Privacy Policy

Effective date: 7 October 2026

Summary: The developer of Melyro operates no servers, creates no accounts, shows no ads and runs no analytics, tracking or crash reporting of its own. The sources you add and your settings are stored only on your device. Data goes only to the provider/server you choose, to the Cast device you choose when you use Chromecast, to Google through the Google Cast SDK, and to RevenueCat to verify Melyro Pro purchases.

1. Data controller

Cenk Gün (individual developer), Türkiye
E-mail: support@melyro.app

2. What Melyro is

Melyro is a media player and includes no content: no channels, films, series, playlists or provider directory. You add your own M3U playlist (file or URL), your Xtream-compatible provider login (server address, username, password), or your own Jellyfin/Emby server, and Melyro only plays that source. Melyro is not affiliated with any provider.

3. Data stored on your device

The following stays on your device only and is never sent to the developer:

the addresses of the sources you add;
credentials such as username and password (in the iOS Keychain);
the catalogue cache (the list loaded from your source);
watch history and playback positions, favourites, channel customizations;
the parental-control PIN and player preferences;
external subtitle files you pick for a film.

4. Data sent to the provider or server you configure

To load the catalogue and play streams, Melyro sends your credentials and the necessary requests directly to the provider or server you configured. This data does not pass through the developer. That provider's own privacy policy applies.

If you enter an http:// address, data (including credentials) travels unencrypted. Use https:// where possible.

TV guide: programme information is likewise fetched directly from your provider, from the XMLTV address your playlist names, or from a guide address you enter, and it is cached only on your device. An address you enter is stored in your device's Keychain.

4a. iCloud sync and Handoff (optional, Melyro Pro)

If you turn on iCloud sync, some data is written to your own iCloud account and carried to your other devices signed in with the same Apple Account. It stays in your account on Apple's servers; the developer cannot access it and nothing is sent to any Melyro server.

iCloud key-value storage: per source, favourites, where you left off and recently watched items (by the provider's item and channel IDs), your channel arrangement (hidden channels and categories, names you gave channels, order), the kind of source, and your Home, channel layout and player preferences.
iCloud Keychain (end-to-end encrypted): the server address, username, password or playlist address needed to add your sources again on another device.
Not synced: the parental-control PIN and locked categories, catalogue content and titles, stream addresses, and the contents of playlists added from a file.

With Handoff, the identity and position of what you are watching (no credentials or addresses) are passed to your nearby device through Apple's Handoff. You can turn sync off at any time in Settings → iCloud Sync; doing so removes this device's sign-ins from iCloud Keychain.

4b. Programme reminders

If you set a reminder for a programme, the notification is scheduled only on your device (a local notification) and is not sent anywhere.

5. Chromecast (Google Cast SDK)

Melyro uses Google's Google Cast SDK for Chromecast support.
Local network permission is requested only when you tap the Cast button, and is used only to discover Cast devices and send the stream you choose to the device you choose.
The stream address is sent to the receiver device, which uses Google's Default Media Receiver.
According to Google's disclosures, the Google Cast SDK itself collects coarse location, device ID, product interaction and other diagnostic data. This data is used for analytics and app functionality, is not linked to your identity, and is not used for tracking.
This data may be processed by Google outside Türkiye and the European Economic Area. Details: Google Privacy Policy.

6. AirPlay, Picture in Picture and CarPlay

These are Apple system features and are subject to Apple's own privacy terms.

7. Diagnostics

Melyro keeps a diagnostics log on your device. It excludes server addresses, usernames, passwords and channel/content names. Nothing is sent automatically; only you can export the log through the share sheet (for example, to e-mail it to us for support).

Apple's MetricKit may provide the app with anonymous performance metrics; these stay on your device unless you export them.

8. In-app purchases

Melyro Pro (a subscription or a one-time purchase) is sold through Apple's in-app purchase system, and Apple processes the payments. The developer receives no payment data. Whether Pro is active is read from the purchase record Apple gives your device.

To verify your purchases and keep Pro active after a reinstall, Melyro uses RevenueCat, Inc. (USA), which acts on the developer's behalf. RevenueCat receives: a random, anonymous identifier created by the app; the App Store purchase records for Melyro Pro (product, dates, price and currency, App Store country); and technical information such as the app and operating system version. Your name, e-mail address and Apple Account are not sent, and Melyro has no accounts. The developer can see these anonymous purchase records in RevenueCat's dashboard and does not match them to a person. Details: RevenueCat Privacy Policy.

9. Children

Melyro is not directed at children under 13 and performs no processing aimed at children.

10. Retention

Data remains on your device until you remove the source, delete it in the app, or delete the app.

11. Legal bases

Providing the service you request (playing your source): KVKK Art. 5(2)(c), GDPR Art. 6(1)(b).
Google Cast SDK diagnostics: legitimate interest, KVKK Art. 5(2)(f), GDPR Art. 6(1)(f).
Verifying Melyro Pro purchases through RevenueCat: performance of a contract, KVKK Art. 5(2)(c), GDPR Art. 6(1)(b).

12. International transfers

When you use Chromecast, data collected by the Google Cast SDK may be processed by Google abroad (KVKK Art. 9, GDPR Chapter V). The developer has no access to this data.

Melyro Pro purchase records and the anonymous identifier are processed by RevenueCat in the USA to verify purchases (KVKK Art. 9, GDPR Chapter V).

If you turn on iCloud sync, the synced data may be stored abroad by Apple through the iCloud service of your own Apple Account. This transfer happens at your request and within your account; the developer has no access to this data.

13. Your rights

Under KVKK Art. 11 and GDPR Arts. 15–22 you have rights including access, information, rectification, erasure, restriction, objection and data portability. Send requests to support@melyro.app.

Because the developer holds no personal data about you, requests will mostly be answered by explaining how to delete the data on your device (see Support: delete all data). For data collected by the Google Cast SDK, you can contact Google.

You have the right to lodge a complaint with the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) or, if you are in the EU, with your local supervisory authority.

14. Changes

If this policy changes, the updated text will be published on this page with a new effective date.