Skip to content
Whatplay
Back to home

Privacy Policy

Last updated: November 5, 2026

This policy explains what data is processed by the Whatplay app (Android, Android TV, iPhone, iPad and Fire TV) and its website, for what purposes, and what rights you have. In short: you do not need an account, we do not see what you play and we do not sell your data.

1. Controller

The data controller is Veltrix Studios, the trade name of Iván Lozano Herrero (a self-employed sole trader), tax ID (NIF) 77836101F, with his address at Calle Flora, 4, 30626 Fortuna (Murcia), Spain. For any matter, including privacy, write to us at contacto@veltrixstudios.net. All our details are in the legal notice.

We process your data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (“LOPDGDD”).

2. What stays on your device

The lists you add, their addresses and passwords, your favorites, what you watch (“Continue watching”, Recent, your history), your browser bookmarks, your settings and your parental controls PIN are stored only on your device. We do not receive them and we do not know what you play. If you use sync, see section 3.4.

3. What data we process, why, and on what legal basis

3.1. Technical operating data

  • What: a random installation ID (not linked to your identity), the app version, the type of device (phone or TV), whether you have Premium, whether you have turned on “What’s new”, and usage counts (for example, how many ads have been shown or whether a purchase has been made).
  • Why: to make the app work (configuration and notices), to know how many installations are active, to measure ads and purchases, and to prevent abuse.
  • Legal basis: our legitimate interest in providing and improving the service. You can object by writing to us.
  • We do not store your IP address on the server: abuse limits use a hash that is deleted after one minute. The installation ID is stored as a hash (HMAC), not in plain text.

3.2. Notifications (“What’s new”)

  • What: your device’s notification token (Firebase Cloud Messaging, from Google) and its language, stored encrypted.
  • Why: to send you Whatplay news.
  • Legal basis: your consent. The token is stored only if you turn on “What’s new”, and it is deleted when you turn it off in Settings.

3.3. Ads

  • The free version shows ads from Google AdMob. Google may process your device’s advertising ID, your IP address and technical data to show, measure and limit ads.
  • Legal basis: in the European Economic Area, the United Kingdom and Switzerland, we ask for your consent through Google’s form (UMP). You can change your choice at any time in Settings › Ad privacy. Without consent, ads are not personalized.
  • More information: how Google uses data in ads. With Whatplay Premium, no ads are shown.

3.4. Sync (optional)

  • With Google: your lists, favorites and settings are saved in a hidden folder in your Google Drive that only Whatplay can access. They do not pass through our servers.
  • Legal basis: performance of the service you request when you turn on sync. You can sign out or use “Disconnect from Google” in the app, and delete the copy in Google Drive › Manage apps › Whatplay › Delete hidden app data.

3.5. Purchases

Subscriptions and purchases are made through Google Play (or your device’s app store). We do not receive your payment details, only the purchase status provided by the store, so that we can activate Premium. Legal basis: performance of the contract.

3.6. Updates and ratings

The app uses Google Play services to update itself and to ask you, from time to time, for a rating. Google processes that data in accordance with its own policy.

3.7. Support

If you write to us (by email or Telegram), we process what you send us in order to reply. Legal basis: your request. Please do not send us list links or passwords.

3.8. This website

This website uses no first-party cookies, no analytics and no advertising. Fonts and scripts are served from our own server. The server keeps technical logs (including IP addresses) for a short time, for security purposes.

3.9. Send to TV: linking your TV with your phone

  • What: so that your TV (whatplay.es/tv in its browser or the Whatplay TV Link app) can open Whatplay from your phone, they are linked with a 6-digit code. From the TV we process a random identifier, a hash of the key stored on the TV itself, the type of TV (browser, LG or Samsung) and the dates of linking and last use; from the phone, the hash of the installation identifier (section 3.1). While a TV is waiting for its code, a hash of your public IP address, computed with a secret key and without storing the IP, to show on the phone the TVs on your same connection. While you use “Send to TV” with a linked TV, your phone’s address within your Wi-Fi (with the size of that network), the port, the phone’s name and some single-use keys, encrypted. If the TV app reports its address within your home, it is only used to check that it is on the same network as the phone, without storing it; if it isn’t, the beginning of both networks (“192.168.1.x”) is stored, encrypted, for 2 minutes to let you know on the phone.
  • Why: to link the TV and let it open automatically. Legal basis: performance of the service you request when linking it.
  • Your lists and videos travel from your phone to your TV over your Wi-Fi, without going through our server: we do not know what you watch.
  • The TV app’s demo plays free-licensed films from public test servers (Mux and JW Player), only if you choose it.

4. What we do not do

  • We do not collect your lists, and we do not know what you watch.
  • We do not sell or pass on your data to third parties for commercial purposes.
  • We do not build profiles of you, except for the ad personalization carried out by Google if you give your consent.

5. Who we share data with

With service providers, which process the data on our instructions or as independent controllers under their own policies:

  • Google: AdMob, Firebase Cloud Messaging, Google Play and Google Drive.
  • Our hosting provider, in the European Union, acting as a processor: the server for the app and for this website.

Some of these providers may process data outside the European Economic Area (for example, in the United States). When they do, they rely on appropriate safeguards, such as the European Commission’s standard contractual clauses or the EU-U.S. Data Privacy Framework.

6. How long we keep data

  • Technical data for each installation: deleted after 13 months without using the app. Each day’s active installations are kept for 100 days. Usage counts are kept only as daily totals, without identifying anyone.
  • Notification token: until you turn off “What’s new”, or after 270 days without using the app.
  • Support messages: for as long as needed to assist you, and for 2 years at most.
  • Send to TV: the code, 10 minutes; your phone’s address in your Wi-Fi and its keys, 2.5 minutes after you stop using it; the link, until you forget it (Settings › TV on the phone or “Forget phones” on the TV) or after 400 days without use; a TV that never gets linked, one hour.

7. Your rights

You can request access to your data, its rectification, erasure, restriction or portability, object to its processing, and withdraw your consent at any time. To do so, write to contacto@veltrixstudios.net or use “Request data deletion” in the Terms of Use. Because much of the data is anonymous or pseudonymous, we may need your installation ID to find it.

Exercising your rights is free of charge. We will reply within one month; this may be extended by two further months if the request is complex or we receive many, in which case we will tell you within the first month.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD, C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es) or with the supervisory authority of the EU Member State where you live or work. If you wish, write to us first and we will try to resolve it.

8. Children

Whatplay is not directed at children under 16. If a minor uses it, they must do so with the permission and supervision of their parents or guardians, who can turn on parental controls. We do not knowingly collect data from minors.

9. Security

Communications with our server are encrypted (HTTPS). Tokens are stored encrypted, and identifiers are stored as hashes. No system is infallible, but we apply reasonable measures and review them.

10. Changes

If we change this policy, we will publish the new version here with its date. If the change is significant, we will let you know in the app.