Privacy Policy

Last updated: October 8, 2026

This policy explains what data Kyema (the apps for TVs, computers, phones and tablets, and the website kyema.app, where devices are set up and licences are managed) collects, why, how long it is kept, who it is shared with, and how you can have it deleted. The full terms of use, in Spanish, are at kyema.app/legal.html, and its privacy section says the same as this page.

1. Who is responsible

The service and the processing of your data are run by Kyema. For anything about privacy, including requests to access or delete your data, write to privacy@kyema.app.

2. What Kyema is

Kyema is a media player. It comes empty: no channels, films or lists. You add your own sources, and the website stores that configuration so each of your devices can load it.

3. Data we collect

From each device, when the app starts

• A device identifier (the one the device provides; on a computer, a hash of its machine identifier, never the raw value; or one the app generates), its MAC address if it has one, and the device number and key the server assigns to it.
• Model, firmware version and app version.
• Date of registration, date of last contact and number of starts.
• Licence status and, if any, an administrative note.

What you set up on the website

• Name, type, server, username, password, token and PIN of each source you add.
• Addresses of your addons and catalogs, your TMDB key and your chosen languages.
• Optional PINs that protect each source on the website (stored so they can be compared, not shown).
• Optional profiles: name, colour, PIN and which sources each profile can see.

If you create an account

• Your email address and password. The password is stored with a key derivation function (scrypt) and its own salt; it cannot be read or recovered, only replaced. We do not ask for your name or phone number.
• The language you signed up in, so we can write to you in it, and whether you bought the household pack.
• If sync is on (it is by default and can be turned off in the device settings): your favourites, what you have watched, where you stopped in each title, recently opened items and the last channel, so your devices stay in step. This is stored encrypted, identified only by title or channel, never analysed or shared, and deleted with the account.
• If you create a help code so someone else can set up your account for a while: that person sees and changes your IPTV accounts, add-ons, catalogues, profiles and tracking, and sees your email only as its first letter and domain. They never see or change your password, purchases, licences or devices. We email you each time someone signs in with your code and keep a note of it (the time and the network it came from, never the full IP address) for 90 days. You can remove the access at any time and it ends at once.

If you sign in with Google or Apple

Instead of a password you can sign in with Google or with Apple. In that case we request only your email address and the account identifier that Google or Apple gives us (Google scopes: openid and email). We use them for one thing: to recognise you the next time you sign in, and to write to you about your account (verification, password and purchase receipts). We do not request your name, contacts, files or any other data from your Google or Apple account, we do not store any Google or Apple password or access token, and we never share, sell or use this data for advertising.

Kyema's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Purchases

• If you buy a licence, the date you accepted the terms and asked for immediate activation, with the version and language of the text you accepted. We do not store your IP address.
• The payment itself is handled by Stripe, or by Google Play or the App Store inside those apps. We never receive your card or bank details.

Optional: Simkl or Trakt

Off by default. If you connect a Simkl or Trakt account, the app tells that service what you are watching (title and position) and fetches your watch history from it. This goes from the device to the service directly. Our server only stores the access token the service grants you (not your password) and deletes it when you disconnect. It does not store your history.

Error reports

When the app fails (an unexpected error, a crash or a hang) it sends a technical report to Sentry: the error and where it happened, the device model, the system and app versions, the language, the screen you were on and an anonymous device id (a hash, not the device number). It never includes your email, user names, passwords, the addresses of your accounts or streams, or what you watch. It is used only to find and fix bugs, and can be switched off in the device's settings (Send error reports).

Sharing a title

When you share a title from Explore, the app sends the server only that title's public data (name, year, poster and synopsis) to make the short link; nothing about you or your device. It is kept for a year.

Resellers

If you register as a reseller: your name or business name, email and reseller key, and the history of devices you activate and credits you buy. If a reseller activates your device, we store which reseller did it and when.

4. How we use it, and on what basis

Only to provide the service: to know the licence status of each device, deliver its configuration when it starts, keep your devices in sync and handle your account and purchases. The legal basis is the performance of the contract you accept by using it. We do not use your data for advertising, we do not build profiles and we do not sell or share it with third parties.

5. Who processes it for us

• OVHcloud (OVH SAS, Roubaix, France) hosts the server in a data centre in Germany, inside the European Union. It does not access the data.
• Brevo (Sendinblue SAS, Paris, France) delivers the emails we send you, so it sees your address and the content of each email.
• Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland) processes payments made on the website.
• Sentry (Functional Software, Inc., San Francisco, USA) receives the apps' error reports and stores them in its European Union region. Should they ever be accessed from the United States, the transfer is covered by the European Commission's Standard Contractual Clauses and the EU-US Data Privacy Framework.

Addons you add are third-party services: when the app asks one about a title, that third party receives the request and your IP address. It does not go through our server. The app comes with two addons from Stremio (OpenSubtitles and Cinemeta) that you can remove from the website.

6. Security

All traffic between the apps, the website and the server is encrypted (HTTPS). Source credentials, Simkl or Trakt tokens and TMDB keys are stored encrypted (AES-256) with a key kept outside the data file. The administration panel does not show your source passwords.

7. How long we keep it

As long as your device or account exists. Deleting a device removes it with its sources and addons at once. A device that ended its trial, was never activated, is not linked to an account and has not started for six months is cleaned up automatically: only its identifier, number and dates are kept, so it cannot start a second trial. Backups are overwritten as they rotate.

8. Deleting your data

• You can delete your account yourself on the website, at any time. That deletes your email, your Google or Apple link, your synced data and your profiles.
• To delete a device and everything set up on it, or any other data, write to privacy@kyema.app.
• If you signed in with Google you can also remove Kyema's access at myaccount.google.com/permissions.

9. Your rights

You can ask for access, rectification, erasure, restriction, objection and portability of your data by writing to privacy@kyema.app. You can also complain to the data protection authority of your country; in Spain that is the Agencia Española de Protección de Datos.

10. Children

Accounts are meant for adults. Children can use a device through a Kids profile set up by an adult; we do not knowingly collect data from children.

11. Changes

If this policy changes, the date at the top changes too, and important changes are announced on the website.