Privacy Policy
1. Controller
The data controller under the GDPR is the service provider Patrick Draouil. Full contact and address details are listed in our Imprint. We are not legally required to appoint a data protection officer; for any privacy matter reach us at kontakt@yunory.de.
2. What is Yunory and what role does your data play?
Yunory Player is a neutral playback tool (media player). Yunory does not provide any media content, channel lists or streams of its own. You, the user, bring your own playlist or your own streaming credentials (M3U link or Xtream access); streams are loaded live from the provider you chose. This policy describes which personal data is processed in your Yunory account or browser session.
3. Account data (email registration)
When you create an account we process:
- Email address (required; used as login identifier and for transactional messages),
- Password — stored solely as a cryptographic hash, never in plain text,
- Display name (optional),
- Language preference, role (user/administrator) and technical timestamps (created/updated),
- your pinned live categories (to sync your interface across devices).
Purpose: provision and management of your account, login and cross-device sync of your settings. Legal basis: Art. 6(1)(b) GDPR (contract/use relationship).
4. Your playlists and streaming credentials
For the player to work we store the playlists you add:
- the name of the playlist and its type (M3U or Xtream),
- for M3U the playlist URL,
- for Xtream the host, username and password of your streaming provider and, if set, a user agent,
- the resulting catalogue (channel, movie and series titles, logos/covers, group names, language and EPG/programme data). For Xtream playlists, stream URLs are not stored permanently; they are reconstructed at runtime from your credentials when needed.
Note: the Xtream credentials are the login details to your streaming provider. They are required for the player to load the catalogue and fetch streams. You can disable or delete a playlist at any time. Purpose: operating the player and displaying your personal catalogue. Legal basis: Art. 6(1)(b) GDPR (provision of the service you requested).
5. Watch history, watchlist and favourites
To provide convenience features such as “Continue watching”, “My list” and favourites we store:
- your playback progress: which channel/movie/episode you last played, the last position reached (in seconds), the total length, a “finished” status (from approx. 95%) and the time of last playback,
- your watchlist (“watch later”) and your favourites (channels and series).
This data is linked to your account or — while you are not logged in — to your anonymous browser session. Purpose: providing the playback convenience features. Legal basis: Art. 6(1)(b) GDPR. No evaluation for advertising or profiling takes place (see section 11).
6. Session and cookies
Yunory uses only strictly necessary cookies:
player_session— the session cookie with a randomly generated session ID. It links your playlists, settings and — if logged in — your account to your browser. It is set asHttpOnly,SecureandSameSite=Laxwith a technical lifetime of up to 12 months.yunory_locale— stores your language choice.yunory_platform— marks the display for TV interfaces.yunory_hdr— remembers whether your browser/display supports HDR playback (to pick the right playback quality).yunory_show_junk— remembers your setting whether hidden channels are shown.
The session also stores your preferred language and the “hide other languages” setting. No marketing, advertising or tracking cookies are set; as only strictly necessary cookies are used, no consent is required under § 25(2) TDDDG. Legal basis: Art. 6(1)(f) GDPR (technical operation) or Art. 6(1)(b) GDPR.
7. IP address and server logs
When you access the service we temporarily process your IP address and technical connection data (time, requested resource, user agent) in server logs. These serve delivery of the service, IT security and abuse mitigation (e.g. rate limiting). They are kept only as long as necessary for these purposes and are then deleted or truncated. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security and operation).
8. Stream proxy / pass-through
When you play a stream, traffic between your browser and the stream source you chose may be routed through our server (proxy). The forwarded media content is not stored, only passed through. In this respect Yunory acts as a mere technical intermediary; we do not take note of the specific media content and do not review it. Legal basis: Art. 6(1)(b) GDPR (provision of the service).
9. Payment processing (Stripe)
If you take out a paid subscription (“Yunory Premium”), we process the data required to perform the contract: the chosen plan, billing interval, status (e.g. active/cancelled/past due), start and end of the billing period, the Stripe customer ID and Stripe subscription/price ID (pseudonyms linking to Stripe), and the date and content of the required consents (immediate performance, loss of the right of withdrawal under § 356(5) BGB). For your orders/invoices we store invoice and payment identifiers, amount, currency, status, description, a link to the invoice and the payment date.
The payment itself is handled by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland). Payment data (card number, IBAN, holder, expiry) is processed exclusively by Stripe — we never see it. Stripe may transfer data to the USA; such transfers are safeguarded by the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses. Details: stripe.com/privacy.
Legal basis: Art. 6(1)(b) GDPR (subscription contract) and Art. 6(1)(c) GDPR in conjunction with § 147 AO (retention of invoices).
10. Recipients and international transfers
We share your data with third parties only to the extent necessary to operate the service. No sharing for advertising or profiling takes place. Recipients are:
- Stripe (payment processing; EU/Ireland, possibly USA) — see section 9.
- The Movie Database (TMDB) (USA) — to enrich your catalogue with posters, descriptions, ratings and cast data, title/catalogue strings from your playlist (e.g. movie/series titles) are sent server-side to TMDB to find matching metadata. No account or contact data is sent to TMDB. Transfer to the USA, safeguarded by the EU Standard Contractual Clauses. Legal basis: Art. 6(1)(f) GDPR.
- Cloudflare (Cloudflare, Inc., USA, with EU establishment) — as an upstream CDN/proxy, Cloudflare technically sees your IP address and request data; it serves delivery, protection and acceleration of the website. Transfer to the USA, safeguarded by the EU Standard Contractual Clauses/EU-US Data Privacy Framework. Legal basis: Art. 6(1)(f) GDPR.
- Email delivery — transactional emails (welcome message on registration, order confirmations and notices, e.g. trial expiry) are sent via our own mail server (
mail.slorify.com, Germany). Legal basis: Art. 6(1)(b) and (f) GDPR. - Hosting — the service runs on our own server in Germany.
Where processing is carried out on our behalf, the agreements required under Art. 28 GDPR are in place.
11. No tracking, no profiling
We use no Google Analytics, no advertising cookies and no cross-device trackers. There is no automated decision-making or profiling within the meaning of Art. 22 GDPR. The watch history described in section 5 serves only your personal convenience features and is not evaluated for advertising or scoring purposes.
12. Retention
- Account data, playlists, watch history, watchlist, favourites (logged-in users): until you delete your account (see section 13).
- Anonymous sessions (no login): playlists and related data of anonymous sessions are deleted automatically after 180 days of inactivity.
- Session cookie
player_session: technical lifetime of up to 12 months. - Invoicing/accounting data (orders, Stripe receipts): retained for the statutory periods, in particular 10 years under § 147 AO / § 257 HGB. This data is kept even after account deletion for the duration of the statutory retention period and its processing is restricted accordingly.
- Server logs/IP: see section 7.
13. Your rights
You have the right at any time to:
- Access the data stored about you (Art. 15 GDPR),
- Rectification of incorrect data (Art. 16 GDPR),
- Erasure of your data (Art. 17 GDPR),
- Restriction of processing (Art. 18 GDPR),
- Data portability (Art. 20 GDPR),
- Object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR),
- Withdraw consent with effect for the future (Art. 7(3) GDPR),
- Lodge a complaint with a supervisory authority (Art. 77 GDPR).
Account and data deletion: you can delete your account yourself — in the app under “Account” or at yunory.de/account — or by an informal message to kontakt@yunory.de. Deletion removes your profile, playlists, watch history, watchlist, favourites and subscription data; only invoicing data subject to statutory retention remains for the duration of the retention period (section 12). Individual playlists can be deleted at any time in the settings independently of this.
14. Minors / 18+ content
The service is not directed at children. Where you play content through your playlist that is intended for adults only, you must be at least 18 years old. We deliberately do not collect special categories of personal data (Art. 9 GDPR).
15. Changes to this policy
We adapt this privacy policy when the service or the legal situation changes. The version published on this page applies.
16. Contact
For privacy-related questions reach us via the contact details listed in the Imprint or directly at kontakt@yunory.de.