Octa IPTV Player

Privacy Policy

How Octa handles your account, your provider logins and your viewing history.

Last updated: 27 October 2026

Octa IPTV Player ("Octa", "the app") is developed and published by Blackpepper Studio, a studio based in Pakistan. This policy explains what the app collects, why, and what you can do about it. It covers the Android phone app and the Android TV app, which share one account.

You can reach us at any time at snapfast.co@gmail.com.

The short version

Octa is a player, not a content service. It carries no channels, films or series of its own. You sign in with a subscription or playlist you already have, and the app talks to that provider directly from your device.

We run no advertising and sell nothing. We do measure how the app itself is used — which screens are opened, when playback starts or fails, and how long the library takes to load — and we collect crash reports, so faults can be found and fixed. None of it is used to build a profile of you, and none of it is shared with advertisers. The app asks for one Android permission, internet access, plus the camera on the phone only while you scan a code shown on your TV.

Creating an Octa account is optional. Without one, everything you add stays on the device you added it on.

What the app collects

Your Octa account, if you create one. You can sign in with an email address and password, or with Google. Sign-in is handled by Firebase Authentication, a Google service. We receive your email address, the sign-in method, and an account identifier. We never see your password. When you connect a TV by scanning a code, that TV is signed in anonymously and linked to your account; no personal detail is attached to it.

The provider logins you enter. To play anything, you give the app the details of your own IPTV provider: a server address, username and password for Xtream Codes, a playlist link or file for M3U, a portal address and MAC for a Stalker portal, or a single stream link. These are saved on the device so you don't have to type them again. If you are signed in to an Octa account, they are also saved to that account so your other device can use them.

Profile names and PINs. A profile PIN is never stored as the digits you typed. It is stored as a one-way scrambled value, so nobody can read the PIN back out of the app or the account.

What you watch inside the app. Octa records the titles you play, how far through you are, and what you add to My List, so Continue Watching and My List work. Each profile keeps its own. If you are signed in, this is saved to your account so the phone and TV stay in step.

Technical identifiers created by Firebase. When the app talks to Firebase, Firebase creates an installation ID for that copy of the app. It identifies the installation, not you and not your phone, and it is used to make sync work. When you sign in or create an account, Firebase also records the IP address of the request, for security and to prevent abuse. We do not use either for tracking or profiling, and we do not read the IP address.

How the app itself is used. Octa uses Firebase Analytics, Crashlytics and Performance Monitoring, all Google services. They record that a profile was opened and which kind it was (Xtream, M3U, portal or direct link), that playback started or failed and for what sort of title, and how long the library took to load or refresh. Your provider's address, your username and your password are never sent to any of them — only the kind of login used. Crash reports carry the device model, the Android version and where in the app the fault happened.

Your device's advertising identifier. Google Analytics for Firebase has access to the advertising ID that Android gives to apps, and so Octa is counted as collecting it. We do not use it to target anything: Octa shows no advertising, sells no data, and builds no profile of you. You can reset it, or switch it off altogether, in Android's own settings under Privacy → Ads.

Nothing else. The app collects no location and no contacts, and it builds no profile of you. It shows no ads and sells nothing.

The camera, files and your local network

The phone app uses the camera in one place: the screen that scans the pairing code on your TV. The picture is read on the phone to find the code, is never stored, and is never sent anywhere. Nothing else in the app uses the camera.

If you load a playlist from a file, the app reads only the file you pick.

"Play on TV" works entirely inside your home WiFi. The phone calls out on the local network to find TVs running Octa, and sends the chosen title straight to the TV it finds. What travels is the title, its identifier, the position you were at and a scrambled key that names the profile. Your provider address, username and password are never sent over the network by this feature; the TV rebuilds the stream link from its own saved copy of the login.

Who else is involved

Google (Firebase). Authentication and the account database (Cloud Firestore) run on Google's infrastructure, which stores that data on Google Cloud servers that may be outside Pakistan. Google processes it on our behalf. See Google's privacy policy at https://policies.google.com/privacy.

Your IPTV provider. The app connects to your provider from your device. That provider sees your requests, your IP address and your account activity, exactly as it would with any other player. Their own terms and privacy policy apply to that relationship. We are not affiliated with any provider and receive nothing from them.

Artwork and guide data. Posters and programme information come from links your provider supplies. Loading them contacts whichever image host the provider points to.

Google Fonts. The app loads its typeface from Google's font service the first time it needs it.

We do not sell your information, and we do not share it with anyone for advertising.

Security, and what you should know about IPTV

Traffic between the app and Firebase is encrypted. Data on the device is stored in the app's own private storage, which other apps cannot read.

One thing deserves plain speaking: many IPTV providers still run on plain HTTP rather than HTTPS. Where your provider does that, the request the app makes to it, including the login details inside the address, is not encrypted in transit. That is a property of the provider's service and applies to every IPTV player, not only Octa. If this matters to you, ask your provider whether they offer HTTPS.

Your provider password has to be stored in a usable form, because the app has to present it to the provider every time it fetches your library. It is not published, shared or sent anywhere except to that provider.

How long it is kept, and how to remove it

Everything stays until you remove it.

To delete your Octa account and everything stored with it, write to snapfast.co@gmail.com from the address you signed up with, with the subject "Delete my account". We remove the account and its data within 30 days and confirm by email. There is nothing to keep afterwards, since we hold no backups of your library beyond the account itself.

Children

Octa is not designed for children and is not directed at them. We do not knowingly collect information from anyone under 13. If you believe a child has created an account, write to us and we will remove it.

Your rights

Depending on where you live, you may have the right to ask what we hold about you, to correct it, to have it deleted, or to receive a copy. Write to snapfast.co@gmail.com and we will answer within 30 days.

Where the GDPR or UK GDPR applies, our basis for handling account data and your saved logins is the contract between us, namely providing the app and its sync feature. Sync is optional and you may use the app without it. You may withdraw consent by deleting your account.

We do not sell personal information and have not done so in the past twelve months.

Changes

If this policy changes, the date at the top changes with it, and the new version appears here and in the app. Significant changes will also be noted on the app's Play Store listing.

Contact

Blackpepper Studio Email: snapfast.co@gmail.com