Privacy Policy

Last updated: 14 October 2026

The short version

Kepler has no account, no ads, no analytics and no crash reporting. What you add stays on your own devices, and nothing about what you watch is sent to us. A few small things are kept elsewhere, all for Kepler Pro: a record that allows one free trial per device and, if you buy Pro, your purchase and the list of devices using it. None carries your name or email address, though a device in that list is shown by the name it has in Android's settings, which you may have chosen yourself. The apps summarise this as sections 4 to 7 of the terms you accept before you start; this page is the full version.

What stays on your device

• Your playlists and their logins (M3U links and files, Xtream server, username and password)
• The channels, films and series those playlists list, and their programme guides
• Your favourites, watch and search history, reminders, scheduled recordings and hand-built groups
• Recordings and downloads
• Settings such as language, theme, layout, sort order and parental PIN

An Xtream password is encrypted with a key held in Android's keystore. The rest of a playlist's details (server address, username, M3U links) and the stream addresses built from them, which for Xtream playlists contain the login, are kept in the app's private storage, which other apps cannot read. A parental PIN is stored only as a one-way hash.

Kepler is left out of Android's device backups and of transfers to a new phone, so none of this is copied to a Google account, and it reaches another device only if you link your devices yourself (see below). Uninstalling the app, or clearing its data, deletes all of it, recordings and downloads included. Only recordings and downloads Kepler 1.0 kept in the shared Movies folder are ordinary files that stay until you delete them.

What the apps connect to, and why

• The servers your playlists and guides name, to load channels, listings, artwork and streams. Those servers see your device's internet address and what it asks for, as any website would. They belong to your provider, not to us.
• TMDB's image server (image.tmdb.org), for film artwork that a playlist names only by path.
• keplerplayer.com, to read a small file from our own server: its time, so the free trial is dated by a clock the device cannot move, and whether this version of the app must be updated. The site sees only that request and your internet address.
• Google Play, for purchases, on a phone for updates, and now and then to invite you to rate Kepler. Google Play's billing, update and review components in the app may send Google data about how they are used, under Google's privacy policy. Billing is on TVs as well as phones, and the invitation to rate on TVs with Google TV. The app is not told whether you rated it; a review you post is public on Google Play.
• Firebase and RevenueCat, for the free trial and Kepler Pro, described in the next section.
• Google Cast, on phones. While the player is open, it uses Google Cast, part of Google Play services, to find TVs you can cast to. Google may collect data about that use under its own privacy policy. The TV app does not use it.
• YouTube, when you open a trailer. The trailer opens in the YouTube app or your browser, both Google's.

Kepler Pro and the free trial

• The trial record. When your first playlist has finished loading, the free trial starts, and Kepler keeps a small record with Google's Firebase service (Cloud Firestore), on our behalf: a salted one-way hash of the device's Android ID, the date the trial started, and the date the record is to be deleted. The hash cannot be turned back into the Android ID, and from Android 8 on, the Android ID Kepler reads is its own: Android gives each app a different one. The record lets a reinstall find the same trial rather than start a new one, and is deleted about 400 days after the device was last seen. Before the record is read or written, Google Play Integrity (through Firebase App Check) confirms that the request comes from Kepler as installed from Google Play.
• Purchases. Kepler Pro is bought through Google Play, which handles the payment; we never see your payment details. To know whether you have Pro, the app uses RevenueCat, a payment service working for us. RevenueCat receives an anonymous id the app creates (never your name or email address), the purchases Google Play reports for it, and your internet address.
• The list of devices. One purchase covers up to 10 Android devices signed in with the Google account that bought it, every device counting. So that the limit holds, Kepler keeps a list for each purchase with Firebase (Cloud Firestore), on our behalf: a salted one-way hash of Google Play's purchase token and, for each device using it, a salted one-way hash of the device's Android ID (salted differently from the trial record's, so the two cannot be matched), the name the device has in Android's settings, its maker and model, whether it is a phone, tablet or TV, and when it was added and when it last checked in. For a device that was removed, the list keeps only that hash and the date. Every device signed in with the purchase's Google account can read the list (Settings, Kepler Pro, Devices using Kepler Pro) and remove a device from it; a device holding a place checks in about once a week. The list is deleted about 400 days after it last changed, and Google Play Integrity (through Firebase App Check) confirms each request, as for the trial record.
• Finding a purchase again. After a purchase, RevenueCat keeps its anonymous id in Google's Block Store on the device, so the purchase is found again after a reinstall. Block Store copies it to your Google account only if Google backup is on.

Other ways data can leave your device

Each of these happens only when you use the feature.

• Adding a playlist from your phone. The TV shows a code that opens a page served by the TV itself, on your local network. What you enter there, login included, or a playlist file you send, goes straight to the TV and nowhere else. That connection is not encrypted, so use it on a network you trust. The page closes after the first playlist is sent, or after ten minutes without use.
• Linking your devices. If you link your devices (Settings › Devices, part of Kepler Pro), what each one ticks there, logins included, goes between them over your local network and never over the internet, encrypted with keys that only your linked devices hold. So that they can find each other, a linked device with Kepler open, or a device showing or reading a pairing code, answers on your local network with the name you gave it and its model. A phone reads a pairing code with its camera, which Kepler uses only while the scanning screen is open; the picture is read in memory, and nothing of it is kept or sent.
• Casting. Casting a stream sends its address and title to the Chromecast you choose. For Xtream playlists that address contains your login.
• Recordings and downloads. From Kepler 1.1 they are saved to Kepler's own media folder, Android/media/com.keplerplayer.app, by default, where your gallery, file managers and other apps can see them. Turn off "Show files in other apps" in Settings to keep them private to Kepler. Either way, uninstalling Kepler deletes them. Kepler 1.0 saves them to the shared Movies/Kepler folder by default (turn off "Keep files in the Movies folder" to keep them private), where they stay after an uninstall until you delete them. Kepler's version is shown in Settings, under About.
• Speaking a search, on TVs. Speak in Search, or the microphone button on the remote, opens the TV's own speech recognition (Google's, on Google TV), which turns what you say into text under its provider's privacy policy. Kepler receives only the text, never the sound, and asks for no microphone permission.
• Open in another app and Share hand a stream address or file to the app you choose.

What we never receive

We do not receive your playlists, logins or viewing history, nor anything your linked devices send each other, and we do not sell data. The only identifiers involved are the one-way hashes in the trial record and the list of devices, and RevenueCat's anonymous id, and none is linked to your name, your email address or what you watch. There is no account to delete, because there is no account.

This website

keplerplayer.com serves static pages with no cookies, analytics, trackers or third-party scripts, and its fonts are served from the site itself. It runs on a server rented from Hetzner Online GmbH, a German hosting company, which handles your connection only to deliver the pages, and to answer the apps' time request. The site's web server is configured not to keep access logs.

Contact

Questions about privacy, or anything else: contact@keplerplayer.com.