Privacy Policy
Skywave is designed so you never have to trust us with anything you wouldn’t give a broadcast TV remote. Here’s exactly what happens, in plain English.
Effective 2026-07-06 · Version 1.0
The short version
Skywave has no advertising, no third-party analytics, and no user tracking. Your Xtream Codes credentials stay on your device in the iOS Keychain. Family Sync, when you enable it, uploads only end-to-end encrypted ciphertext to Skywave’s server — we never see your account details in the clear.
What Skywave collects
Xtream Codes account credentials
The server URL, username, and password you enter on the Add Account screen are stored in your device’s Keychain and are never transmitted to any Skywave-operated server. Skywave uses them locally to authenticate against your IPTV provider — the same handshake a web browser would perform when you visit that provider’s player. Removing an account deletes the Keychain entry.
Family Sync (opt-in)
If you enable Family Sync from Accounts → Family, Skywave uploads a snapshot of your accounts, favourites, custom groups, and watch history to a Skywave-operated Cloudflare Worker. The snapshot is AES-GCM encrypted on your device before it leaves; the server only stores ciphertext plus a hash. The decryption key never leaves your household — it’s shared via a QR code or one-time code between family members, not through our server. Family Sync is off unless you turn it on.
Watch history and preferences
Recently watched channels, watchlist, favourites, custom groups, parental-control settings, and sports preferences are stored locally on your device (Application Support directory + Keychain). They’re only ever transmitted off-device via Family Sync, and only if you’ve turned that on.
Diagnostics
App Store builds of Skywave ship without any diagnostics collection endpoint. Developer builds used inside the Skywave team can be configured to send anonymised playback events to a developer-run collector; those builds are never distributed through the App Store.
What Skywave does NOT collect
- No advertising IDs. No IDFA access is requested.
- No third-party analytics SDKs (no Firebase, no Segment, no Mixpanel, no Amplitude, no Facebook SDK).
- No location data.
- No contacts, photos, calendar, or health data.
- No purchase history.
- No browsing history outside Skywave.
- No conversations with support (email replies aside — see below).
Third-party services Skywave calls
TMDB — movie and series metadata
To enrich VOD and Series detail pages with posters, backdrops, plots, cast, and trailer links, Skywave calls The Movie Database API (via a Skywave-operated proxy that adds our API key). No identifying information about you is included in these requests — only the movie or series title/id you’re viewing. TMDB’s privacy policy is at themoviedb.org/privacy-policy. This product uses the TMDB API but is not endorsed or certified by TMDB.
ESPN — sports scores and fixtures
The Live Sports rail queries ESPN’s public site.api.espn.com scoreboard endpoints to determine which matches are live now and their scores/kickoff times. No identifying information about you is sent; the request is a plain league-scoreboard fetch that any web browser can make. Skywave is not affiliated with, endorsed by, or sponsored by ESPN.
Your IPTV provider
Skywave connects directly from your device to whichever Xtream Codes server you configure in Add Account. That provider sees your device’s IP address and the credentials you provided, exactly as it would if you used their own player. What your provider does with that information is governed by their privacy policy, not this one.
Data retention
- On device: kept until you remove the account or delete Skywave.
- Family Sync ciphertext on our server: kept until any device in the household clears its snapshot, or the household is deleted from any member’s Accounts → Family screen. Ciphertext with no active households is purged.
- Support emails: kept for as long as needed to resolve your issue, plus a reasonable archive window.
Your rights
Because Skywave stores almost everything locally, most of your privacy rights are exercised directly in the app:
- Access: everything Skywave has is visible in the app.
- Deletion: remove an account from Accounts, or delete Skywave, to wipe on-device data. Delete the household from Family to wipe the ciphertext on our server.
- Portability: the credentials you entered are the credentials your provider gave you — they’re yours to take anywhere.
If you’re in a jurisdiction with additional rights (GDPR, CCPA), email us using the address below and we’ll help.
Children
Skywave is rated 17+ because the content available from any Xtream Codes account is at the discretion of your provider — not Skywave. The app itself has no advertising and no communications with other users. Parental controls are built in (Accounts → Parental Controls) and enforced across every browse surface.
Changes to this policy
If we change what we collect or how we use it, we’ll update the effective date at the top of this page and, for material changes, note it in the next app release’s What’s New.
Contact
Privacy questions: privacy@skywave.app. General support: skywave.app/support.