1. Who the controller is
The data controller is the party responsible for AshyTV. Data protection officer contact: contato@ashytv.com.
When you activate a TV with a Partner Code, the partner serving you also processes your data (for example, your login to their service) as an independent controller, under their own policy.
2. Data we collect
- Account: e-mail, password (stored only as an Argon2id hash, never in plain text) and preferred language.
- List settings: the server or M3U list address and, when applicable, the Xtream username and password. The Xtream password is encrypted (AES-256-GCM), is never shown back and never appears in logs.
- TVs: platform, model and app version, reported by the TV itself; the name you give the TV; installation and device identifiers, stored only as hashes; and the TV's access token, also stored only as a hash.
- Security and audit: date, time and IP address of sign-ins and important changes, to prevent fraud and licence misuse.
3. What we don't collect
- What you watch: video goes straight from the source to the TV and never passes through our servers. Favorites, history and progress are stored only on the TV.
- This website uses no cookies, no ads, no analytics and no third-party trackers, and loads no external fonts or scripts.
- The panel uses only one strictly necessary session cookie to keep you signed in.
4. Why we use it and legal basis
- Providing the Service (creating the account, activating TVs, delivering settings): performance of a contract (LGPD art. 7, V).
- Security, fraud prevention and licence control (detecting cloned activations, audit): legitimate interest (art. 7, IX).
- Complying with legal obligations and authorities' requests: art. 7, II.
We do not sell personal data and do not use it for advertising.
5. Who we share it with
- Your partner, if you use a Partner Code: they see the TVs and users linked to their code, with masked identifiers, so they can support you.
- Infrastructure providers (cloud hosting) that process data on our behalf under contract. Servers may be located outside Brazil; in that case we adopt the safeguards required by the LGPD.
- TMDB (The Movie Database), for cast and photos: the panel queries TMDB by the title name, without identifying you; photos load straight from TMDB's servers, which receive the TV's IP address.
- Secure DNS provider (optional, on Android TV and Linux): when enabled, the app's DNS lookups go encrypted (DNS-over-HTTPS) to the chosen provider.
- Authorities, when required by law or court order.
6. How long we keep it
We keep data while your account is active. When you delete your account or unlink a TV, the related data is deleted or anonymized, except records we must keep by law (for example, application access logs for 6 months under Brazil's Marco Civil da Internet) or for the defense of legal claims.
7. How we protect it
Connections always over HTTPS; passwords with strong hashing; encrypted Xtream passwords; TV identifiers and tokens only as hashes; role-based access (each partner sees only its own data); and an audit log of sensitive actions.
8. Your rights (LGPD)
You may request at any time: confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary data; portability; information about sharing; and withdrawal of consent, where applicable. You can also delete your account and unlink TVs in the panel itself. To exercise your rights, write to contato@ashytv.com. You may also contact Brazil's National Data Protection Authority (ANPD).
9. Children and teenagers
Panel accounts are intended for people aged 18 or over. The app offers parental controls (hiding adult content and a PIN) to protect the younger members of the household.
10. Changes to this Policy
We may update this Policy. The date at the top shows the version in force; relevant changes will be announced on the website or in the panel.