Privacy policy
Last reviewed: 12 October 2026.
What Tevium does
Tevium is a media player and account-management service. It does not supply channels or media subscriptions. This policy explains how the app, website and optional account sync handle your information.
Information handled
Accounts use an email address, authentication records and optional display name. Account sync can store playlist configuration, favourites, groups, addon and EPG URLs, resume points, library entries and watched episodes. Source URLs can include private access tokens. Normal hosting/security operations process connection information such as IP addresses, request timing and error codes.
Provider credentials
Adding a playlist through the website or syncing it from the app sends provider details to the account service over HTTPS. Stored credential records use AES-256-GCM with a server-held key. The server can decrypt them for authorised source operations and send them to your signed-in app. This is not encryption where only your devices hold the key. The server does not relay the media you watch.
Device storage and security
The app stores account tokens using Android Keystore-backed encryption. Provider passwords use a separate Keystore mechanism where available; older installations or unavailable Keystore implementations can contain legacy plaintext credentials. Manual JSON backups include unencrypted provider passwords and URLs: keep them private. Automatic account-data backup and device transfer are excluded by the app's backup rules. Device security, provider transport and source URLs also affect confidentiality. Account passwords are managed by Supabase Auth, not stored as plaintext by Tevium.
Purpose and service providers
Account data supports sign-in, configuration management, device linking, playback-state sync and support. Supabase provides authentication/database services. Selected hosting and email services also process information required for operation. These providers may process data outside your country.
Cookies and tracking
The website uses necessary sign-in/security cookies. No advertising or third-party analytics scripts are configured on this website. Hosting security systems may process traffic information. Optional tracking must not be introduced without reviewing notice and consent requirements.
Retention and deletion
Account deletion removes the auth user and associated live-database configuration, provider credentials, viewing state, device links and app sessions through database relationships. Redemption history can retain an anonymised record. Operational logs and backups have separate retention schedules and may not disappear immediately. Revoking app sessions prevents further use of those sign-ins; it does not erase synced data.
Your choices and requests
Use the account security page to revoke app sign-ins or request account deletion. Avoid account sync if you do not want supported device state and provider details processed by the account service. Contact the operator for access, correction, export or privacy complaints . Third-party sources have their own policies and you must have permission to access them.
Contact
For privacy questions, access, correction or deletion requests, email support@tevium.tv.