Privacy policy

Last updated 9 October 2026

LUMA TV keeps only what it needs to link your TVs and deliver your playlists to them. We do not show ads, do not use tracking or analytics tools, and do not sell data.

Who is responsible

LUMA TV (the TV apps, the dashboard at lumatv.app and the server behind them) is operated by , Serbia, who is the data controller. Contact: .

What we collect

Your account

  • Name and email address of a cloud account. A guest account has neither.
  • Password and parental PIN, stored only as one-way hashes (Argon2).
  • Plan and its dates (trial start and end, expiry), and the reseller who manages your account, if any.

Your TVs

  • Device model, platform, app version and screen resolution.
  • An installation ID created by the app, and a hashed hardware identifier (on Android, the Android ID). They keep a TV linked to your account after a reinstall and enforce the number of TVs your plan allows.
  • The IP address and the time a linked TV last reached our server (once a minute while the app is open).

Your playlists

  • Playlist addresses, usernames, passwords and portal MAC addresses you add. Passwords are encrypted on the server (AES-256-GCM).
  • Uploaded M3U files, and the channel lists our server downloads from your provider to deliver them to your TVs.
  • Your category, visibility and parental choices per TV.
  • An optional TMDB API key you add, stored encrypted.

Security records

  • Sign-ins, password changes and changes to TVs and playlists, kept in an audit log so we can investigate abuse.

What stays on your TV

Favourites, the last channel, watch progress, settings and playlists you type directly on a TV without an account stay on that TV and are not sent to us. On Android TV, the "Continue watching" row is written to the TV's own home screen.

This website

To show this site in Serbian or English, our server checks which country your IP address belongs to, using public address registrations. Only the country is used and nothing is stored on the server; your browser remembers the result and the language you pick.

What we do not collect

We do not collect your location, contacts, payment details, advertising ID or what you watch. The apps contain no advertising, analytics or tracking libraries.

Why we use it

PurposeLegal basis
Running your account, linking TVs and delivering your playlistsPerforming our agreement with you
Enforcing the number of TVs per plan, preventing abuse, keeping the audit logOur legitimate interest in a secure service
Movie details through your own TMDB keyYour consent; remove the key at any time

Who else receives data

  • OVH (France, EU) hosts our server and database.
  • Google Drive stores our daily backups. They are encrypted before they leave the server; Google cannot read them.
  • Your playlist provider. Your TV and our server connect to the provider you add, which sees the IP address and the credentials you gave it. Their own privacy policy applies.
  • TMDB (The Movie Database) supplies movie details through our server. Your TV loads posters directly from TMDB, which sees its IP address.
  • YouTube plays a trailer when you open one (in privacy-enhanced mode).
  • Google Fonts supplies the typeface of this site and the dashboard.

We share nothing else, and we never sell or rent personal data. We disclose data to authorities only when the law requires it.

How long we keep it

  • Account, TV and playlist data: until you delete the playlist, unlink the TV or delete the account.
  • Pairing codes expire after a few minutes; sign-in sessions expire or end when you sign out.
  • Encrypted backups: daily backups for 30 days and monthly backups for 12 months. Data you delete disappears from them when they expire.

Your rights

You can ask for a copy of your data, have it corrected, deleted or restricted, object to its use and take it to another service. You can change most data yourself in the dashboard and delete your account there at any time. For anything else, write to ; we answer within 30 days.

You may complain to the Commissioner for Information of Public Importance and Personal Data Protection of Serbia (poverenik.rs) or to the data protection authority where you live.

Children

LUMA TV is not directed at children under 13, and we do not knowingly collect their data. Parents can lock categories with the parental PIN.

Security

All traffic between the apps, the dashboard and our server uses HTTPS. Passwords and PINs are hashed, provider passwords and keys are encrypted, and backups are encrypted with a key that is not stored on the server.

Changes

When this policy changes, we update the date above, and we tell you in the app or the dashboard before an important change takes effect.