Yonto Player
English

Privacy policy

Last updated

The short version

  • The Yonto Player apps have no account, no ads, no analytics and no crash reporting. Your sources, history and settings stay on your device. When you fill in your TV’s form from your phone, what you type passes through our service encrypted, so we can’t read it.
  • If you never buy Pro, we hold nothing about you.
  • If you buy Pro, we keep your email address, your licence and the devices you use it on, so the licence works and you can manage it. Stripe processes the payment for us; we never see your full card number.
  • If you buy Pro in the App Store on an iPhone or iPad, Apple processes the payment. We get Apple’s signed record of the purchase, not your name or email address. If you then add your email to it from the app, we keep that address as for any buyer.
  • You can ask us for a copy of your data, or to delete it, at support@yonto.app.

Who we are

Yonto Player is made and sold by a sole trader in New Zealand, trading as Yonto, who is responsible for your data under this policy. Contact: support@yonto.app.

The apps

What stays on your device. Your sources and their sign-ins, plugins, watch history, playback positions, the PIN lock and your settings are stored only on your device. They are not backed up to us, and we can’t see them. The one time any of it leaves your device is when you send a source, or a repo’s or plugin’s address, from your phone to your TV, below.

What the apps send, and to whom.

  • To the sources you add. Yonto Player talks to the media servers, plugins and repos you add, to browse and play from them. What they receive and keep is up to them and their own privacy policies.
  • To check for updates. Yonto Player asks GitHub which version is newest. The request carries nothing about you beyond what any web request does, such as your IP address.
  • To play the demo library. Its clips are plain files on player.yonto.app, so playing one asks the website for it. The request carries nothing about you beyond what any web request does, such as your IP address.
  • To the licence service, only if you use Pro. Turning Pro on sends your licence key (or a code shown on your TV), a device identifier, the kind of device (Android TV, Android or iPhone) and its name (its maker and model). The device identifier is a one-way hash, made for this use only, of an identifier for your device: on Android its system identifier, on iPhone one Yonto Player creates and keeps on it. It keeps the licence tied to that device. About once a month the app sends its licence back to be renewed, which is how a refund or a removed device takes effect. On an iPhone or iPad, buying Pro or choosing Restore purchases also sends the App Store’s signed record of the purchase, which the licence service checks against Apple’s signature. Adding your email to Pro from the App Store sends that address and this device’s licence token, and the licence service emails the address a link to finish. Apart from setting up from your phone, below, a free app sends nothing to the licence service.
  • To the licence service, when you set up your TV from your phone. Set up from your phone, on the TV, sends the form the TV is showing (the kinds of source it takes and the fields of its plugins) and shows a QR code. The page your phone opens from it, on tv.yonto.app, sends back what you type, which can include a server’s address, username and password. Both are encrypted end to end with a key that is only in the QR code, which your browser never sends to us, so the licence service holds them without being able to read them. It keeps them only until your TV collects the answer, or the code’s ten minutes end; either way they are deleted within a minute of the ten minutes ending. An encrypted copy can stay in the server’s own disk snapshots for up to seven days, as unreadable to us as the original. None of it is linked to your licence or account, and the page sets no cookies. Like any web request, these carry your IP address, which the service counts for a minute to limit how often it is asked, and does not otherwise keep.

player.yonto.app

The website is a static site. It sets no cookies and runs no analytics. If you pick a theme, your browser remembers it on your device. Amazon Web Services hosts the site and, like any host, sees the requests it serves, including your IP address. Downloads and the feedback buttons go to GitHub, where an issue you file is public.

The account site and the licence service

When you buy Pro, sign in at account.yonto.app, or turn Pro on in the app, we keep:

  • Your email address, and the language you use the site in.
  • Your licence: its status and what it includes. We store only a hash of your key, never the key itself, which is why a lost key is reissued rather than resent.
  • Your devices: the hashed identifier, the kind of device and its name, and when it was first and last seen. Each also has a random secret behind the unlock code that gets you past a forgotten Master PIN; the device keeps a copy to check the code, and drops it when the device is removed or the licence revoked.
  • An App Store purchase, if you bought Pro there: its original transaction id and product, which is how a restore on another device finds the same licence. Apple doesn’t tell us who bought it, so that licence has no email address until you add one from the app, and no key until you then issue one on your account page. Once you add an email, we keep it, and the account it belongs to, as for any buyer. Apple also tells us when it refunds the purchase, and we keep that notice.
  • Your orders: Stripe’s payment id, the plan, the amount and currency, any discount code, and whether it was refunded. We also keep the order messages Stripe sends us about your purchase, which include the name, email address and billing address you gave at the checkout, and your card’s brand, country, last four digits and expiry date.
  • A security log of what happened to your account and licence (for example, a device added, a sign-in, or a licence revoked and the reason we gave), with the IP address it was done from.
  • Your session: while you use the account site, the IP address and browser you use it from.
  • Notes our support writes when helping you.

Cookies. The account site uses only the cookies it needs to work: a session cookie while you’re signed in, one that remembers your language when you choose one or follow a link from this site, one that links a checkout to your browser for two hours, and one that protects forms. The checkout is Stripe’s: the page sends you to Stripe, which sets its own cookies under Stripe’s privacy policy.

Emails. We email you your licence key, sign-in links you ask for, the link that confirms an address you add to a licence from the App Store, a notice when a new device is added to your licence, a notice when your email address is changed, and, if we revoke your licence, a notice saying why, unless the law stops us. We send no marketing.

Why we use it

  • To provide what you bought: issuing, activating and renewing your licence, and letting you manage it.
  • To keep it safe: stopping fraud and abuse, such as a key shared widely, and investigating problems.
  • To meet our legal obligations, such as keeping records for tax.

In the terms of the EU and UK GDPR, the bases are the contract with you, our legitimate interest in security, and legal obligation.

Who else handles it

  • Stripe, which processes the payment for us. For the card and the other payment details you give it, Stripe is responsible for your data under its own privacy policy.
  • Apple, which processes a purchase in the App Store. For that payment and your Apple Account, Apple is responsible for your data under its own privacy policy.
  • Amazon Web Services, which hosts our server and the website and delivers our emails, and processes data only on our instructions.
  • GitHub, for downloads and feedback, as above.

We don’t sell your data or share it with anyone else, unless the law requires it. These companies may process data outside your country, including in the United States and the European Union.

How long we keep it

  • Your email address, licence and devices, and an App Store purchase’s transaction id and product: for as long as your licence exists, until you ask us to delete them.
  • Orders, and the order messages from Stripe: for 7 years after the end of the New Zealand tax year you bought in (it ends on 31 March), as New Zealand tax law requires.
  • The security log: its entries are kept, and their IP addresses are erased after 12 months.
  • Support notes: for as long as your account exists; they are deleted with it.
  • Sign-in links and TV codes: they expire within minutes, and are deleted a day later.
  • What you send from your phone to your TV: until your TV collects it, and never longer than a minute past the code’s ten minutes, apart from an encrypted copy in the server’s disk snapshots, kept up to seven days.

Your rights

You can ask us to:

  • tell you what we hold about you and give you a copy,
  • correct it,
  • delete it, which deletes your account, licence and devices and turns Pro off.

Deleting doesn’t remove everything. Your orders stay as long as tax law requires, and so do Stripe’s order messages about them. The security log keeps its entries: they no longer point to your account, but they keep their IP addresses until those are erased at 12 months, and they keep anything written in them, such as the reason a licence was revoked.

Write to support@yonto.app from the address on your licence. A licence from the App Store has no email address until you add one, so if you haven’t, write with the order ID from Apple’s receipt instead. We answer within 20 working days.

If you’re unhappy with how we handled your data, you can complain to the Office of the Privacy Commissioner in New Zealand, or to the data protection authority where you live.

Security

We store licence keys and sign-in links only as hashes, and restrict our admin tools to our own network with two-factor sign-in. No system is perfectly secure, and if a breach puts you at risk we will tell you.

Children

Yonto Player is not directed at children, and we don’t knowingly hold data about anyone under 16.

Changes

If we change this policy, the date at the top changes. If the change is significant, we will email the people it affects.