Privacy policy

Fenris Player is a media player. You bring your own playlist; we do not provide content. This policy explains what personal data the app, this website and our servers process, why, and what you can do about it. It applies to the Fenris Player app on every platform and to fenrisplayer.com.

1. Who is responsible

The controller of your personal data under the General Data Protection Regulation (GDPR) is:

• Operator: Fenris Player, the Netherlands
• Email: info@fenrisplayer.com

For any privacy question or request, email us. We answer within one month.

2. The short version

• There is no account. The app identifies itself with a random device ID it creates on first launch.
• No ads, no analytics, no tracking. The app and this website contain no advertising or analytics code.
• We do not sell or rent your data, and we do not use it for profiling.
• Card payments are handled by Stripe. We never see your card number.
• Your playlist address can contain the username and password of your content provider. We store it only to deliver it to your device.

3. What we process and why

3.1 When you use the app

When the app starts for the first time it registers with our server. We then process:

• Device identifiers: a random device ID and secret created by the app, and the device code and key we issue for linking playlists.
• Device fingerprint: identifiers derived from your device, which we receive and store only in hashed form. We use them only to recognise a device that has already had a free trial and to prevent abuse.
• Technical details: platform (Android or Windows), app version, and the IP address from which the device started its trial and last contacted us.
• Licence status: trial start and end dates, activation period, payment status, and the date the device was last seen.

Why: to activate the app, check whether it is in trial or paid, deliver your playlists and updates, and keep the service secure. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)). Recognising repeated free trials and protecting the service against abuse is based on our legitimate interest in preventing fraud (Art. 6(1)(f)).

3.2 Playlists you link

When you link a playlist on the Manage playlists page we store its name, its address (URL) and, if you set one, a hash of its PIN. A playlist address often contains the username and password your content provider gave you. We use the address only to send it to your device and to check whether it is reachable. We never share it and never use it for anything else.

Your content provider is not us. When the app plays a stream it connects directly to your provider's servers, which then see your IP address and what you watch. That is governed by your provider's own privacy policy.

Legal basis: performance of our contract with you (Art. 6(1)(b)).

3.3 Data that stays on your device

Watch progress, favourites, settings, your parental-control PIN and a cached copy of your playlist are stored only on your device. The cached playlist is encrypted. We do not receive this data. Uninstalling the app deletes it.

3.4 Payments

Payments are processed by Stripe. You enter your card details on Stripe's own checkout page; we never receive them. We keep an order record with the plan, the amount, the date, your device code, the Stripe payment references, the version of our terms you accepted, the email address you gave Stripe, and a copy of the invoice. We use them to prove the purchase, to restore a lost activation, to handle refunds and for our accounting.

Legal basis: performance of our contract (Art. 6(1)(b)) and our legal obligation to keep accounting records (Art. 6(1)(c)).

3.5 Contact form and email

If you contact us we process your name, email address, phone number if you give one, and your message, only to answer you. Legal basis: our legitimate interest in answering questions (Art. 6(1)(f)), or steps taken at your request before a contract (Art. 6(1)(b)).

3.6 Newsletter

If you sign up for updates we store your email address and the time you signed up. We use it only to send occasional release notes and important product news. Legal basis: your consent (Art. 6(1)(a)). You can withdraw it at any time using the link in any email or on the unsubscribe page.

3.7 Partner codes

Some people recommend Fenris Player as our partners and earn a commission when someone they referred pays. If you pay with a partner code, we link your device code to that code so the partner's share of this and later payments can be worked out. The partner sees the date, the amount, and only the first part of your device code. They never see your email address, full device code, playlists or what you watch. Legal basis: our legitimate interest in paying the partners who bring us customers (Art. 6(1)(f)).

If you are a partner, we process your name, email address, password (stored only as a hash), bank account details and the commissions and withdrawals on your account, to run the partner programme and pay you. Legal basis: performance of our agreement with you (Art. 6(1)(b)) and our legal obligation to keep accounting records (Art. 6(1)(c)).

3.8 Website and server security

Our servers process IP addresses and request details to deliver pages, limit abuse (for example too many attempts) and investigate security incidents. The sign-in and contact forms use a self-hosted "I'm not a robot" check (ALTCHA): your browser solves a small calculation, no cookie is set and nothing is sent to a third party. Legal basis: our legitimate interest in running a secure service (Art. 6(1)(f)).

4. Cookies

This website sets only cookies that are strictly necessary for it to work. They are exempt from consent under the Dutch Telecommunications Act, which is why there is no cookie banner. We use no analytics, advertising or tracking cookies, and no third-party cookies. The one exception is fenris_ref: it is set only if you follow a partner's link and then choose Apply code, and it is not set otherwise.

Fonts are served from our own server. Pages do not load anything from Google or other third parties. (Stripe's checkout page is Stripe's own website and has its own cookie notice.)

5. Who receives your data

We do not sell personal data. We share it only with service providers that process it on our behalf:

• Stripe (Stripe Payments Europe Ltd., Ireland, and its group companies): payment processing.
• Our hosting provider: runs the servers for this website and our API.
• An email service, only if and when we send the newsletter.

If you install the app from Google Play or another store, that store processes data under its own privacy policy. We may also disclose data where the law requires it.

6. Transfers outside the EU

Stripe may process payment data in the United States. Stripe relies on the EU–US Data Privacy Framework and the European Commission's Standard Contractual Clauses for these transfers.

7. How long we keep data

• Device and licence data: while the device is in trial or activated, and deleted on request after that.
• Device fingerprints: up to 2 years after the trial they relate to, to recognise repeated trials.
• Playlists: until you remove them on the Manage playlists page, or the device is deleted.
• Payment records: 7 years, as required by Dutch tax law.
• Partner accounts and commissions: while the partnership runs, and commission and payout records 7 years after, as required by Dutch tax law.
• Contact messages: up to 12 months after our last reply.
• Newsletter: until you unsubscribe.

8. Your rights

You have the right to access your data, correct it, have it deleted, restrict or object to its processing, and receive it in a portable format. Where we rely on your consent you can withdraw it at any time. To use any of these rights, email us and include your device code if your request concerns the app. See how to delete your data.

You can also complain to the Dutch data protection authority, Autoriteit Persoonsgegevens, or the authority in the EU country where you live.

9. Security

All traffic between the app, this website and our servers is encrypted with HTTPS. Requests from the app are signed with a per-device key, and device fingerprints are stored only as hashes. No system is perfectly secure; if a breach affects your data we will inform you and the authorities as the law requires.

10. Children

Fenris Player is not directed at children under 16, and we do not knowingly collect their data.

11. Changes

We will update this page when what we do with data changes, and change the date at the top. Significant changes will also be announced in the app or on this website.