Skip to content
Whatplay
Back to home

Privacy Policy

Last updated: November 4, 2026

This policy explains what data is processed by the Whatplay app (Android, Android TV, iPhone, iPad and Fire TV) and its website, for what purposes, and what rights you have. In short: you do not need an account, we do not see what you play and we do not sell your data.

1. Controller

The data controller is Veltrix Studios, the trade name of Iván Lozano Herrero (a self-employed sole trader), tax ID (NIF) 77836101F, with his address at Calle Flora, 4, 30626 Fortuna (Murcia), Spain. For any privacy matter, write to us at soporte@whatplay.es; for anything else, at contacto@veltrixstudios.net. All our details are in the legal notice.

We process your data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (“LOPDGDD”).

2. What stays on your device

The lists you add, their addresses and passwords, your favorites, what you watch (“Continue watching”, Recent, your history), your browser bookmarks, your settings and your parental controls PIN are stored only on your device. We do not receive them and we do not know what you play. If you use sync, see section 3.4.

3. What data we process, why, and on what legal basis

3.1. Technical operating data

  • What: a random installation ID (not linked to your identity), the app version, the type of device (phone or TV), whether you have Premium, whether you have turned on “What’s new”, and usage counts (for example, how many ads have been shown or whether a purchase has been made).
  • Why: to make the app work (configuration and notices), to know how many installations are active, to measure ads and purchases, and to prevent abuse.
  • Legal basis: our legitimate interest in providing and improving the service. You can object by writing to us.
  • We do not store your IP address on the server: abuse limits use a hash that is deleted after one minute. The installation ID is stored as a hash (HMAC), not in plain text.

3.2. Notifications (“What’s new”)

  • What: your device’s notification token (Firebase Cloud Messaging, from Google) and its language, stored encrypted.
  • Why: to send you Whatplay news.
  • Legal basis: your consent. The token is stored only if you turn on “What’s new”, and it is deleted when you turn it off in Settings.

3.3. Ads

  • The free version shows ads from Google AdMob. Google may process your device’s advertising ID, your IP address and technical data to show, measure and limit ads.
  • Legal basis: in the European Economic Area, the United Kingdom and Switzerland, we ask for your consent through Google’s form (UMP). You can change your choice at any time in Settings › Ad privacy. Without consent, ads are not personalized.
  • More information: how Google uses data in ads. With Whatplay Premium, no ads are shown.

3.4. Sync (optional)

  • With Google: your lists, favorites and settings are saved in a hidden folder in your Google Drive that only Whatplay can access. They do not pass through our servers.
  • With Apple: an encrypted copy is stored on our server, in the European Union. From your Apple account, we store only a hash of its identifier, not your email address.
  • Legal basis: performance of the service you request when you turn on sync. You can sign out and delete the copy in Settings › Sync.

3.5. Purchases

Subscriptions and purchases are made through Google Play (or your device’s app store). We do not receive your payment details, only the purchase status provided by the store, so that we can activate Premium. Legal basis: performance of the contract.

3.6. Updates and ratings

The app uses Google Play services to update itself and to ask you, from time to time, for a rating. Google processes that data in accordance with its own policy.

3.7. Support

If you write to us (by email or Telegram), we process what you send us in order to reply. Legal basis: your request. Please do not send us list links or passwords.

3.8. This website

This website uses no first-party cookies, no analytics and no advertising. Fonts and scripts are served from our own server. The server keeps technical logs (including IP addresses) for a short time, for security purposes.

4. What we do not do

  • We do not collect your lists, and we do not know what you watch.
  • We do not sell or pass on your data to third parties for commercial purposes.
  • We do not build profiles of you, except for the ad personalization carried out by Google if you give your consent.

5. Who we share data with

With service providers, which process the data on our instructions or as independent controllers under their own policies:

  • Google: AdMob, Firebase Cloud Messaging, Google Play and Google Drive.
  • Apple: “Sign in with Apple”.
  • Our hosting provider, in the European Union, acting as a processor: the server for the app and for this website.

Some of these providers may process data outside the European Economic Area (for example, in the United States). When they do, they rely on appropriate safeguards, such as the European Commission’s standard contractual clauses or the EU-U.S. Data Privacy Framework.

6. How long we keep data

  • Technical data for each installation: deleted after 13 months without using the app. Each day’s active installations are kept for 100 days. Usage counts are kept only as daily totals, without identifying anyone.
  • Notification token: until you turn off “What’s new”, or after 270 days without using the app.
  • Apple sync copy: until you delete it. Sessions expire after one year without use.
  • Support messages: for as long as needed to assist you, and for 2 years at most.

7. Your rights

You can request access to your data, its rectification, erasure, restriction or portability, object to its processing, and withdraw your consent at any time. To do so, write to soporte@whatplay.es or use “Request data deletion” in the Terms of Use. Because much of the data is anonymous or pseudonymous, we may need your installation ID to find it.

Exercising your rights is free of charge. We will reply within one month; this may be extended by two further months if the request is complex or we receive many, in which case we will tell you within the first month.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD, C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es) or with the supervisory authority of the EU Member State where you live or work. If you wish, write to us first and we will try to resolve it.

8. Children

Whatplay is not directed at children under 16. If a minor uses it, they must do so with the permission and supervision of their parents or guardians, who can turn on parental controls. We do not knowingly collect data from minors.

9. Security

Communications with our server are encrypted (HTTPS). Tokens and copies are stored encrypted, and identifiers are stored as hashes. No system is infallible, but we apply reasonable measures and review them.

10. Changes

If we change this policy, we will publish the new version here with its date. If the change is significant, we will let you know in the app.