LEGAL
Privacy Policy
Last updated: 29 September 2026
This policy explains what personal data is processed when you use zeloplayer.com and the Zelo Media Player app. The data controller is Zelo TV Player (operated by Mehmet Polat, [email protected]).
1. Data we process
- Device data: the device number (Device ID) shown by the app, the access key given to the device (stored only encrypted and hashed), registration and last connection time, and free trial start and end time.
- Playlist data: the M3U link or Xtream server address, username and password you enter on the activation page. This is stored encrypted and deleted once your device collects it, or within 30 minutes at the latest. The history keeps only when a code was created and used, not the playlist data.
- Purchase data: your email address, country, amount paid, transaction number and the device number the license is assigned to. We never see your card or payment details; Polar processes them.
- Contact data: the email address registered to your license and messages you send us for support.
- Technical data: your IP address, processed to prevent abuse and automated attacks (rate limits, security checks); it may be kept briefly in server logs.
2. Why we process it
- To provide and verify your license and track its period.
- To deliver your playlist to your device and make activation codes work.
- To send a one-time code to your license email to verify your device when you reinstall the app.
- To answer support requests and process refunds.
- To prevent fraud and abuse and keep the service secure.
- To meet legal obligations such as accounting and tax.
3. Who we share it with
We do not sell your data or use it for advertising. We share it only with the following service providers, and only as needed to provide the service:
- Polar (Polar Software, Inc.): taking payments, tax, invoicing and refunds (Merchant of Record).
- Cloudflare: the website's network infrastructure and security checks on forms (Turnstile).
- Resend: sending verification code emails.
- Telegram: internal sales notifications that only we can see (may include email address and device number).
4. Cookies
We do not use tracking, analytics or advertising cookies. Cloudflare Turnstile may use cookies it needs to work during form security checks. Payment is made on Polar's own page (polar.sh), where Polar's privacy policy and cookies apply. The admin panel uses a session cookie for administrators only.
5. Retention
- Playlist data: until your device collects it, at most 30 minutes.
- Device verification codes: valid for 10 minutes, stored only hashed.
- Device registration and trial data: until the device registration is deleted.
- Purchase and license records: as long as required for accounting and legal obligations.
6. Security
All connections are encrypted with HTTPS. Playlist data and device access keys are stored encrypted with AES-256-GCM; access keys and verification codes are additionally verified only as hashes.
7. Your rights
You have the right to access your data, ask for it to be corrected or deleted, and object to its processing (under KVKK and, where applicable, GDPR). Email [email protected] with your request. You also have the right to complain to the relevant data protection authority.
8. Changes
We may update this policy. The current version is always published on this page.