Privacy Policy

Last updated: October 10, 2026

oediv ("we", "our", or "the app") is a self-hosted video streaming application for Android TV. This Privacy Policy explains how we handle information when you use our application.

1. Information We Collect

oediv collects minimal information necessary to provide the streaming service:

Device Information: A unique device identifier, device name, and device model are collected when you register your device with the server. This is used to authenticate your device and manage access.
Watch Progress: Your video playback position is saved so you can resume watching where you left off.
View Logs: We record which videos are watched and for how long, for usage analytics visible only to the server administrator.

2. Information We Do NOT Collect

We do not collect personal information such as names, email addresses, or phone numbers.
We do not collect location data. (If you accept analytics cookies on the website, Google Analytics derives an approximate country and city from your IP address; see section 8.)
We do not use advertising SDKs or tracking services, and the TV app contains no analytics. The website uses Google Analytics only if you accept analytics cookies (section 8).
We do not share any data with third parties, except Google when you accept analytics cookies on the website (section 8).

3. Data Storage

All data is stored on the self-hosted server configured by the server administrator. Video content is encrypted at rest using AES-256-CBC encryption. Device tokens and sensitive data on the TV device are stored using Android's EncryptedSharedPreferences, and the local database is encrypted with SQLCipher.

4. Data Security

We take data security seriously:

All communication between the app and server uses HTTPS encryption.
Video files are encrypted at rest on the server.
Stream tokens are time-limited (4-hour TTL) and scoped to specific devices and videos.
Category access can be protected with PIN codes.
Local data on the device is encrypted.

5. Data Retention

Device registration data and watch progress are retained on the server as long as the device is active. The server administrator can remove device data and associated records at any time through the admin panel.

6. Children's Privacy

oediv does not knowingly collect personal information from children under 13. The app does not require any personal information to operate. Content access can be restricted by the server administrator using PIN-protected categories.

7. Your Rights

Since oediv is a self-hosted application, the server administrator has full control over all data. You may contact the server administrator to:

Request deletion of your device data
Request information about what data is stored
Request export of your data

8. Cookies and Google Analytics (website)

The website uses these strictly necessary cookies and browser storage:

Session cookie (oediv-session): keeps you signed in; expires after 120 minutes of inactivity.
XSRF-TOKEN: protects forms against cross-site request forgery; expires with the session.
Remember-me cookie (remember_web_…; only if you tick “Remember me” when signing in): keeps you signed in on that browser for up to 400 days, or until you sign out.
Your cookie choice (zx_consent in the browser's local storage): your accept or reject and its date; you are asked again after 6 months.

The only optional tool is Google Analytics 4, provided by Google Ireland Limited (for visitors in the EEA and Switzerland) and Google LLC (USA). It runs only on the website's public pages (home, this policy, the terms, and the sign-in, registration and password-reminder pages), and only if you choose “Accept all”, or turn on Analytics under “Preferences”, in the cookie banner; until then no request is sent to Google and no analytics cookie is set. It never runs on your account pages, the upgrade page, the admin panel or in the Android TV app. It measures the pages you visit (with the query string and IDs removed from the address), page titles, the page you came from, when and how long you visit, interactions such as scrolling and outbound link clicks, your browser, device and language, and an approximate location (country, city) derived from your IP address; Google Analytics 4 does not log or store IP addresses. No name, e-mail address, account or user ID is sent to Google, and Google signals and ad personalisation are switched off. It sets the _ga and _ga_<ID> cookies, which stay in your browser for up to 2 years; Google keeps the analytics data for 14 months, then deletes it.

Legal basis: your consent (GDPR Art. 6(1)(a) and ePrivacy Art. 5(3); for visitors in Türkiye, explicit consent under KVKK Art. 5(1)). The data is processed by Google, including on servers in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; for visitors in Türkiye the transfer abroad relies on your explicit consent under KVKK Art. 9(6)(a), given knowing that the USA may not offer the same level of protection as Türkiye and that US authorities may be able to access the data.

You can change your choice or withdraw consent at any time from the “Cookie settings” link at the bottom of the page. Withdrawing stops Google Analytics and deletes the _ga cookies the site can delete. Rejecting does not affect your use of the site.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date.

10. Contact

If you have questions about this Privacy Policy, please contact us at: privacy@oediv.com