Privacy Policy

1. Who we are

TellyPop is a media player app published by Acefina LLC (“Acefina”, “we”, “us”). It is available for iPhone and iPad on the Apple App Store, and for Android phones, tablets and Android TV / Google TV on Google Play.

Acefina LLC is not affiliated with any TV or content provider. When you add a TV service to TellyPop, that provider handles your information under its own terms and privacy policy.

2. What TellyPop does not do

• There is no account or registration with Acefina.
• There is no advertising in the app.
• The app contains no analytics or tracking tools (SDKs).
• We do not track you across other companies’ apps or websites.
• We do not sell or share your personal data.

3. Information kept on your device

To play your TV service, TellyPop needs the details your provider gave you: the server address, your username and your password. The app also remembers your favourites and recent channels.

This information is stored only on your device, in the operating system’s secure storage — the iOS Keychain on iPhone and iPad, and encrypted storage on Android.

It is not sent to Acefina. Your details are sent only to your own provider’s server, so that the app can sign in and play what you choose. If you use phone-to-TV pairing, your details also pass through our pairing relay, but only in encrypted form that we cannot read (see section 4).

You stay in control

• Turn off Remember me if you don’t want your sign-in saved on the device.
• Use Sign out and forget service to delete the saved sign-in from your device.
• On Android, uninstalling TellyPop also removes the app’s data. On iPhone and iPad, iOS can keep Keychain items after an app is deleted, so use Sign out and forget service before deleting the app if you want your sign-in removed.

4. Pairing your phone with a TV

Pairing is optional. It lets you set up TellyPop on an Android TV or Google TV without typing on the remote. The TV shows a QR code and an 8-digit code, and your phone sends your service details to the TV.

• Your phone encrypts your service details before they leave the phone, using X25519 key agreement, HKDF-SHA-256 and AES-256-GCM encryption.
• The encrypted details travel through Acefina’s pairing relay over HTTPS. The relay only ever sees encrypted data that it cannot read.
• The relay holds a pairing session in memory for no more than 5 minutes, then deletes it.
• The relay keeps no access logs and does not log the contents of requests.
• To prevent abuse, the relay keeps a short-lived counter in memory, keyed by IP address, for about 60 seconds. This limits how many requests can be made in a short time.

5. Camera

TellyPop asks for camera access only to scan the pairing QR code shown on your TV. Camera images are not stored or sent anywhere.

You can type the 8-digit code instead, and you can turn camera access off at any time in your device’s settings.

6. The demo

TellyPop includes a demo that plays publicly available sample test video, so you can try the player before you add a service. The demo video is streamed from Apple’s public developer sample server, which receives your IP address as part of the request, as any web server does. Acefina LLC receives nothing from the demo.

7. Purchases

TellyPop offers full access through a monthly subscription that renews automatically (with a 7-day free trial for eligible new subscribers), or through a one-time lifetime purchase. Both are sold through Apple App Store or Google Play in-app purchase.

• Payments are processed by Apple or Google. Acefina never receives your card details.
• To check that your purchase is valid, the app uses RevenueCat, Inc., a subscription-management service.

RevenueCat receives:

• an anonymous app user ID;
• purchase and transaction identifiers;
• the product and its price;
• your store country;
• basic device and app information, such as the operating system version and app version; and
• your IP address, as part of the request.

You can read RevenueCat’s privacy policy. Apple and Google handle your purchase under their own policies: Apple’s privacy policy and Google’s privacy policy.

8. Who receives information

• Your TV provider receives your sign-in details and the requests needed to play what you choose, because you have chosen to connect to it. Its own privacy policy applies.
• Apple or Google handle app downloads, payments and refunds under their own privacy policies.
• RevenueCat, Inc. checks purchases for us, as described in section 7.
• Our pairing relay receives only encrypted data it cannot read, plus the short-lived rate-limit counter described in section 4.

We do not sell your personal data or share it for advertising, and we do not give it to anyone else unless the law requires us to.

9. How long information is kept

• On your device: until you use Sign out and forget service (or, on Android, uninstall the app).
• Pairing relay: a pairing session is deleted after no more than 5 minutes. The rate-limit counter lasts about 60 seconds.
• Purchase records at RevenueCat: kept so that your purchase can be checked and restored. You can ask us to delete the anonymous purchase record (see section 12).

10. Security

Your sign-in details are kept in your device’s secure storage, and pairing data is encrypted on your phone before it is sent. Connections to our pairing relay use HTTPS.

How the connection to your provider is protected depends on your provider. For example, a server address that starts with http:// rather than https:// is not encrypted.

No method of storing or sending information is completely secure, but we have designed TellyPop so that we hold as little about you as possible.

11. Children

TellyPop is not directed at children under 13, or under the relevant minimum age in your country. We do not knowingly collect personal information from children. If you have a concern, please contact us at support@acefina.com.

12. Your choices and requests

Most of your information is only on your device, so you control it directly:

• turn off Remember me;
• use Sign out and forget service to delete your saved sign-in;
• use Sign out and forget service, or uninstall the app on Android, to remove its data from your device; and
• turn camera access on or off in your device’s settings.

Because we never receive your service sign-in details, we cannot see, change or delete them for you.

For questions about your purchase record held by RevenueCat, or to ask us to delete the anonymous purchase record, email support@acefina.com. Because the record is anonymous, we may ask for details that help us find it, such as the order number on your Apple or Google receipt. Deleting this record does not cancel a subscription. Your store purchase history itself is held by Apple or Google and is managed through them.

13. Users in the UK and EEA

If you are in the United Kingdom or the European Economic Area, Acefina LLC is the controller of the limited personal information described in this policy. You can contact us at support@acefina.com.

Legal bases

• Performance of a contract: to check and restore purchases you make, and to provide features you ask for, such as pairing your phone with a TV.
• Legitimate interests: to prevent abuse of the pairing relay, using the short-lived rate-limit counter. Our interest is keeping the service secure and available for everyone.

Your rights

You have the right to ask for access to your personal information, to ask us to delete it, and to object to processing based on our legitimate interests. Depending on where you live, you may have other rights too. To make a request, email support@acefina.com.

You also have the right to complain to your data protection supervisory authority — in the UK, the Information Commissioner’s Office (ICO), or in the EEA, the authority in your country.

International transfers

RevenueCat, Inc. is based in the United States, so purchase-checking information is transferred to and processed in the US. RevenueCat’s privacy policy explains how it protects this information. Contact us if you would like more information about these transfers.

14. Changes to this policy

If we change this policy, we will post the updated version on this page and change the effective date at the top.

15. Contact us

Acefina LLC
30 N Gould St
Sheridan, WY 82801-6317
United States
Email: support@acefina.com