Privacy Notice

Effective date: 24 October 2026.

1. Controller and scope

The controller is Giovanni Caroni, Via alla Ramogna 4, 6600 Locarno, Ticino, Switzerland. Privacy contact: support@4191.ch. This notice concerns Eterivo for Mac, iPhone and iPad, including its beta versions, and assistance for this app. Features may differ by version, subscription and platform. Eterivo is a player: it does not supply television channels or playlists and does not require an Eterivo account. This notice does not replace Apple's or your chosen providers' notices, or govern other apps linked from the same website.

2. Data and purposes

• Local library: source configuration, content names and metadata, categories, variants, favourites, manual matches, rules and settings used to organise and play your library.
• TV guide: EPG data, channel mappings, programmes, recently opened channels and reminders used to display schedules and arrange local notifications.
• Viewing history and resume: recently played items, playback dates, saved positions and durations are stored in the local library to show History and resume films and episodes, including when opened elsewhere in the library. They are not sent to the Publisher or included in iCloud snapshots. Local database backups include these records; Apple device backups may also include them.
• Secrets: sensitive operational addresses, credentials, TMDB tokens and content keys are managed through Keychain; operations may temporarily use them in memory. We do not claim that the application encrypts every item on your device.
• PIN: the adult-content PIN verifier is local in Keychain and excluded from snapshots. Biometrics or device-credential authentication are handled by the operating system; Eterivo receives an outcome, not fingerprints or face templates. Filtering uses playlist category labels, not video or audio analysis. Labels may be absent or inaccurate: unrecognised adult content can remain visible even with the switch off. Neither the filter nor the PIN verifies age or guarantees protection for minors.
• Saving declarations: when you declare a right to download or record, a local Keychain record stores the source binding, operation, declaration basis, reference you provide, wording version, language and local date. The current record and a bounded event history document your choice, not independently verified rights, identity or a trusted timestamp. These records are not sent to the Publisher or included in iCloud snapshots or Keychain synchronisation. Permission information supplied by a source can remain in its original playlist content and copies made through the app's backup or snapshot features.
• Viewing allowance (Free version): a small local record on the device holds the calendar month, the viewing time used in it and a latest-date marker used to keep the month consistent. It contains no titles, channels, addresses or identifiers. The app does not synchronise it with iCloud and keeps it out of snapshots and local backups; like other app files it may be included in device backups made by Apple. It is never sent to the Publisher or to any server.
• Files: imported playlists, caches, downloads, recordings and local backups support the requested features. Exported files can be retained or shared outside the app under your control.

3. Network connections and recipients

Opening a source or playing content connects your device to servers specified by that source, including redirects and CDNs. They may receive IP addresses, requests, technical information and credentials required for service. Channel logos and EPG images may come from separate hosts. The Publisher does not determine every such provider's retention or practices. Unencrypted HTTP, if enabled, may expose data and credentials on the network.

When TMDB enrichment is enabled, automatic and manual searches may transmit titles, year when used, type and language; detail requests use TMDB identifiers. The TMDB token is sent to that service to authenticate API calls. Poster and backdrop requests reach image servers and may expose your IP address and the requested image. These TMDB calls do not send complete playlists or IPTV credentials. Turning off the option stops future searches dependent on it but cannot withdraw data already received by third parties.

4. Apple and iCloud

Snapshot features transfer data through explicit publishing, checking for new collections and downloading actions. Collections may contain source configuration, favourites, rules, EPG configuration, metadata preferences, manual TMDB correction identifiers and playlist content admitted by the feature. Poster caches, complete EPG schedules, Guide history, viewing history, resume positions, reminders and the Free viewing-allowance record are not part of these snapshots. Keychain synchronisation is a separate option and can transfer credentials, TMDB tokens and content keys through Apple; the adult PIN remains local. Switching synchronisation off does not promise global deletion. Removing a local source does not remove previously published collections. In Settings, under “Copies of Your Data”, you can delete published collections — from this device and, when iCloud synchronisation is on and iCloud is reachable, from iCloud — and local backups; this does not require Premium. A deletion is shown as pending until iCloud confirms it. Reminder notifications are local, but their text can appear on a locked screen according to Apple settings. Apple services have their own terms and privacy notice.

For subscriptions, Apple processes purchases and payments. Eterivo uses StoreKit transaction and entitlement information, such as product, validity and expiry, to unlock features and restore purchases. The app does not receive your card or bank details. Apple may make purchase, subscription and diagnostic reports available to the Publisher under its developer services. TestFlight may also provide crash reports and feedback you submit through Apple.

5. Retention and deletion

Library data and settings persist until changed or removed; Guide history can be cleared from “My TV”. Viewing history is pruned according to your selected limit (10, 20, 30, 40 or 50 items) and age setting (1, 7, 30 or 90 days, or no age expiry). Removing a History entry or reaching its age or count limit does not delete its resume position. Resume records are kept separately, subject to the local capacity limit, until cleared or their source is removed. The History settings offer a separate confirmed action to clear both history and resume positions. Previously made backups retain their copies until deleted. Saving declarations retain the current record and up to 20 recent events per source and operation. Revoking a declaration removes the current permission but retains a revocation event; removing its source removes these local records. The reviewed metadata cache has a combined 128 MiB budget and a configured 30-day expiry: expired entries are removed on the next cache operation, including entries not requested again, and less recent entries may be removed sooner to meet storage limits. The app cannot run cleanup while it is not executing. “Clear Cache” does not remove manual corrections, downloads, Keychain items, backups, snapshots or the Free viewing-allowance record. Downloads and recordings have no automatic application expiry; backups and exported files may remain after other deletions. Local backups are never deleted automatically; you can delete them in Settings, under “Copies of Your Data”. Uninstalling does not guarantee removal of Keychain items, iCloud data or external files. Support correspondence is kept for 12 months after the request is closed, unless a legal obligation requires longer retention. Information subject to such an obligation is retained only for the required period and purpose. Apple and your chosen providers apply their own retention policies to data they hold.

6. Diagnostics and support

Eterivo does not include advertising or a dedicated third-party analytics or crash-reporting service. This does not determine the independent practices of Apple or your chosen providers. The app uses system diagnostics. You may voluntarily send information to support. Do not send passwords, tokens, private playlists or sensitive complete URLs: system logs may contain information that the app has not redacted. Diagnostics shared through Apple depend on Apple's options and the Publisher's access. Support messages may contain your email address, name, message, attachments and technical details you choose to provide; they are used to respond and troubleshoot, not for advertising. The support mailbox serves only the apps listed on 4191.ch and the website itself. Its stored support correspondence is hosted in Switzerland. Email delivery also involves the providers used by you and the recipient; this is not a promise that every transit connection remains in Switzerland.

7. Rights and international transfers

Where applicable law provides, you may request access, correction, deletion, restriction or portability, object to processing, withdraw consent and contact the competent supervisory authority. Contact support@4191.ch. Withdrawal does not make earlier processing unlawful. The Publisher cannot arbitrarily inspect or delete data held only on devices or third-party services. Procedures and deadlines follow applicable law. You may complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or your competent local data-protection authority.

Swiss hosting of support does not mean all app-related data stays in Switzerland. Apple operates internationally, including in the United States; its privacy notice describes international processing and applicable safeguards. TMDB is operated by TiVo Platform Technologies LLC; consult its privacy policy before enabling it. TMDB and source, guide, image and email providers may process data outside Switzerland or the EEA. The countries depend on the service you choose, its infrastructure and any redirects. Eterivo does not route your library through a Publisher-operated streaming or metadata server. Optional connections are initiated from your device; you can stop future use in the app or remove the source. This choice does not waive mandatory transfer protections or your rights.

8. Changes and minors

New features or recipients require notice review and, where necessary, an additional choice or consent. A PIN does not establish that the app is suitable for children. Minimum age and any parental authorisation depend on law and the distributed version's age classification.

We update this notice when the app's data practices change, with additional notice and choices where required. The effective date above identifies this version. Reading this notice is not consent to optional features.

9. Reasons for processing and your choices

We process information needed to provide the app, verify purchases and answer support requests to perform the service you request. Where data-protection law requires a legal basis, this is performance of a contract or steps requested before one; necessary troubleshooting, security and handling of claims may rely on legitimate interests, balanced against your rights, and legally required records on legal obligations. Optional title sharing with TMDB, iCloud features and notification permissions use your separate choices and, where required, consent. You may withdraw consent for future processing through the relevant app or system setting, without affecting prior lawful processing.

Without optional services, the corresponding features will not operate. You can still use local features subject to the app's subscription and viewing limits. No automated decision with legal or similarly significant effects is made about you by Eterivo. We do not sell personal data or use it for cross-app advertising.