Privacy Policy — Nova Fast IPTV

• Your IPTV source credentials (server address, username, password, M3U and EPG links). On Android TV they are protected by the Android Keystore; on LG webOS they are encrypted locally (AES-256-GCM). They are only sent to the IPTV server you chose, and in the Nova Plus online backup described in section 4.
• Search history: kept on the device, per profile, never sent or backed up. You can clear it from the search screen.
• Profiles and parental control: names, avatars, PIN (stored as a hash, never in clear), locked categories.
• Favorites, playback positions and settings (theme, language, subtitles, audio…).
• TMDB API key (LG webOS only, if you enter one): used to query TMDB directly from the TV.
• Google TV "Continue watching" (Android TV): the app adds titles in progress to the system home screen row. This information stays on the device.

On Android TV, Android's automatic backup is turned off: this data is not included in any system backup. Uninstalling the app deletes it.

When you activate Nova Plus (with a key or a QR code) and during its regular checks, the app sends our servers:

• A device identifier: on LG webOS, a random identifier created on first launch; on Android TV, an identifier derived from the app-specific Android ID on that device. It is used to count the devices on the license.
• A device label (for example the box maker and model), so you can recognize your devices.
• The license key.

For QR code activation, the TV creates a temporary code that you confirm on your phone with your key.

• On novafast.tv: payment is processed by Stripe. We receive your email address (to send your key and sign you in to the customer area) and the payment status, never your card number.
• In the Google Play version (Android TV): payment is processed by Google Play. The app sends our servers the purchased product, the purchase token provided by Google and the device identifier. Our servers verify the purchase with Google and create the license. We receive neither your email address nor your payment details. The subscription is managed in Google Play.

These transfers start automatically as soon as a Nova Plus license is active.

• Resume across devices: at each playback progress of an Xtream source, the app sends a non-reversible fingerprint (salted SHA-256) of the server address and username, never the password, to recognize "the same account" across your devices, along with the content identifier provided by your server, season and episode, position, duration and "watched" state. The license key comes with these transfers; when positions are read, it is part of the request address and may therefore appear in our host's technical logs.
• Online backup (Android TV): once a day and a few minutes after a change, the app sends a backup of your sources (including credentials and passwords), profiles, positions and settings. It is encrypted on the device (AES-256-GCM) with a key derived from your license key before upload. Since our servers know the license key, this is not end-to-end encryption. We keep the last 5 backups of each license.

Like any web service, our servers and their hosts see the device's IP address and the time of each request.

• Rich details (TMDB), Nova Plus, Android TV: the cleaned titles and year of the movies and series in your catalog, and the language, go through our relay to TMDB. Posters and backdrops are then loaded directly from TMDB's image servers, which therefore see the device's IP address.
• Online subtitles, Nova Plus, Android TV: on request, or automatically if you turn on automatic search, the app sends our relay the content type, its TMDB identifier, season and episode, and the wanted languages. The relay queries OpenSubtitles.com. No data identifying you is sent to OpenSubtitles.
• Rows by platform (Android TV): once a day, the app downloads the list of titles available on streaming platforms for the region chosen in settings. Only the region is sent.
• Sending a source from your phone: what you enter on novafast.tv/pair-source is kept by our servers until the TV picks it up, and 10 minutes at most, then deleted.
• Updates (Android TV): the Google Play version is updated by Google Play; the version installed outside Play checks novafast.tv once a day for a new version, without sending any identifier.

The search microphone button uses the system speech recognition service (usually Google's). Microphone permission is only requested on first use. The app only receives the recognized text, keeps no audio and sends that text to no Nova server. The recognition service applies its own privacy policy.

• IONOS: hosting of the novafast.tv website and license services. Data hosted in Europe.
• Lovable Cloud: backend, database and authentication. Data encrypted in transit (TLS) and at rest.
• Stripe: payments on novafast.tv.
• Google Play: payments and updates of the Google Play version.
• notify.novafast.tv: transactional emails (license key, sign-in link).
• TMDB and OpenSubtitles.com: metadata and subtitles, as described in section 5.

• We sell no data and show no ads.
• The app contains no audience measurement, tracking or crash reporting tool.
• We provide no content, channel or IPTV service: the app is a player that connects to the source you configure, under your responsibility.
• We collect no location data.

• Delete device data: uninstall the app or remove your sources and profiles in settings.
• Remove a device from your license: from the app's Nova Plus screen or from your customer area on novafast.tv. It goes back to the free version.
• Request deletion of your license data (email, key, devices, synced positions, online backups) by writing to contact@novafast.tv. Billing records are kept for the period required by law.

The app offers kids profiles with parental control (PIN, locked categories), set up by the household's adult. We do not knowingly collect data from children beyond these settings.

For any question about this policy or your data: contact@novafast.tv.