Privacy Policy

This Privacy Policy explains how Nefarius Apps Bilgi Teknolojileri Limited Şirketi (“Nefarius Apps”, “we”, “us”) handles information when you use the Tivi app for iPhone and iPad, the Tivi app for Android, and this website, tivi.nefarius.co. We are the data controller (“veri sorumlusu”) under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”) and, where it applies, the controller under the EU and UK General Data Protection Regulation (“GDPR”).

Nefarius Apps Bilgi Teknolojileri Limited Şirketi, Fatih Sultan Mehmet Mah. Balkan Cad. Meydan İstanbul AVM No:62A, 34771 Ümraniye/İstanbul, Türkiye (MERSIS 0630141599800001). Email: [email protected].

Words defined in our Terms of Use have the same meaning here.

Tivi in Short

• There is no account and no sign-in. We never ask for your name, email address or phone number in the app.
• Finding and controlling your TVs happens on your local network. Your TV list, pairing keys and settings stay on your device.
• To understand how the app is used, find crashes and manage subscriptions, the app sends usage, device and purchase information to the service providers named below, tied to random identifiers rather than to your name.
• Tivi shows no ads. We do not sell your data and do not use it to target ads at you.
• You can ask us to delete your data at any time by email; see “Deleting Your Data”.

What Stays on Your Device

To find your TVs, Tivi searches the Wi-Fi network your phone or tablet is connected to: it listens for devices that announce themselves (for example over Bonjour/mDNS) and asks the addresses on that network whether a supported TV answers. On iPhone and iPad this needs the Local Network permission; on recent versions of Android it needs the local network access permission. The search, and every command you send — a button press, text you type on the TV keyboard, volume or playback — goes directly from your device to your TV over your local network. It does not pass through our servers and we do not receive it.

The TVs you save (their name, model, brand and local network address), the pairing keys your TVs issue, your settings and your choices in the app are stored only on your device. Deleting a TV in the app, or deleting the app, removes them. If you use your device's backup (iCloud or Google), your device may include them in that backup under your own account.

Notifications from Tivi — the trial reminder and the lock-screen remote — are scheduled and shown by your device. You can turn them off in your device's settings at any time.

Identifiers We Use

• User ID: a random identifier the app creates on first launch. It contains nothing about you, and you can see it at the bottom of Settings in the app (tap it to copy it). It links your crash reports, and on iPhone and iPad also your analytics and purchase records, together.
• App instance ID: a random identifier that Google's Firebase creates for each installation.
• Advertising identifier: the IDFA on iPhone and iPad, only if you allow tracking (see “Advertising Identifier”), and the Android advertising ID on Android.
• On Android, purchases are tied to a random identifier that RevenueCat creates for each installation.

What We Collect and Why

Firebase Analytics (Google) — iPhone, iPad and Android. Collects how the app is used: when it is first opened, sessions, screens viewed, updates and in-app purchases; together with the app instance ID, the advertising identifier where available, device model, operating system and app version, language, and an approximate location (country, region and city) derived from your IP address. We use it to count users and see which features are used, so we can improve the app.

Firebase Crashlytics (Google) — iPhone, iPad and Android. When the app crashes or hits a serious error, it sends a crash report: the technical details of the error, device model, operating system and app version, device state such as free memory and storage, your User ID, and a log of what the app did just before the error. That log can include the names, models and local network addresses of your TVs. We use crash reports only to find and fix problems.

Mixpanel — iPhone and iPad. Records how you use the app, tied to your User ID: app launches, onboarding, TV connections (including the type and name of the TV), the remote buttons you press and how many characters you type (never the text itself), paywall views and purchases, and your choices about the trial reminder and the tracking prompt. Mixpanel also derives an approximate location from your IP address. We use it to understand which features help people and where they get stuck.

App Store Operator — iPhone and iPad. Our own analytics service. It receives app events (such as the app being opened, onboarding steps, TV connections, remote use and subscription changes) with a random per-installation identifier, your User ID, app version, operating system version, device model and language, plus the country derived from your connection. The IP address is used only to work out the country and is not stored. We use it to measure how the app and its store listing perform.

RevenueCat — iPhone, iPad and Android. Manages Tivi Premium: it receives your purchases, subscriptions and free trials from the App Store or Google Play (product, price, currency, dates, renewal and refund status, store country), with your User ID on iPhone and iPad or RevenueCat's random identifier on Android, and your device's operating system and app version. We use it to unlock and restore Premium, to manage trials and to see how subscriptions perform. RevenueCat also receives the marketing campaign that brought your install, if there was one: on iPhone and iPad, the Apple Ads attribution token; on Android, the campaign details Google Play passes to the app at install (source, medium, campaign, keyword, ad content and Google Ads click ID). We use these to measure which of our own marketing campaigns lead to installs and subscriptions.

Payments. Purchases are made and paid through Apple's App Store or Google Play under their terms and privacy policies. We never receive your card details, name, email address or billing address. Refunds are handled by Apple or Google.

If you email us, we receive your email address and whatever you choose to write, and use them only to answer you.

Analytics and crash reporting are on in the versions of Tivi published on the App Store and Google Play. The app does not offer a switch to turn them off; the choices you do have are described under “Advertising Identifier” and “Your Rights”.

Advertising Identifier

Tivi does not show ads, does not sell your data, does not share it with data brokers and does not use it to target ads at you in Tivi or elsewhere.

On iPhone and iPad, after your first TV search Tivi asks for permission to track (Apple's App Tracking Transparency). Only if you allow it can Firebase Analytics read your device's advertising identifier (IDFA), which we use for analytics: to count installs and users accurately and to see which of our campaigns bring people to the app. If you do not allow it, the IDFA is not read and everything else in the app works the same. You can change your answer at any time in Settings › Privacy & Security › Tracking.

On Android, Firebase Analytics reads your device's advertising ID for the same analytics purposes. You can reset or delete your advertising ID at any time in your device's settings (Settings › Privacy › Ads, or Settings › Google › Ads, depending on the device); once it is deleted, apps receive a string of zeros instead of an identifier.

This Website

tivi.nefarius.co exists to describe the app. There is no account to create and no form to fill in, and the site sets no cookies. To learn which pages people read and which buttons lead them to the app stores, we count visits with two cookieless analytics tools: Umami, which we host ourselves, and Cloudflare Web Analytics. They record the page you view, the site that referred you, your browser, device type and language, your country and your clicks on the store buttons. Your IP address is used only to work out your country and to group page views into one visit — it is not stored, and none of this identifies you or follows you to other sites. We do not sell this data or use it for advertising. Apart from that, the only information we receive from this site is whatever you choose to send us by email.

The site links out to the App Store, Google Play and our support address. Once you follow one of those links you are using a service we do not operate, and that service's own policy applies.

Legal Bases

• Providing the app and Premium — unlocking, restoring and managing your purchases: performance of a contract (KVKK Article 5(2)(c); GDPR Article 6(1)(b)).
• Crash reports, security, analytics and measuring our marketing campaigns: our legitimate interest in keeping the app working and improving it, balanced against your rights (KVKK Article 5(2)(f); GDPR Article 6(1)(f)). You can object at any time (see “Your Rights”).
• Reading the IDFA on iPhone and iPad: your consent through the tracking prompt, which you can withdraw in your device's settings (GDPR Article 6(1)(a)).
• Keeping purchase records that tax and commercial law require: legal obligation (KVKK Article 5(2)(ç); GDPR Article 6(1)(c)).

Who Processes Your Data

We do not sell or rent your data. We share it only with service providers that process it on our behalf and under our instructions, for the purposes above:

• Google (Google LLC and Google Ireland Limited) — Firebase Analytics and Firebase Crashlytics.
• Mixpanel, Inc. (United States) — product analytics on iPhone and iPad.
• RevenueCat, Inc. (United States) — purchase and subscription management.
• Amazon Web Services (Frankfurt, Germany) and Cloudflare, Inc. — hosting and network delivery for App Store Operator and this website.

Apple and Google also process your purchases as independent controllers under their own privacy policies. We may disclose information if the law, a court or a competent authority requires it, or to protect our rights or the safety of others.

International Transfers

Our service providers store and process data outside Türkiye, including in the United States and the European Union. These transfers rely on the safeguards the law provides, such as the European Commission's standard contractual clauses that these providers offer, and, for data transferred from Türkiye, on the conditions of Article 9 of KVKK.

How Long We Keep Data

• Data on your device: until you delete it in the app or delete the app.
• Analytics data (Firebase Analytics, Mixpanel, App Store Operator): at most 14 months from collection, after which it is deleted or kept only in aggregate form that no longer relates to a person. App Store Operator deletes events automatically after 13 months.
• Crash reports (Firebase Crashlytics): 90 days.
• Purchase and subscription records (RevenueCat): while you have a subscription, and afterwards only as long as tax and commercial law requires, up to ten years.
• Emails you send us: as long as needed to answer you and resolve the matter.

Your Rights

Under Article 11 of KVKK you have the right to learn whether your personal data is processed; to request information about it; to learn the purpose of the processing and whether it is used accordingly; to know the third parties to whom it is transferred in Türkiye or abroad; to have it corrected if incomplete or inaccurate; to have it deleted or destroyed under the conditions of Article 7; to have third parties to whom it was transferred notified of a correction or deletion; to object to a result against you that arises solely from automated analysis; and to claim compensation for damage caused by unlawful processing.

If the GDPR applies to you, you also have the right of access, rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting earlier processing.

To use any of these rights, email [email protected] and include the User ID shown at the bottom of Settings in the app. We answer within 30 days, free of charge. If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) or, in the EU or UK, to your local data protection authority.

Deleting Your Data

Because Tivi has no accounts, deletion is by request:

• Email {email} with the subject “Delete my data”.
• Include your User ID (Settings in the app, at the bottom — tap it to copy). If you bought Premium on Android, also include the order number from your Google Play receipt (it starts with “GPA.”), so we can find your purchase records.
• Within 30 days we delete the data linked to those identifiers at Firebase Crashlytics, Mixpanel, App Store Operator and RevenueCat, ask our providers to do the same, and confirm by email. We keep only the purchase records that tax and commercial law require us to keep, for the period they require.

Some analytics data is linked only to the random app instance ID that Firebase creates, which we cannot see or match to your request; it is deleted automatically under “How Long We Keep Data”. Deleting the app removes everything stored on your device and, on reinstall, the app starts with new random identifiers. Deleting the app does not cancel a subscription: cancel it in your App Store or Google Play subscriptions.

Children

Tivi is a general-audience app and is not directed at children under 13. We do not knowingly collect personal data from children under 13 (or under the age of digital consent in your country, such as 16 in parts of the EU). If you believe a child has provided personal data through the app, contact us at [email protected] and we will delete it.

Security

Everything the app sends to our service providers travels encrypted (HTTPS/TLS). Communication between your device and your TV stays on your local network and uses the protocol your TV supports, some of which are not encrypted by the TV's maker. We limit access to the data to the people who need it. No method of transmission or storage is completely secure, but we work to protect your data with commercially reasonable measures.

Links to Other Sites

The app and this website contain links to services we do not operate, such as the App Store, Google Play and your TV maker's pages. Their own privacy policies apply, and we are not responsible for their content or practices.

Changes to This Privacy Policy

We update this policy when the app or the law changes, and change the date at the top when we do. If a change significantly affects how we use your data, we will also tell you in the app or on this page before it takes effect.

Contact Us

For questions about this policy or your data, contact us at [email protected], or by post at Nefarius Apps Bilgi Teknolojileri Limited Şirketi, Fatih Sultan Mehmet Mah. Balkan Cad. Meydan İstanbul AVM No:62A, 34771 Ümraniye/İstanbul, Türkiye.