Privacy policy

Last updated: 31 October 2026

This policy covers the Family Filter TV Android app (TV and phone) and the Family Filter TV iPhone app. It explains what an account involves, what we store, how payment works, and what the third-party services the app relies on see. It's written in plain language on purpose.

What Family Filter TV does

Family Filter TV works with supported Stremio playback and automatically mutes unwanted language according to the filter profile you choose. To support playback and filtering, the app may use Stremio metadata and subtitle services. Those services are operated by third parties, not by Family Filter TV. Family Filter TV is not affiliated with Stremio, Google, Apple, or OpenSubtitles.

Your account

Since version 0.2, using Family Filter TV requires an account, created with Firebase Authentication using either an email address and password or Google sign-in. On iPhone you can also use Sign in with Apple; Apple may give us a private relay address instead of your real email, and we use whichever address we are given. Accounts are for the parent or adult setting up filtering for the household — see "Children" below. The TV itself never asks you to type a password: you sign in on your phone and activate the TV with a short code generated by the TV, which expires after 2 minutes.

What we store

Against your account we store:

• Your email address and the Firebase user id created for your account.
• A record for each device linked to your household: a device id generated by the app, the device model, a name you give it, its kind (TV or phone), and when it was last seen.
• Link-code records used to activate a TV from your phone. These expire 2 minutes after creation.
• For a TV, a yes/no flag saying whether it has notification access, so your phone can tell you if it needs turning on.
• A snapshot of your subscription status (active/expired and renewal date) used to unlock filtering and to help with support queries.
• If you join with an invite code, we store which household invited you. The person who invited you can see your first name if you signed in with Google, otherwise your email address with the middle hidden (for example j•••@gmail.com), and whether you are on a trial or subscribed — never your full address.
• When you open an invite link we count the open against that code; nothing about you is stored.

This data is stored in Google Cloud / Firebase, in the europe-west1 region. We do not store your card or payment details — see "Payments" below.

Payments

Subscriptions are billed through Google Play Billing (Android) or Apple's in-app purchase (iPhone) and managed by RevenueCat, a subscription-management service. RevenueCat receives your Google Play purchase token or Apple purchase receipt and your Firebase user id, so it can tell us whether your subscription is active — it does not receive your card details, and neither do we. No card, bank, or payment-card information ever reaches Family Filter TV's own servers.

Network requests during playback

Besides our own account and billing systems, Family Filter TV may contact third-party Stremio services needed for supported playback and filtering:

Family Filter TV does not upload the video or audio you watch to our servers. Subtitle data used by the filtering feature is handled on-device and may be cached locally to avoid unnecessary repeat requests. That local cache is not uploaded to Family Filter TV.

Usage analytics (app)

The app uses Google Analytics for Firebase to count how the app is used, so we can see which devices and versions people use and whether it keeps working for them. It records things like app opens, session length, screens viewed, subscription purchase events (which plan and its price, never card details), app version, device model, Android or iOS version, and an approximate country worked out from a masked network address. Each install gets a random app-instance id; it is not your name, email or advertising ID, and we do not link it to your account.

• We switched off advertising ID collection and ad personalisation signals, and we do not share this data with Google for advertising.
• Google Analytics does not receive what you watch, subtitle text, your filter words, or anything the phone hears during listen-to-sync. The follow-mode data described below goes only to our own household storage, never to Google Analytics.
• Google processes this data for us as a service provider under the Firebase data processing terms. Detailed event data is kept for two months; after that only totals remain.

No advertising, no selling data

Family Filter TV contains no advertising SDK and does not use an advertising ID. We do not sell your data, or any data about your household, to anyone, for any purpose.

Launch updates sign-up (website)

The website can offer a short form to get launch updates by email. You do not need an account or the app to use it.

• What we store: the email address you type, the date you signed up, and which page of the website you signed up from (for example the home page or the download page).
• Why: only to email you about Family Filter TV launch updates. We do not sell or share the list, and we do not use it for anything else.
• Where: in the same Google Cloud / Firebase project as the app, in the europe-west1 region.
• Unsubscribe: every email will have an unsubscribe link, or you can reply to ask to be removed.
• Deletion: email jacquesjdupreez@gmail.com from the address you signed up with and we will delete it.

Website visit counter (no cookies)

This website counts visits in a simple way that does not follow anyone. It sets no cookies and stores nothing in your browser. It is a counter, not a profile of you.

• What is counted: the page address without anything after a question mark, a one-word referrer category (direct, search, social, this site or other, never the full address you came from), and how often the links to the Google Play listing, the direct download and the sign-up form are used.
• What is not stored: no IP addresses, no cookies, no device or browser identifiers, and nothing that lets one visit be matched to the next.
• Your choice: if your browser sends Do Not Track or Global Privacy Control, the counter sends nothing at all.
• No third parties: the counts are kept in the same Google Cloud / Firebase project as the app, in europe-west1. No third-party analytics or advertising service is used for it.

The website's fonts are hosted on our own site, so no font requests go to Google.

Notification-listener access

On an Android TV, follow mode (below) needs Android's notification-listener permission to read what another app is currently playing. You are asked to grant it explicitly in Android's system settings. The app does not have this access until you turn it on yourself, and you can revoke it at any time from Android's notification-access settings. It reads media-session information (what's playing, not notification content), and it never reads the text of your notifications. Settings → Diagnostics, a compatibility check screen, exists only in test builds of the app, not in the versions you install from Google Play, the App Store or this website.

Following another app on your TV (beta)

Follow mode lets Family Filter TV mute swearing while you watch in another app on your Android TV. It uses the same notification-listener access described above, which you grant yourself, and reads, from the TV's media session, which apps are playing, their playback position and state (playing, paused), and the title, id and length, only to check that the same show is still on. Nothing it reads is stored by us beyond the follow data below, and it never reads notification text.

• Follow data, synced between your phone and TV. While you follow something we store in your household account: the title, IMDb id, season and episode you picked on your phone, which streaming app you are following, the subtitle file (its id, address and language), the playback position and status, and the timing offset. This is how your phone and TV stay in step. Only devices signed in to your household can read it. Each new session replaces the last, and it is deleted with your account.
• Microphone (phone only). When the TV or computer cannot tell where you are in a film, your phone finds the place by listening. Once you have allowed the microphone, the phone starts listening by itself when you follow a title, and keeps listening while the Follow screen is open so it can correct itself after a pause or a skip. It only listens while the Follow screen is open and something is playing, never in the background. The sound is turned into words on the phone itself and compared there with the subtitles. No audio and no words are stored or sent anywhere. The speech model is downloaded once from its publisher and runs offline. On iPhone the same job is done by Apple's on-device speech recognition (iOS asks for Microphone and Speech Recognition access), and the audio is not recorded, stored or sent. You can press Stop at any time, or deny or remove the microphone permission in your phone's settings; follow mode with a TV app that reports its own position still works without it.
• Windows computer (early beta). The Windows app also listens to the computer's own sound output, to catch spoken swearing that the subtitles miss. That sound is processed on the computer itself and is not stored or sent anywhere.
• Shared timing, to help other families sync. When a household confirms the timing of a subtitle file, we store the subtitle file id, the streaming app, the timing offset (milliseconds) and a one-way code made from your account id. The code cannot be turned back into your account, and no account id is stored. We also store votes on how a streaming app numbers a season's episodes. These are used only when at least three households agree, and they stop counting after 90 days. They are removed when you delete your account. The one exception is the plain timing number in the shared subtitle table, which stays because it cannot be traced to you.
• Wi-Fi TV muting. The phone looks for your Samsung or LG TV on your home network (iOS asks for Local Network access). We store only the TV's brand and model and counts of how well muting worked.

Direct-install updates

Copies of Family Filter TV installed directly (not through Google Play) check a small version file hosted on this site to see if an update is available. That check does not send any personal data — only the app's own version number, to compare against the latest one published.

How long we keep your data, and deleting your account

We keep your account and device records for as long as your account exists, and your subscription snapshot for as long as needed to support billing queries. To delete your account and the data we hold about it, email jacquesjdupreez@gmail.com from the address on the account. In the Android app and in the iPhone app you can also delete your account yourself: open the Account tab and tap Delete account. The steps, what is deleted and what is kept are on the account deletion page. Cancelling your subscription in Google Play or your Apple Account settings stops billing but does not by itself delete your account, and deleting your account does not cancel your subscription, so cancel there first.

When an account is deleted, the sign-in and the household are deleted, but a few records are kept for a fixed time because of a legal or abuse-prevention reason, and then deleted by a job that runs every day: 2 years for a one-way hash of the email address and of the device id with the date and kind of the free week (the user id is removed from it, so a deleted account cannot be recreated to collect another one, under POPIA section 11(1)(f)); 5 years for paid creator commission records, which hold the amount the subscriber was charged, the tax and store shares, the commission owed, the currency, the date, the creator's code and the store transaction id against the account's old random user id, with no name or email (a commission record that is not paid yet is kept until it is paid), and for the purchase-event log, which holds that user id, the event type, the product and the time, with no email and no price. Those records still contain the old user id, which we can no longer match to you through the app. Shared timing votes, a plain number filed under a hash of the user id, are kept with no deletion date, because removing old votes would let one new vote overwrite the timing other households share. Totals that hold no personal data are not deleted. The account deletion page lists them and how long each is kept.

Your rights

This app is operated from South Africa and this policy is written with South Africa's Protection of Personal Information Act (POPIA) in mind. We collect only what's needed to run your account, activate your devices, and confirm your subscription (see "What we store" above). You can ask us at any time what we hold about you, ask us to correct it, or ask us to delete your account — email jacquesjdupreez@gmail.com.

Children's privacy

Family Filter TV accounts are for parents and other adults (18+) setting up filtering for the household, in line with the target-audience declaration on our Google Play listing. The app itself does not collect data from the children watching — filtering happens on-device, and only the account holder's details (above) are stored against the account.

Changes to this policy

If this policy changes, the "Last updated" date above will be updated and the change described here before it takes effect.

Contact

Questions about this policy, or to delete your account: jacquesjdupreez@gmail.com
Jacques du Preez, South Africa.