Privacy Policy
Last updated: 2026-10-02
What changed on 2 October 2026: the retention periods in §8 now apply by themselves. A licence that has ended — expired or revoked, paid or the free trial — is deleted with its devices six months after the end. An account with no live licence and no activity for twelve months is deleted with everything in it; we do not send a warning first. Records of failed sign-in and code attempts are deleted 30 days after the last failure. §8 now also says how long backups last.
What changed on 28 September 2026: the sealed email address (§1) now has a second use — letting the operator recognise your account when you write to support — and a third one you choose yourself: if you press «Notify me» on the giveaway page, we email you when the next giveaway opens. We now keep the address from the moment you buy, not only from your next sign-in. We also corrected §2.1: Stripe gives us your address, not a hash of it. Two retention periods overstated what we keep: audit events are kept 400 days, not 7 years, and API logs up to 7 days, not a year. We added what was missing: the legal basis of each email (§4), sign-in records (§2.3), device names and the free-trial record (§2.2, §8), and the reseller program (§2.7).
Data controller: Zbelthas, sole proprietor, Italy
Contact: privacy@limpido.app
We designed Limpido around the idea that software should work for you, not on you.
1. The honest summary
- No telemetry by default. Limpido installs silently and does not send us anything unless you explicitly opt in.
- We look you up by a hash of your email, and keep the address itself sealed. Everything we look you up by is a one-way hash — your address never appears in our database in readable form. We also keep the address sealed with a key we hold, for three purposes only. First, sending you a security warning if a sign-in method is added to or removed from your account, or if someone signs in from a network we have never seen on it: without an address we would have no way to reach you outside the account someone had just taken over. Second, support: when you write to us, the operator (and nobody else) can see which account is yours. Third, only if you ask for it by pressing «Notify me» on the giveaway page: one email when the next giveaway opens, until you press «Stop notifying me». It is opened only for those three things, never for profiling, it is never shared, and it is deleted when you delete your account (§8).
- We never see your videos or what you watch. The content-script runs locally; it never calls home.
- We do see the minimum needed to deliver your license. One-way hashes of your device fingerprint so we can enforce the device limit.
- We follow GDPR. You have rights over your data, listed in §7.
2. What we collect
2.1 Purchase data (via Stripe)
Stripe collects your email, payment method, billing country, IP, and transaction history. We receive from Stripe: a customer ID, product/price ID, transaction amount, and your email address, which we store only as a one-way hash plus the sealed copy described in §1. For customers who bought before 28 September 2026, the operator may ask Stripe for that address once, to seal it the same way; it is kept only if it matches the account.
2.2 License activation data
A one-way hash of a stable device identifier (SHA3-256 of MAC, CPU vendor, disk serial). Your OS and CPU architecture. Timestamps and a random install ID. The name you give a device, if you type one: only your account sees it.
So that the free trial is used once per device and not once per email address, we also keep the device hash, with the date the trial was claimed, for 12 months. If you delete your account, that record is detached from it and ages out on its own: deleting it would reset the trial.
2.3 Operational data (Cloudflare)
Request logs at Cloudflare retain IP addresses for up to 7 days for anti-abuse. Our API logs store request ID, route, status code, duration — never IP, email, or license key.
Sign-ins, refused sign-ins, lockouts and changes to your sign-in methods are recorded in an audit log: the method, a one-way hash of the IP and the network (ASN) — never the IP itself. Kept 400 days (§8).
2.4 Optional telemetry (OFF by default)
If enabled: app version, OS version, aggregate feature counts, crash reports (stack trace only, no memory/disk/URLs).
2.5 IPTV module — credentials and watch state
When you import an Xtream Codes account, the password is AES-256-GCM-encrypted before it touches the disk; the key is wrapped in the OS keyring (macOS Keychain, Windows DPAPI, Linux Secret Service) and never leaves your machine. M3U URLs and Xtream hosts are stored verbatim. Stream URLs are routed through a loopback HTTP proxy bound to 127.0.0.1 so the WebView never receives cleartext credentials.
Per-channel state — favorites, watch progress, recently-watched, stream-health attempts, EPG cache
— lives entirely in the local sled databases (playlists_db and epg_db under the app data dir). Nothing is uploaded to our servers; we have no record
of which channels you watch, when, or for how long.
2.6 Library sync (OFF by default, end-to-end encrypted)
If you turn sync on, your playlist definitions, favorites and resume positions are carried between the devices of your account. They are encrypted on your device with AES-256-GCM before they leave it, and the key never reaches us: we store one blob we cannot open, its version, its size, and a copy of your key wrapped under a 120-bit recovery code that exists only in your hands. A second device is let in either by approving it from a device you already use — the key travels sealed under an X-Wing (X25519 + ML-KEM-768) exchange we only relay — or by entering that recovery code.
This does not change §3 below. We still never see your IPTV provider's hostname, your Xtream username or your password: they are inside the encrypted blob. There is no administrative procedure, key escrow or recovery path on our side that could reveal them, which also means a lost recovery code with no enrolled device left is not something we can undo. Turning sync off, or deleting your account, deletes the stored blob.
2.7 Reseller program
If you join as a reseller, we keep the display name, the contact email you give us — in readable form, because it is a business contact — and your application note. The credit ledger holds only account IDs, amounts and payment references, and is kept 10 years as an accounting record. Your customers' addresses are never shown to you.
3. What we do not collect
Your name, postal address, browsing history, video activity, tracking cookies, or your IP beyond what Cloudflare needs to serve the request. We do keep your email address, sealed, for the three uses described in §1 — that is the one exception, and it is deleted with your account. Specifically on the IPTV side: we never see your IPTV provider's hostname, your Xtream username/password, the channels in your playlist, or what you watch. Every IPTV fetch goes from your machine directly to the provider you configured. With sync enabled (§2.6), what we hold is ciphertext we have no key for — the same sentence still holds.
4. Legal basis (GDPR)
- Contract performance (Art. 6(1)(b)): processing necessary for license delivery, recognising your account when you ask for support, the giveaway slot you claim, and the reseller program.
- Legitimate interest (Art. 6(1)(f)): anti-fraud, the free-trial record, audit logs, kill-switch, and the security warnings of §1.
- Consent (Art. 6(1)(a)): optional telemetry, crash reports, library sync, and the giveaway «Notify me» email.
- Legal obligation (Art. 6(1)(c)): keeping invoices and the reseller ledger.
5. Recipients and sub-processors
| Purpose | Provider | Location | Safeguards |
|---|---|---|---|
| Payment | Stripe Payments Europe, Ltd. | Ireland | SCCs + DPA |
| Hosting + CDN | Cloudflare, Inc. | Global (EU-preferred) | SCCs + DPA |
| Resend, Inc. | US | SCCs + DPA |
No data is sold. No data is shared with advertisers.
6. International transfers
All transfers rely on Standard Contractual Clauses (SCCs) and supplementary measures including TLS + hybrid post-quantum encryption.
7. Your rights (GDPR Chapter III)
- Access (Art. 15) — request a copy of your data.
- Rectification (Art. 16) — correct inaccurate data.
- Erasure (Art. 17) — delete your data (fiscal law exceptions).
- Restriction (Art. 18) — restrict processing during disputes.
- Portability (Art. 20) — receive data in machine-readable format.
- Object (Art. 21) — object to legitimate-interest processing.
- Withdraw consent at any time: telemetry and sync from the app settings, «Notify me» from the giveaway page.
- Complain to the Garante per la Protezione dei Dati Personali — garanteprivacy.it.
Self-service paths:
- Erasure (Art. 17) — visit Account → Settings → Danger zone (web) or the same page in the desktop app, and click Delete my account permanently. We immediately cancel any active Stripe subscription, wipe your account row (cascades to licenses, devices, sessions, TOTP secret, backup codes, passkeys, preferences), and revoke every trusted-device cookie. Past Stripe invoices are retained for 10 years under Italian fiscal law (Codice Civile art. 2220); audit-log events are retained for 400 days (§8) for security obligations under GDPR Art. 17 §3(b).
- Portability (Art. 20) — same page, Export my data. Downloads a JSON file containing your account row, licenses, devices, sessions metadata, TOTP enrolment status (without the secret), passkey metadata (without public keys), preferences, trusted-browser counts, Stripe invoices, giveaway claims and «Notify me» status, the free-trial record, and the reseller account and ledger if you have one. Credential material is intentionally excluded — it is one-way and useless to import elsewhere.
For every other right — and for the carve-outs we keep (e.g. fiscal-law invoice retention) — email privacy@limpido.app. We respond within 30 days.
8. Retention
| Data | Retention |
|---|---|
| Your account: email hash, settings, sign-in methods | Until you delete it. With no live licence and no activity — no sign-in, no app or device checking in — for 12 months, it is deleted automatically with everything in it, without notice. A reseller account (§2.7) is not deleted for inactivity, because its unused credit would be lost with it: it goes when you delete it |
| Licences, device hashes | While the licence is live (a Lifetime, for life), then 6 months after it ends — by expiry or revocation — and deleted automatically |
| Sealed email address (§1) | Life of the account — deleted with it |
| Library sync (§2.6) | Until you turn sync off, or the account is deleted |
| «Notify me» for giveaways (§1) | Until you turn it off, or the account is deleted |
| Giveaway slot you took | With the licence it gave you; on account deletion the slot stays counted, no longer linked to you |
| Invoice records | 10 years (Italian fiscal law) |
| Support emails | 12 months |
| Edge access logs | 7 days |
| API logs | Up to 7 days (Cloudflare Workers Logs); no archive |
| Audit events, sign-in records | 400 days — including the pseudonymous ids of an account deleted in the meantime |
| Failed sign-in and code attempts | 30 days after the last failure |
| Free-trial record (§2.2) | 12 months from the claim; on account deletion it stays, no longer linked to you |
| Reseller ledger (§2.7) | 10 years (accounting records) |
| Optional telemetry | 24 months; aggregated after 6 |
| Database backups (encrypted) | 30 nights, plus Cloudflare's own point-in-time copy for 30 days. Deleted data leaves them as they age out |
9. Security
Hybrid classical + post-quantum cryptography throughout: Ed25519 + ML-DSA-65 for signatures; X25519 + ML-KEM-768 for key exchange; AES-256-GCM at rest.
10. Contact
- Privacy: privacy@limpido.app
- Security: security@limpido.app (PGP encouraged)
- Billing: billing@limpido.app