Privacy policy

Zapa Player collects no personal data, carries no advertising or measurement, and has no servers of its own. What you type stays on your device.

Last updated: 28 August 2026

In one line

Zapa Player is an empty player: it includes no channels, no lists and no subscriptions. You supply the details of the service you already pay for, the app connects to that service and to no other, and those details never leave your device.

What the app stores, and where

Everything below lives only on your device. None of it is sent anywhere.

What	How it is stored	What for
The address, username and password of your service	Encrypted against the device's own keystore. The encryption key never leaves the secure hardware, so a copy of the file carried to another device decrypts nothing	So you aren't asked for them every time you open the app
Your favourites, what you watched last, the categories you have hidden and their order	In ordinary preferences, unencrypted: they are channel numbers and there is nothing sensitive in them	So the app behaves the way you left it
The channel catalogue your service sends you	In a temporary file on the device	So opening the app doesn't take time to draw the list

Who it talks to

The service you configure. You type the address yourself. Neither the author of Zapa Player nor any third party receives a copy of what you request or what you watch.
Google Play, only if you decide to buy the full version. Google handles the purchase from start to finish: the app merely asks whether this account has bought it or not. We never see your payment method, your name or your address.
Whoever hosts the channel logos, if your service serves them from another domain. These are image requests made by your device to the server your own service points at.
epgshare01.online, only in the full version and only for the stitched guide: the schedule Zapa Player fills in by itself when your service leaves channels without programme data. It downloads a public XMLTV file for the countries you have selected, once a day at most and never over mobile data. That server sees your device's IP address and which country file you asked for. Nothing about you is sent to it: not who you are, not your service, not what you are watching.
local-ip.sh, only if you cast to a Chromecast. The Chromecast receiver requires HTTPS, and no certificate authority signs certificates for an address on your home network, so the app downloads a public certificate from there — a few kilobytes, once every several weeks — so that the server it runs on your own device can speak HTTPS. The video does not pass through there, or anywhere else: it goes from your service to your device and from your device to the Chromecast, over your home wi-fi.

What there isn't

There are no accounts. There is nothing to sign up for and no email address to give.
There is no advertising and no ad networks.
There is no measurement or analytics: no Google Analytics, no Firebase, no advertising identifiers, no third-party trackers.
There are no servers of ours. There is nowhere we could send your data to, because there is nowhere at all.
Nothing is sold or shared with anyone — among other reasons, because nothing is collected.

How to delete everything

By uninstalling the app. Uninstalling removes the encrypted credentials, the preferences and the stored catalogue. Nothing remains anywhere else, because there never was anything anywhere else.

Without uninstalling, inside the app itself, Settings → Change service deletes that service's credentials, and under My lists any saved list can be removed.

There is no account to close and no data to request: no database of Zapa Player users exists.

The permissions it asks for, and why

Permission	What for
`INTERNET`	To connect to the service you configure. Without this the app can do nothing at all
`ACCESS_NETWORK_STATE`	To know whether there is a connection, so it can explain a failure instead of going black
`WAKE_LOCK`	To keep the device from falling asleep while a video is playing
`ACCESS_WIFI_STATE` `CHANGE_WIFI_MULTICAST_STATE`	To find the Chromecast on your own network. Discovery works by multicast, and without these permissions no TV appears in the list. Your wi-fi password is not read and your location is not inferred
`FOREGROUND_SERVICE` `FOREGROUND_SERVICE_MEDIA_PLAYBACK`	To keep casting alive while you use other apps. Android requires declaring it and showing a notification for the whole time it lasts
`POST_NOTIFICATIONS`	To tell you a programme you marked is about to start. You are asked the first time you set a reminder, and you can say no
`RECEIVE_BOOT_COMPLETED`	To restore your reminders after the device restarts: the system clears them on shutdown
`com.android.vending.BILLING`	To ask Google Play whether this account has bought the full version. Google handles the purchase entirely

It does not ask for the camera, the microphone, your location, your contacts, access to your files, or the list of installed apps.

Children

Zapa Player is declared on Google Play for users aged 18 and over. It is not directed at children and it knowingly collects data from nobody, child or otherwise.

Responsibility for content

Zapa Player is a playback tool. It does not include, host or distribute audiovisual content of any kind. What you see depends entirely on the service each person configures, and it is that person's responsibility that the service they use is legitimate.

Changes to this policy

If it ever changes, this same page and its date will be updated. If a change ever affected data leaving the device — which today it does not — notice would be given inside the app before it happened.

Contact

For any question about this policy, or about the app in general: info@zapaplayer.com

We reply in English and in Spanish.