Privacy, with clarity.
How HoiPlayer handles device records, approximate connection country, owner-approved partner access, partner accounts and support conversations.
Updated 30 October 2026This website
This notice covers the HoiPlayer website, device connection, related operational records, owner-approved recovery, partner accounts, delegated playlist management and support conversations. Use the app device code and a valid Device Key, existing owner session or saved recovery code to access the relevant owner functions. The public device code is a derived identifier, not a network-interface MAC or a password. There is no payment form. App playback and metadata flows are a separate scope.
Preferences on your device
Your language choice is kept in local browser storage. Acknowledgement of the usage notice is kept separately in session storage for the current tab visit, so moving between pages does not ask again. These preferences are not sent to an analytics service. You can remove saved language data using your browser settings.
Device connection and saved sources
Device Keys expire after 10 minutes and can be used once. A link opened from the app contains a separate single-use handoff token, valid for 10 minutes; the browser removes it from the address before exchanging it. Playlist names, source URLs, optional EPG and source credentials are stored encrypted on our server. The encryption key is held on the server outside the public website. The browser holds retrieved source details in memory, not in local storage. Signing out clears the displayed details; removing a playlist removes its saved entry. Do not enter sources you are not authorised to use.
Operational device records
To operate and support connections, authorised administrators can view your public PL device code, registration time, latest authenticated app contact, app-reported system, version and build, saved-list count, active-list indicator and available list creation, update and save times. These records help diagnose connection and version issues and produce service activity totals. Earlier values may be unknown. System and version are self-reported; recent contact does not prove that a device is still online or that anyone watched content. This monitor does not collect viewed titles or viewing history, or display full source URLs, source credentials, Device Keys or recovery codes. Approximate country is handled separately below.
Approximate connection country
After an authenticated app contact, the service may use the connection IP address with a locally stored DB-IP country database to derive a country code. It retains the latest country code, observation time and lookup-source label with the device record. This lookup sends no customer IP address to an external geolocation service and adds no raw IP address to the country record. It uses no GPS, city or coordinates. A country may reflect a VPN, proxy or network exit rather than your physical location or residence; it may be inaccurate or unknown. Administrators, and a partner you have authorised for that device, can see this approximate country. A newer unknown lookup replaces the earlier value. Separate hosting logs and abuse protection can still process IP information as described elsewhere.
Partner accounts and verification email
Partner registration stores the name and email address supplied, a password hash, account status, registration and verification times, and the accepted terms version and time. Optional profile and store contact details are stored when entered. Single-use email-verification links expire 30 minutes after the request; password-reset links expire after 15 minutes. The service keeps keyed token hashes for validation. To send these links, it temporarily stores the recipient address, readable token, language and related account reference in an encrypted private mail queue. This is server-side encryption, with the key held outside the public website. The configured email provider processes recipient and message data for transmission. A password-reset request does not confirm whether an account exists; email delivery is not guaranteed. To complete verification, the holder of the email link chooses and confirms a fresh account password. This replaces the pending registration password before activation. At that step, the link holder must also expressly accept the current partner terms. The activated account records that terms version and acceptance time in place of the pending declaration. Verification confirms access to that mailbox, not a partner's identity or trustworthiness. It activates the account without signing in. Partners then use their password; partner login currently has no second authentication factor. Administrator authentication is separate.
A partner you authorise
A public PL code alone does not authorise partner access. After authenticating as device owner, you can explicitly approve an invitation for one partner at a time. That partner can add, edit, select and remove playlists for that device, view list names, types and source server addresses (protocol, host and port), and see its operational device metadata including approximate connection country. Existing full saved URLs and source passwords are not returned in the partner list view; details entered to add or replace a source are processed for that operation. The partner can store device notes and export a scoped customer overview. A confirmed bulk source-server change can update matching lists of their currently linked customers. You can revoke access or explicitly transfer the device to another partner in the owner portal. This ends the former partner's future service access without deleting saved playlists; it cannot recall data they already exported or remove independent records they hold. Invitations expire after 10 minutes. Verification of a partner's email does not replace your device-specific approval.
Partner support conversations
When a partner opens a support ticket, the service stores its subject, category, messages, author role and identifier, status and timestamps. The subject and message bodies are encrypted on the server with a key held outside the public website; identifiers, category, status and routing/time metadata remain in the private database. The partner can read their own conversations and authorised administrators can read and answer them. This is server-side encryption, not end-to-end encryption. Closing a ticket preserves its conversation. Do not include account passwords, Device Keys, recovery codes or complete private playlist links in messages.
Sessions and abuse protection
The service uses a secure HttpOnly SameSite session cookie, a CSRF token and server-verified security challenges. Sessions expire; renewing the Device Key in the app can revoke existing browser sessions. Completing a partner password reset invalidates earlier partner sign-in sessions and unused reset links for that account, while keeping connected customers and saved playlists. IP and device request information may be processed to limit abusive attempts and operate the service. The language preference and visit acknowledgement remain separate from device authentication.
Device recovery
A replacement installation keeps its own random private credential. Recovery stores credential hashes, an ownership snapshot and two independent temporary token hashes; the QR never contains the app credential. Requests expire after 10 minutes and need explicit approval by an authenticated owner, or separately verified support approval for legacy devices. Approval preserves saved playlists and revokes old app credentials, Device Keys, handoff links, browser sessions and earlier backup recovery codes.
Your backup recovery code
An authenticated owner can explicitly create or replace a random 128-bit backup recovery code. The readable code is shown only in that response; keep it somewhere private. Our server stores a purpose-bound keyed hash, not the readable code. A successful recovery-code login consumes it; replacing it or completing device recovery also invalidates the old code. Create a replacement after restoring access. The website does not save the readable code in browser storage.
Retention and removal
Expired request records are deleted during later service requests once they are more than 24 hours past expiry; cleanup is not a timed background job. A used recovery-code hash remains until replaced or the device record is removed. Removing a playlist removes its active saved entry. Protected support-approval files and migration backups can retain earlier records until an authorised operator removes them; no automatic backup-deletion period is configured. Contact support@hoiplayer.com about device records or backups. Operational device records keep the latest contact, reported system/version/build, country observation and latest save time until the device record is removed; there is no history of every contact or scheduled observation expiry. List times remain with the saved entry. The source-policy audit retains up to 100 recent changes. No automatic deletion period is configured for partner accounts, profiles or support conversations, including closed tickets; expiry of a verification link does not delete a pending account. Revocation or transfer removes the prior partner assignment and its device note, not playlists or earlier audit/ticket records. Partner audit rows older than 30 days are removed when a later partner audit is written. Expired partner invitations become eligible for cleanup more than 24 hours after expiry during later invitation creation. Temporary bulk plans and encrypted rollback snapshots are cleaned during later bulk previews: expired pending plans or jobs more than 48 hours old are removed. The rollback window is 24 hours after application and may end earlier if scope or source data changes. These are request-triggered cleanups, not timed deletion guarantees. A mail job’s encrypted payload is cleared after a successful send, terminal failure or discard. When a new mail job is queued or the private mail worker runs, expired pending jobs are discarded, mail-queue rows more than 48 hours old are removed, and password-reset records more than 24 hours past expiry are removed. These cleanups depend on those operations running; they do not guarantee deletion at an exact time. Downloaded exports and email-provider records follow the recipient's or provider's own handling. Contact support@hoiplayer.com about access, correction or removal; no self-service account-deletion feature is promised.
Technical website requests
Your browser requests pages, fonts and images from our hosting service. The hosting provider may process technical request information, such as an IP address and access logs, to deliver and operate the website. This site does not load advertising trackers or analytics scripts.
When you email us
Contact links open your own email application. If you send a message, our support mailbox receives the information and attachments you choose to include. Share the details needed for the question; avoid credentials and complete private playlist links.
Questions about your information
For questions about information you have sent to HoiPlayer, contact support@hoiplayer.com. Tell us which interaction your question concerns so we can identify the relevant correspondence. Do not include account passwords.