Privacy Policy

Who this page is about

• You, the person or business with an M3UTool account or an M3UTool Player account. For your account, M3UTool decides how the data is used (we are the controller).
• Your customers, the people who watch through your service. You decide what happens with their data; M3UTool stores and uses it only to run the service for you (we are your processor, see section 6 of the Terms).

Your account

• Account details: username, email address, password (stored only as a hash), when you last signed in and whether your email is confirmed.
• What you build in the editor: playlists, channels, categories, guide mappings, logos, your brand (name, logo, colour, custom domains), your customers and the logins for your providers.
• Security records: a log of important actions with the IP address they came from, including when our staff open your account to help with a support request, and a log of every call made with your API keys (time, IP address, what was called).
• API keys: stored as a hash. Keys made since October 2026 are also stored encrypted, so you can see them again in your account.
• Two-step sign-in, if you turn it on: the secret of your authenticator app, stored encrypted, and your recovery codes, stored only as hashes.
• Payments: you pay through PayPal, by card or with a PayPal account. PayPal tells us the payment's number, amount and status and the payer's email address; we keep that with your account. We never see your card number.
• Support: your tickets, messages and the screenshots you attach. An email you send to [email protected]becomes a ticket as well; the original email stays in our support mailbox.
• Discord, if you connect it: your Discord ID, name and avatar, and the notifications you chose to receive there.
• Free trial: when your trial started and ends. So that each Discord account gets one trial, we keep a one-way fingerprint of the Discord ID it started with (not the ID itself), also after you disconnect Discord or close the account.

We use this to run and bill your account, keep it secure, prevent abuse and help you when you ask. We send service emails only (email confirmation, billing notices), never newsletters.

If you email [email protected] without an M3UTool account, we keep your email address, the name your email shows, and your email with its pictures as a ticket, so that we can answer you. Automatic replies, such as out-of-office notes and delivery failures, are kept the same way.

M3UTool Player accounts

If you use M3UTool Player with your own TV subscription, we store:

• Account details: your email address, your password (stored only as a hash), whether your email is confirmed, and when your free trial started and ends.
• Your licence: yearly or lifetime, until when it is paid, and the PayPal payment numbers.
• Your devices: up to three, each with the name you gave it, the device model, the app version, when it was last seen and its last IP address.
• Your playlists: the playlist address and login you entered, stored encrypted.
• Support: the messages you send us from your account page.

We use this to run your licence and your devices and to help you. We never see or store what you watch in M3UTool Player.

Why we may use your data

• To provide what you signed up for (your account, the editor, the apps, billing and support): because we have a contract with you.
• To keep M3UTool secure and working (activity and sign-in logs, abuse prevention, crash reports, the staff access log): because we have a legitimate interest in a safe, working service.
• To keep payment and tax records: because the law requires it.
• To send you Discord messages: only because you chose to connect Discord. You can disconnect it at any time in the editor.
• Your customers' data: we use it only on your behalf, as your processor. Your own legal basis applies.

We make no automated decisions about you that have legal or similar effects.

Your customers' data

When you add customers, M3UTool stores and uses the following for you:

• Customer records: the name or label you give them, their usernames and passwords for the feed, expiry date, connection limit, when their app last loaded their list and the messages you send them. Feed passwords are stored as entered, because player apps sign in with them.
• What they watch: live sessions (channel, IP address, device and app), which you see under Who's watching, and a history of the channels they played and when, kept for 7 days.
• Synced app data: profiles (name, kids profile), favourites, watch progress, recently watched, home screen layout and hidden or locked categories. A parental PIN is stored only as a salted hash.
• Devices and problems: activation codes with the device name, crash reports and logs the apps send (device model, operating system, IP address) and support messages your customers send you from their portal.
• Video in the web player: the stream can pass through our relay server on its way to the browser.
• Video in other player apps: when a customer plays a channel through your Xtream or M3U link, M3UTool sends their app on to your provider's stream address. The app then connects to your provider directly, so your provider sees the viewer's IP address and app.

We use this data only to deliver your service: to let customers sign in, apply your limits, show you who is watching and fix problems. You are responsible for telling your customers how their data is used and for having a legal basis to share it with us.

The players and apps

The web player, the Android TV and phone apps and the Windows app contain no advertising, analytics or tracking tools. To work, they send us:

• the customer's sign-in, and a signal every 15 seconds while something plays, with a random device ID (not a hardware ID), so connection limits and Who's watching work;
• the resolution and frame rate of what plays, so the checker knows which streams work;
• the synced app data described above;
• a crash report with the device model and operating system when the app crashes, and logs when you or your customer ask for them;
• a check for new versions.

The web player keeps a customer signed in by saving their login in the browser on that device. It loads a film's trailer from YouTube, in its privacy-enhanced (no-cookie) mode, when the customer opens one.

Self-hosted M3UTool

The self-hosted edition keeps your playlists, customers and their data on your own server; we don't receive them. It contacts us to:

• check your licence once a day with your gateway key (we log the IP address it comes from);
• check for and download updates and the list of TV guide sources (these requests show us your server's IP address);
• keep your account in step with your M3UTool account, and pass on Discord notifications if you turned them on;
• fetch a provider's list for you when that provider refuses your server; the provider address, including its login, is sent to us for that request;
• move your account to or from M3UTool when you ask.

You are responsible for the security of your server and the customer data on it.

Who else receives data

We use these services to run M3UTool. Each receives only what it needs for its job.

Cloudflare, PayPal, Discord and Google may process data in the United States. Data sent to them is protected under the EU-US Data Privacy Framework where the company takes part in it, and otherwise under the EU standard contractual clauses in their data protection terms.

Besides our main server we run a second server ourselves. It holds a live standby copy of the database, so M3UTool can be restored quickly, and the encrypted backups. It is reached only through a private, encrypted connection.

We also look up public information: film and series details from TMDB, sports fixtures from ESPN and TheSportsDB, and TV guides and channel logos from public sources. These requests contain channel and programme names, never personal data.

Cookies and browser storage

• dontvsess keeps you signed in to the editor. It lasts until you close the browser, or 30 days with "Keep me signed in" (renewed while you use M3UTool); a session you have not used for 24 hours ends on our server. It is only sent to dontv.shop sites.
• Browser storage remembers your settings in the editor (theme, layout, last playlist), that you closed the cookie notice on dontv.shop, the customer's login and preferences in the web player, and a sign-in token on the player site for 180 days.

We use no advertising or tracking cookies.

How long we keep data

How we protect it

• All connections use HTTPS. Account passwords, parental PINs and recovery codes are stored only as hashes; API keys as a hash and, for newer keys, encrypted; authenticator secrets encrypted.
• You can turn on two-step sign-in with an authenticator app for your account.
• Our admin area can only be opened with a hardware security key.
• When our staff open your account to help you, it is recorded in our activity log.
• Our second server is reached only through a private, encrypted connection. The backups kept there are encrypted.

Your rights

You can ask us to show, correct, export or delete your personal data, to limit how we use it, or object to how we use it. Where you gave your consent (the Discord link), you can withdraw it at any time; this does not affect what happened before. Email [email protected] from your account's email address and we answer within 30 days.

To close your account, email us. We delete the account with its playlists, customers, their watch history and app data, API keys and their log, playlist backups, brand files and app logs. Support tickets stay as your support history until you ask us to delete them, payment records stay as long as tax law requires, the free trial record stays with only the Discord fingerprint, the live standby copy follows straight away, and database backups age out within 12 months.

You can also complain to your data protection authority.

Children

M3UTool and M3UTool Player accounts are for adults (18 and over). Kids profiles in the apps are set up by the account holder and store only a profile name and its settings.

Changes and contact

We update this page when M3UTool changes and put the date at the top. For important changes we also tell you by email or in the editor.

Questions about privacy: [email protected].