StreamX ("the app", "we", "us") is a media player for Android TV. It plays the playlists and streams that you provide; it does not host, supply, or index any media content. This policy explains what data the app handles and why. By using StreamX you agree to this policy.
StreamX is fully usable without signing in. In this mode, everything you add — your playlists, source logins, watch history and settings — is stored only on your device and is never sent to us. You can use the app entirely offline of our services.
Signing in with an email and password is optional and exists only to sync your library across your own devices. If you choose to create an account, we process the following through Google Firebase:
| Data | Purpose |
|---|---|
| Email address (and password, handled securely by Firebase Authentication) | To create your account and sign you in |
| Your playlists / source configurations (server URLs, usernames, passwords, MAC addresses, portal URLs that you enter) | To restore your sources on your other devices and after a reinstall |
| Watch history (titles watched, playback position, timestamps) | To power "Continue Watching" and resume across your devices |
| App settings (display, tabs, appearance, remote-button choices, viewing profiles with their favourites and Watch Later, parental-controls PIN, subtitle-service logins, followed teams) | To keep your preferences consistent across devices |
| Device information: device model, brand, Android version, app version, language, time zone, and your public IP address | To operate the sync service, distinguish your devices, and for basic analytics and abuse prevention |
This data is stored in your private, per-user area of our Google Firebase (Cloud Firestore) project and is protected by security rules so that only your authenticated account can read or write it. We do not sell your data.
The app uses Firebase Crashlytics and Firebase Analytics to record crashes and basic usage so we can fix bugs and improve stability. This may include device state at the time of a crash, a device identifier, and (if you are signed in) your account identifier. It does not include the contents of your streams.
StreamX plays media from sources you add. We do not control, monitor, or store the media content itself. Any third-party servers you connect to (your content provider) are governed by their own privacy policies, not ours. You are responsible for the sources you add and for their legality in your jurisdiction.
Future versions of StreamX may include advertising and an optional in-app purchase to remove ads. If introduced, advertising will be provided by Google AdMob, which may collect advertising identifiers and related data as described in Google's policies, and you will be shown an appropriate consent prompt where required. This policy will be updated before any such features are enabled.
StreamX relies on Google Firebase (Authentication, Cloud Firestore, Crashlytics, Analytics) and, for the public-IP lookup, a public IP-echo service. Your use of these is subject to Google's Privacy Policy.
These only run if you use them. None of them receive your playlists or your source logins. Watch-history trackers (below) receive titles only if you link one yourself.
| Feature | What is sent, and to whom |
|---|---|
| Weather in the top bar | Your approximate location is worked out from your public IP address by ipapi.co (unless you type a city instead), then the coordinates are sent to open-meteo.com to fetch the weather. You can turn the weather off, or choose a city manually, in the profile menu. |
| Sports tab | Requests for public scores and fixtures go to ESPN's public data service. No account information is sent. The tab can be hidden in Display & tabs. |
| Posters, ratings, trending, trailers | The title names you browse may be sent to The Movie Database (TMDB) to look up artwork and details. This product uses the TMDB API but is not endorsed or certified by TMDB. |
| Your own TMDB key (optional) | If you enter your own TMDB API key, it is used for these look-ups instead of the shared access, so the requests count against your TMDB account. It is stored encrypted on your device and in your encrypted settings sync. |
| Watch-history trackers (optional, off until you link one) | If you link Trakt, Simkl or AniList, then when you finish a movie or episode its title (plus season and episode number) is sent to that service so it appears in your own history there. You approve StreamX from your phone with a short code, or paste a code from AniList; your password is never typed into StreamX. The access token is stored encrypted on your device and in your encrypted settings sync. You can pause syncing or unlink at any time in Profile menu → Watch trackers, and nothing is sent while it is paused or unlinked. Each service's own privacy policy applies to the data it receives. |
| Subtitle search | If you search for subtitles, the title and your chosen language are sent to OpenSubtitles, along with the OpenSubtitles login you enter. The login is kept on your device. |
| Secure DNS (optional) | If you switch DNS to Google, Cloudflare or Quad9 in the profile menu, the website names the app looks up are sent to that provider instead of your network's resolver. |
| Android TV "Play next" | Titles you have started (name, poster and position) are shared with your TV's home screen so you can resume them. They are removed when you finish a title or sign out. |
| Jellyfin | If you add a Jellyfin server, the app signs in to your own server with the details you enter. |
The parental-controls PIN is stored as a salted hash.
When you are signed in, your source logins, watch history, settings, PINs and subtitle-service logins, tracker links and TMDB key are encrypted on your device before they are uploaded. A random account key does the encrypting; that key is stored in the cloud only in a form that your account password unlocks. Firebase and our team therefore see only ciphertext for these items. Each TV keeps the key in its own secure storage after you sign in. If you reset your password, previously encrypted cloud data can no longer be opened with the new password and is replaced from the device you sign in on.
New accounts are asked to confirm their e-mail address with a link sent by Firebase Authentication; until it is confirmed, nothing is uploaded to your cloud area. "Forgot password" sends a reset link to your e-mail address.
Local data is removed when you uninstall the app or clear its data. Cloud data is retained while your account exists. Watch-history entries older than 30 days are pruned automatically on the device. To delete your account and all associated cloud data, contact us at the email below and we will remove it.
StreamX is not directed at children under 13, and we do not knowingly collect personal data from them.
We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above.
Questions or data-deletion requests: 5xstreamx@gmail.com
© 2026 StreamX. All rights reserved. StreamX is proprietary software; copying, cloning, redistributing or reverse engineering it is not permitted. Licence