Privacy policy

Last updated 24 October 2026.

The short version

Your sign-in details

The address, username and password of any server you add — or the LinkACode ID you used instead of an address — are kept on your device. The sign-in itself (the address, username and password, or the whole link of an M3U list) is kept encrypted: in the iOS Keychain on iPhone and iPad, and on Android under a key held in the Android Keystore, which never leaves the device. Alongside it, in the app's own storage on the device and not encrypted by the app, are the server's address or the LinkACode ID, and an M3U list's channel addresses, which for many servers include the username and password. On iPhone and iPad all of this can be included in your own iCloud or computer backup, if you make one; Android backups and phone-to-phone transfers leave Vizi's data out altogether. Your details are used only to reach the server they belong to, and are never sent to Vizi's servers in any form we can read. The one time they pass through us is if you choose to send a playlist from one of your devices to another — a phone to a TV, say, from the app or from viziplayer.com/link: it is locked on the sending device, or in your browser, with a key only the receiving device holds, passes through us as unreadable data, and is deleted as soon as it is collected (see Codes between devices). If you enter a LinkACode ID, the app sends that ID — and only that — to linkacode.com, a separate service we also operate, to look up the server's address, which comes back to your device. On a second device you enter your details again — or send them from a device that already has them.

That is a deliberate inconvenience. It means we are never a place where someone's sign-in details can be stolen, demanded or leaked, and it means we cannot tell anyone which servers you use — including anyone who asks us officially.

Two things worth knowing. If you play something on a TV with Chromecast or AirPlay, the TV is handed the address of what is playing and fetches it from your server itself, and for many servers that address includes the username and password. And Vizi's own services and linkacode.com are only ever reached over an encrypted connection, while your server is reached the way its own address says, which can be plain http.

Nothing syncs between devices

Favourites, viewing history, where you got to, playlists and profiles all stay on the device they were made on, unless you send a playlist to another device yourself. None of it is sent to us in any form we can read, with an account or without one. What an account does carry is whether it has Vizi+ — see Vizi+ and your account.

What we cannot do

We cannot tell you, ourselves, or anyone who asks, what you have watched. Not because we decline to, but because the information does not exist here. This also means we can never build viewing analytics. That is the trade, and we chose it.

What you may and may not play with Vizi is set out in our acceptable use policy.

Account information

An account is optional. Vizi+ bought from a store already works on every device signed in to the same Apple ID or Google account (or, on Fire TV, the same Amazon account); you need a Vizi account for it to reach a device that is not — an Android phone, say, for Vizi+ bought on an iPhone — and, on iPhone and iPad, for kids profiles. If you create one we hold your email address; which sign-in method you used, with the identifier Apple or Google gives us if you use one of them; when the account was made and last used; whether it has Vizi+, and the store purchases behind it; a security log of its sign-ins and other changes to it; and a list of your devices. For each device that is its name, what kind of device it is, the app version, a random identifier the app makes for it, and when it was first and last seen. On Android a device is named by its model. (Test versions of the Android app handed out before its Google Play release sent the name the phone was given in its settings instead; a device signed in with one keeps that name until it signs in again or is removed.) If Apple or Google include your name when you sign in with them, we do not keep it.

Vizi+ and your account

If you have Vizi+ and a Vizi account, the app tells us which Vizi+ the account has — a subscription and until when, or Lifetime — and we check it with the store it was bought from: on iPhone and iPad the app sends Apple's signed record of the purchase, on Android the purchase's reference, which we look up with Google Play, and on Fire TV the receipt's reference and your Amazon account's identifier, which we check with the Amazon Appstore. Apple, Google and Amazon can also tell us directly when a subscription renews, ends or is refunded. We keep which Vizi+ it is, until when, and the store's reference for the purchase. That is what lets Vizi+ work on every device signed in to the account. If you buy Vizi+ while signed in to a Vizi account, the app gives Apple or Google the account's random identifier along with the purchase, so that the purchase can find its account again; the store keeps it with its record of the purchase, and Google may also use it in its own checks against fraud. Payment is handled by that store, and your payment details never reach us.

Codes between devices

A device can show a code so that another one can sign it in to your account, send it playlists, or — for a TV — send it searches typed on a phone. While the code lasts we keep what the waiting device says about itself (its name and model, what kind of device it is, the app version and its random identifier), roughly where it is (city and country, looked up from its network address) and a salted hash of that address. They are shown on the screen that answers the code, with whether the two devices seem to be on the same network, so you can tell the device is yours.

A code lasts ten minutes; one taking searches lasts ten minutes from the last search, and never more than an hour. After that, the clean-up that runs every ten minutes deletes it and everything kept for it. A playlist or a search sent with a code is locked on the sending device — or in your browser, at viziplayer.com/link — with a key only the receiving device holds. We pass it on without being able to read it, and delete it as soon as it is collected.

Advertising

On phones and tablets the free tier shows adverts, served by Google's AdMob network. Google's advertising software in the app collects its own data to show and measure them and to prevent fraud — including roughly where you are (estimated from your network address), how you interact with the adverts, diagnostic information and the device's advertising identifier — and sets its own identifiers. Where the law requires it, as in the UK and the EEA, Google's consent form asks you first; on Android, Privacy choices in Settings lets you change your answer. On iPhone and iPad the identifiers are also subject to the tracking permission iOS asks you for. If you decline tracking you still see adverts; they are simply not personalised. A TV never shows adverts, and Vizi+ removes them entirely.

IP addresses

Where we record an address for security purposes — when you sign in, for example — we store a salted hash of it, never the address itself. It is kept with that record and goes when the record does: with your account, for its security log, and much sooner for a code between devices or a count kept to limit repeated attempts.

Children

Vizi is not directed at children. Kids profiles are a control for the adult who owns the device; they exist only on that device, and we never receive them.

Legal basis and retention

We process the little we hold to provide the service you asked for — the contract between us — and to keep it secure, which is our legitimate interest. What has done its job is not kept: a clean-up that runs every ten minutes deletes sign-in codes, and the email address each was sent to, an hour after they were made; codes between devices, and everything kept for them, once they run out; and sessions that were signed out, have expired or belonged to a removed device. Removing a device deletes it straight away; signing out of one does not remove it. Everything else we keep for as long as your account exists. Delete the account and it goes with it; all that remains is a record that an account was deleted and when, which holds no address, name or device and identifies no one. We keep that record indefinitely, so that we can show the deletion was done.

Suppliers

Cloudflare hosts the service. Resend delivers our email. Apple, Google and Amazon handle payment for Vizi+, through the App Store, Google Play and the Amazon Appstore — your payment details never reach us — and run Sign in with Apple and Sign in with Google if you choose them. Google also serves the free tier's adverts, and on Android its Play services run the QR code scanner (the app receives only the code's text) and Chromecast. LinkACode, a separate service we also operate, looks up a server address when you enter a LinkACode ID. We sell your information to nobody at all.

Your rights

In the app you can see the email address and devices on your account, remove any of your other devices, which deletes it from our records (to remove the one you are holding, use another device signed in to the account), and — on a phone or tablet — delete the account, which deletes what we hold about you. If you want a copy of everything we hold, or have a complaint, email support@viziplayer.com. If you are in the UK you may also complain to the Information Commissioner's Office.

Contact

support@viziplayer.com