Nodus IPTV privacy policy

Repository policy dated 5 November 2026. Website adaptation under review; not yet effective.

Who we are

Nodus IPTV ("Nodus", "the app") is published by Nodus Limited, registered in England and Wales under company number 17423184. You can reach us at info@nodus-ltd.co.uk.

What Nodus is

Nodus is a player for LG webOS TVs. It does not provide channels, films, series or any other content. You add playlists from a provider you are authorised to use, and Nodus shows them on your TV. The app also includes a small demo library that plays a bundled sample video.

What is stored, and where

When you add a playlist, Nodus saves the following on your TV, in the app's own storage:

• the playlist name;
• for an Xtream account: the server address, your username and your password;
• for an M3U link or file: the parsed playlist entries, including their stream addresses and any access tokens in those addresses; the original file is not kept, and an M3U download link is used only for that import, not saved for automatic refresh;
• the channels, films and series listed by your provider (the catalogue);
• your profiles (name, colour, Adult or Kids, age limit and country), and for each profile its watch history and playback progress, favourites and preferences (for example sort order and the last channel you watched);
• the optional household PIN, saved only as a salted hash, and the allow and block rules a parent sets for kids profiles;
• a cache of film and series details looked up from TheTVDB and Wikidata (see below), and the age ratings found there;
• if you turn on the programme guide for a playlist: programme titles and times for that playlist's channels and, for an M3U playlist, the guide address named in the playlist;
• subtitle files you choose to download from OpenSubtitles (see below), with your timing adjustment: at most 100 files, and a file not used for 30 days is removed;
• restore points you save in Settings: a copy of your profiles, favourites, watch history and preferences. They never contain logins, playlist addresses, the PIN or the catalogue.

These saved records stay on your TV. The app sends the requests described below to load playlists, play streams and look up metadata. The PIN is a household lock to keep children out of adult profiles and settings. It is not strong security: someone with access to the app's storage on the TV can remove it.

Your password and stream addresses are saved as files in the app's private storage. They are not encrypted with hardware protection. Anyone who can access the app's storage on the TV could read them.

What is sent, and to whom

Nodus connects to the services you point it at:

• the provider server you enter for an Xtream account, to log in and to load your catalogue and streams;
• the M3U playlist URL you enter, to download that playlist for the import; the destination receives the request and any credentials or tokens included in the URL;
• the stream hosts named in your playlist or returned by your provider, to play a channel, film or episode, and artwork hosts named by those sources to load images;
• if you turn on the programme guide for a playlist: your Xtream provider's guide address, with your username and password as that provider requires, or the guide address named in your M3U playlist.

To show film and series details and to find age ratings for kids profiles, Nodus also connects to:

• the Nodus metadata service at https://nodus-metadata.nodus-media.workers.dev, which we run on Cloudflare Workers and which forwards requests to TheTVDB (thetvdb.com). Nodus sends a cleaned film or series title, its year, its type (film or series), a language code and, when your playlist provides them, the title's IMDb or TMDB id. It does not send your provider address, username, password, stream addresses, playlist name, profile names or a watch-history record. However, the titles requested and request timing can reveal viewing interests. Requests happen when you open a title's Insights tab and, in the background, for a small number of titles (at most 60 per run and 500 per day), such as the ones you recently watched, your favourites and recently added titles;
• TheTVDB's image servers, to load posters for those titles;
• Wikidata (wikidata.org), for film age ratings that TheTVDB does not have. Nodus sends the IMDb or TMDB id and makes follow-up entity and label requests, with the app version in its request identification.

Services contacted directly receive your IP address and ordinary request information. The Nodus metadata service receives your IP address; the reviewed proxy does not forward client IP headers to TheTVDB. It holds IP addresses in memory to limit request rates and caches answers by title so repeated lookups do not reach TheTVDB. The rate window is not an IP-deletion deadline. The reviewed application code has no request logging, accounts or analytics; Cloudflare infrastructure logging and retention must be confirmed separately. Cloudflare, TheTVDB and Wikidata handle request data under their own policies. Demo titles are never looked up.

Your playlist and stream servers see standard request data, such as your IP address and the resource you request, and your Xtream username and password when you log in. URLs may also contain access tokens. How these servers use that data is covered by their own policies, not this one. On the TV, use an M3U link; file selection is available in browser preview, where the selected file is read locally. Imports can continue while you browse inside the app. Nodus does not automatically refresh a saved M3U link.

When subtitles are configured in the release build and you open Subtitles during playback and choose a language, Nodus searches OpenSubtitles (opensubtitles.com) directly from your TV. It sends the title's IMDb or TMDB id when your playlist provides one, otherwise a cleaned title and year, plus season and episode numbers for series and the language you chose. When you pick a result, it downloads that file. It does not send your provider details, stream addresses, playlist name or profile names. Nodus never searches subtitles on its own; a subtitle you chose before plays from the saved copy. OpenSubtitles sees your IP address and handles request data under its own policy.

If you email support, Nodus receives your email address, message and any attachments. This correspondence and the metadata-service request processing described above are separate from records stored locally on your TV. Do not send provider passwords, playlist URLs or access tokens.

What Nodus does not do

• No analytics, usage statistics or crash reporting.
• No advertising.
• No tracking across apps or sites.
• No Nodus account or sign-in. Profiles and the PIN exist only on your TV.
• We do not sell your data. The service requests and processing described above still occur.

Children

Nodus is a general-audience app. It includes kids profiles that a parent or guardian creates and sets up. A kids profile shows only titles that look suitable for its age limit, based on age ratings from your playlist, TheTVDB and Wikidata, kids group names, and the parent's own allow and block rules. Titles with no rating are hidden unless a parent allows them or they belong to a recognized kids group with that option enabled. This filtering is a best effort: ratings can be missing or wrong, and providers name their groups in many ways, so a parent should check what a kids profile shows. Without a PIN, a child can switch to another profile.

Kids profiles are a convenience filter, not a guarantee. Nodus does not provide, review or rate any content. A kids profile shows a title when a parent allowed it, or when its age rating is within the profile's age limit; if your provider and TheTVDB or Wikidata disagree, the higher rating counts. A title with no rating is shown only if it is in a group recognised as a kids group and the parent turned that option on. Titles a parent blocked are always hidden, and titles marked as adult are hidden unless a parent allowed them. Ratings and group names come from third parties and can be missing or wrong, so unsuitable content can still appear. Parents and guardians remain responsible for what children watch.

Kids profiles send the same metadata requests as any other profile, and nothing about the profile itself. The metadata service processes the request information described above, including when a kids profile is used.

Retention and deletion

Your data stays on the TV until you remove it:

• Choose Delete on a playlist to remove its saved details (including the username and password) and its catalogue from the TV.
• Delete a profile in Manage profiles to remove its history, favourites and preferences.
• Turning the programme guide off stops guide downloads for that playlist. Its saved guide data is removed when you delete the playlist.
• Choose Remove in the subtitle menu to delete a title's saved subtitles.
• Delete a restore point in Settings.
• In Manage profiles, choose Clear movie insights cache to remove saved movie and series insights. Separately stored age ratings used by kids profiles are retained; clearing insights does not reset those ratings.
• Use the in-app deletion controls before uninstalling. Do not rely on uninstalling as a secure erasure of locally stored data.

Because we hold no copy of your device-local records, we cannot recover or remotely delete those records for you. Restore points must be deleted separately because they can contain copies of profile information. For requests about support correspondence or personal information processed by our infrastructure, contact us using the address below.

Security

Credentials are stored as app-local files, not in hardware-encrypted storage. Connections to your provider use whatever address you enter; if you enter an http:// address, your login and streams travel without encryption and can be read on your network. Use https:// where your provider supports it. Anyone with access to your TV, your home network or your provider account may be able to see or misuse the data described above. No system is completely secure, and we cannot guarantee absolute security.

Credits

Film and series metadata is provided by TheTVDB (https://thetvdb.com). Some age ratings come from Wikidata (https://www.wikidata.org), available under CC0. Subtitles are provided by OpenSubtitles.com (https://www.opensubtitles.com). Nodus is not endorsed by any of them.

Changes to this policy

If this policy changes, we will update the effective date above and publish the new version at the same address. Material changes will also be mentioned in the app's store listing.

Contact

Questions about this policy: info@nodus-ltd.co.uk.