ALPAPLAYER
EN

Privacy Policy

Last updated: 30 October 2026

This policy explains which data the Alpa Player app (Android, Android TV, Samsung, LG, Windows, iPhone and iPad) and the alpaplayer.com website process. Data controller: Alpa Player (a non-profit project run by Alpa Yazılım), Mardin, Türkiye, e-mail: info@alpayazilim.com.

1. Personal use

When you add your own source (a playlist, a video link or an account), this information is stored encrypted only on your device, in the device’s secure storage (Android Keystore, Apple Keychain, Windows DPAPI), and is not sent to Alpa Yazılım. Your favourites, watch history and settings also stay only on your device. The content you watch comes directly to your device from the source you added; it does not pass through our servers and is not recorded.

Remote list and device pairing: when you open the “Device ID” screen or press “Refresh lists” on the home screen, the app sends our server, to ask whether a list has been assigned to you remotely (by an institution panel or via alpaplayer.com), the device ID generated by the app (in MAC format; it is not your hardware identifier: on phones it is generated randomly; on Samsung TVs the DUID and on LG TVs the LGUDID is converted inside the TV into a one-way SHA-256 hash, the original identifier never leaves the TV and cannot be recovered from the hash), the device model, the app version and the IP address of the connection. This data is used only for pairing, security and abuse prevention; it is not used for advertising or marketing and is not shared with third parties (except where required by law). You can ask for it to be deleted at info@alpayazilim.com.

2. Institution use

When you sign in with an account or a device ID provided by your institution, the Alpa Player server processes the following data: the institution code, the student / staff number and the name defined by your institution, the device ID generated by the app (not a hardware identifier; generated randomly), the device model, the last sign-in and last-seen times, and the IP address (for security and to validate the short-lived playback link). This data is used only to provide the service, keep accounts secure and let your institution manage it; it is not used for advertising or tracking and is not sold.

3. Uploading a list via alpaplayer.com

When you upload a list to a device on the site, the uploader’s IP address, the date and time, the device ID, the uploaded list / account details (encrypted) and the version of the accepted responsibility statement are recorded. These records are kept for at most 2 years to prevent abuse and to respond to requests from competent authorities.

4. Institution panel applications

The institution name, contact name, e-mail and phone you give in the panel application form are processed only to review the application, open the panel and contact you. Alpa Player is free of charge; no payment is taken and no card or bank details are requested.

5. Legal retention records (operation and device records)

As a hosting provider, and as required by Law No. 5651 and related legislation, the following information is recorded for operations carried out on the panel and alpaplayer.com:

These records are kept for 2 years even if the related device, list, user or account is deleted or closed, and are deleted or destroyed when that period ends. The hosting provider’s obligation to retain traffic information is set out in Article 5 of Law No. 5651. Only a person authorised by Alpa Yazılım and, upon a legal request, competent authorities (courts, public prosecutors, BTK, etc.) can access the records; the records are not used for advertising or marketing and are not shared with third parties except where legally required. These records are outside the scope of data deletion requests (see Data Deletion).

6. Third-party services

TMDB (optional showcase): if enabled, film / series artwork is loaded from themoviedb.org.

OpenSubtitles (optional): if you connect it, subtitle searches go to opensubtitles.com.

If you do not use these services, no request is sent to them. The app contains no advertising, analytics or tracking libraries.

7. Retention, destruction and security

Server-side data is transmitted over an encrypted connection (HTTPS); source addresses and account details are stored encrypted in the database with AES-256. Security logs (blocked attempts, shared links) are deleted automatically after at most 90 days. App download records (the downloader’s IP address, browser / device details, date and time and version) are kept for at most 2 years to count downloads and prevent abuse. Legal retention records (section 5) are kept for 2 years. Institution data is kept while the institution account is open and, after it is closed, for as long as needed for legal obligations. Personal data whose retention period has expired is deleted, destroyed or anonymised in periodic destruction runs (at least every six months) in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

8. Children

Alpa Player is intended for general use. Institution accounts of users under 13 are opened under the responsibility of the institution (school) and with the knowledge of a parent.

9. Your rights, applications and contact

For your rights under Article 11 of the KVKK (Turkish Personal Data Protection Law) and how to apply, see the KVKK Notice. For users in the European Union / European Economic Area, the rights of access, rectification, erasure, restriction of processing, objection and data portability, and the right to complain to the competent supervisory authority, are reserved to the extent applicable; requests can be sent to the same address. For deletion requests see Data Deletion. For questions: info@alpayazilim.com