting law requires, and nothing deletes any of these after that today (How long it is kept). Stripe keeps its own payment records under its own policy. The audit log keeps its other entries, whose network addresses go after ninety days as everywhere else, and a password reset row goes a month after its link expired.

If you cannot sign in, write to support@lumentv.app from the account’s address. We ask that address to confirm, cancel a monthly subscription at Stripe, and close the account for you within thirty days.

What a television left on our server. Write to support@lumentv.app with the six-character support code shown in the television’s Settings → About or Settings → Licence. You do not need an account. A support code is on the screen for anybody in the room to read, so it says which television is meant but not whose it is. A request made with one therefore deletes what the television reported about itself, and nothing that belongs to an account. Within thirty days:

• Deleted: its model, system and build, an LG television’s network address, when it was last in touch, its fault reports, the codes it asked for, and the notes support wrote about it alone. Its own entries in the audit log (its trial and any later request for another, its enrolment, its licence checks, the playlists and backups passed to or from it, and requests from its own payment page) keep their date and lose their link to it, the network address, the user-agent and the provider’s host name. The entry for a seat it gave back by itself loses its network address.
• A television that holds a seat on a licence comes off it only with the agreement of that licence’s account holder, whom we ask. Without that agreement, what is listed as deleted above is deleted all the same, and the seat stays until the account holder frees it from their account page.
• Kept, the television’s own: its identifier and hardware signature, the support code derived from the identifier, the hash of its secret with the dates it was set and first used, the date it first reached us, the dates of its trial, and the record that the deletion was done. They stop the free trial from being taken on it a second time, keep anybody else from using its identity, and show that the request was carried out. On an LG television that let the app read its network address, the identifier and the signature are hashes of that address and the model. LG’s address prefixes are published and its models are a public list, so both can be worked out again from what is kept by trying every combination: they are gone from our records, but not beyond recovery. On an Android television, or an LG one that did not give its address, the hashes are made from a random number the television holds (on Android, with the model), and cannot be worked back without that number.
• Kept, an account’s: the seats it held on a licence and gave back, a block an account holder put on it, a licence’s record that it was bought from this television, the account holder’s and support’s own entries about it in the audit log, copies of its setup kept in an account, and notes that are also about an account. They are that account’s records, or support’s, and are not deleted on a television’s request. The account holder can delete kept copies on the account page.
• Kept, for security: the records of requests refused in the television’s name (a signature that did not match, an enrolment refused), with the network address they came from until the ninety days every address is kept. Their user-agent, which can name the television’s model, is deleted.

A payment made on the television’s own payment page carries its identifier in Stripe’s record of that payment, which Stripe keeps as it keeps every payment record. A copy of the database taken before the deletion keeps the old rows until that copy is deleted.

A backup kept in your account. Delete it on the account page, one copy at a time. It is gone at once.

What stays on the television. It never reaches us, so it is deleted on the television: uninstall the app, or on Android TV and Google TV clear its storage in the television’s settings. On an LG television, a recording written to a USB drive stays on the drive until you delete it. On Android TV and Google TV, recordings are kept in the app’s own folder, on the television or on the drive, and uninstalling the app deletes that folder from every drive plugged in at the time.

Things this product does not do

• No automated decision-making with legal or similarly significant effect, and no profiling.
• No advertising, no advertising identifier, no audience measurement by a third party.
• No sale, rental or exchange of personal data. There is no arrangement under which that could happen.
• No data knowingly collected from children. The product is sold to adults and requires a payment method.

When this notice changes

The date at the top moves whenever this page changes. We do not write to account holders about it: the only email this service sends is a password reset.