Privacy Policy

**Last updated: 7/6/2026

This Privacy Policy explains what personal data we collect when you use this service, why we collect it, and the rights you have over it. In this policy, "we", "us" and "the service" refer to the operator of this Guidearr installation. If you are in the EU/EEA or UK, we are the "data controller" for your personal data.

**Who we are / contact: RockMyM3U.com / help@rockmym3u.com

What we collect

• Account details — your email address and a securely hashed password when you register and sign in.
• Security data — your IP address and request metadata, used to rate-limit playlist access, throttle failed logins, and keep server security logs. If you enable two-factor authentication, we store your 2FA secret and recovery codes.
• Your content — the IPTV providers you add (including the provider URLs and credentials you enter) and the playlists you build. We store these so the service can fetch and serve your feeds.
• Cookies — see our Cookie Policy for the small number of strictly-necessary cookies we set.

Signing in with Google or Facebook (optional)

If we offer sign-in with Google or Facebook and you choose to use it, those providers send us a limited set of information to create or match your account — typically your name, email address, and a provider account ID. We do not receive your Google or Facebook password. We use this only to authenticate you and run your account. Google and Facebook process your use of their sign-in under their own privacy policies. You can disconnect this at any time by deleting your account (below) or contacting us.

Why we process it (legal bases)

• To provide your account and the service — performance of our contract with you (account data, your providers and playlists, social sign-in).
• Security & anti-abuse — our legitimate interest in protecting the service (IP-based rate limiting, login throttling, server logs, CAPTCHA).
• To verify your email — performance of our contract / our legitimate interest in valid accounts.

We do not use your data for advertising, profiling, or automated decision-making, and we do not sell it.

Who we share it with

• Cloudflare — we use Cloudflare Turnstile to tell humans from bots on our sign-in and registration forms; your browser contacts Cloudflare and it may set a security cookie. Some page assets may also load from Cloudflare's CDN. Cloudflare acts as our processor/service provider.
• Google / Facebook — only if you use their optional sign-in, as described above.
• Our hosting/email providers — the infrastructure and email service we use to run the site and send verification messages.

Some of these providers are based outside the EU/EEA (e.g. the United States). Where that is the case, transfers are covered by appropriate safeguards such as the providers' Standard Contractual Clauses or Data Privacy Framework certification.

How long we keep it

We keep your account data for as long as your account exists. Security logs and IP rate-limit records are kept only for a short rolling window. When you delete your account, we remove your account data and your stored providers/playlists.

Your rights

If you are in the EU/EEA or UK you have the right to access, correct, erase, restrict, object to, and port your personal data, and to withdraw consent where processing is based on consent. You can delete your account and its data yourself from your account settings, or contact us to exercise any of these rights. You also have the right to lodge a complaint with your local data-protection supervisory authority.

Changes

We may update this policy from time to time; the "last updated" note above reflects the current version.