Rivulet privacy policy

Effective 2026-11-07 — applies to version 1.3.3.

Applies to Rivulet for phones (app.rivulet) and Rivulet for TV (app.rivulet.tv), from that version until replaced. Each release publishes its own copy of this page; earlier versions stay available under /privacy/ followed by the version number.

1. Who we are and what this document covers

Rivulet is an empty media player. It ships with no content, no channels and no providers, and you add your own source. This policy covers the two apps, which are distributed on Google Play and the Amazon Appstore. We run no server, no account system and no website that the apps talk to; this page itself is hosted on GitHub Pages.

2. What Rivulet stores on your device

Everything below stays on your device:

the login or playlist address you enter, in Android's encrypted storage (a key held by the Android Keystore protects it);
a cache of your provider's catalog (channels, movies, series, guide data) in a local database in the app's private storage. The app does not encrypt this database itself; it relies on the operating system's file encryption;
your preferences;
your favourites, resume positions, and hidden or sorted channels;
cached channel logos and posters.

3. Where it goes

Nowhere that we can see. Rivulet itself connects to the server address you entered, and to the stream and artwork addresses that your provider's own responses name. It has no analytics, no crash reporting and no account of its own, and nothing is sent to us. On the phone app, Google's advertising component also talks to Google (section 4); the TV app contains no advertising component.

There is one further request you should know about. When you play a live stream in the DASH format, Rivulet can ask a public time server, time.android.com, for the current time, so that playback stays in step. This request is made by the Media3 playback library that Rivulet includes, not by us; it contains none of your login, playlist, provider or viewing details. Like any internet request, it is visible to the operator of that time server together with your device's network address.

Permissions: Rivulet asks for Internet access, network-state access, and the keep-awake permission (WAKE_LOCK) that WorkManager uses so a refresh is not cut short. On the phone it also has the advertising-ID permission that Google's advertising component declares; you can reset or delete the advertising ID in Android settings. On TV it also asks, when you first open Local media, for permission to read videos on the TV and its drives. It does not ask for location, microphone, camera or contacts, and it asks for no other access to your files.

Rivulet's own code writes nothing to the device log in release builds, and your login never appears in any log.

On the phone app only, one small banner may appear at the bottom of browse and list screens. It is shown by Google's advertising component (the Google Mobile Ads SDK), not by us. It never appears during playback, picture-in-picture or casting, in a restricted profile, or on TV. The TV app contains no advertising component, and its store listing says so. The phone app also includes Google's consent component (the User Messaging Platform SDK). Neither loads until Home has been on screen for a few seconds. The advertising SDK carries Google's analytics interface stubs, which stay inert: no analytics library is included.

To show the banner, Google's component contacts Google's ad servers, and a banner can load images from the advertiser's servers. Google, not Rivulet, receives the data its component collects. As Google publishes it for this component, that is: identifiers (the advertising ID and an app-set ID), your device's IP address and the approximate location it implies, your interactions with ads, and diagnostics; used for advertising, analytics and fraud prevention, and encrypted in transit. We follow Google's published list, checked at each release (Google's disclosure page for its Mobile Ads SDK: https://developers.google.com/admob/android/privacy/play-data-disclosure). Google's own privacy policy governs what it does with that data: https://policies.google.com/privacy.

This applies to the phone app even if you play only files from your own device and have added no provider: the app still contacts Google, first to learn whether a consent form is needed and then, once you have chosen or no choice is needed, for the banner. Nothing is requested while you play, and nothing is requested before Home has been on screen for a few seconds.

Rivulet adds nothing of yours to an ad request: no playlist, server address, login, channel, file name, viewing history or search, and Rivulet adds no targeting to ad requests.

Where the law requires it, Rivulet asks for your consent through Google's consent form before any ad is requested. If you decline, no ad is shown. When it applies to you, you can change your choice at any time in Settings › About › Privacy options.

Google's advertising component uses your device's advertising ID. You can reset or delete the advertising ID in Android settings.

5. What is never collected

We never see your provider, your login, your channel list, your viewing history, any device identifier or your location, because nothing is sent to us and we have no server that could receive it. On the phone app, what Google's advertising component sends to Google is described in section 4.

6. Deleting your data

Delete a playlist in the app and its login, every catalog record, favourites, resume positions, search index and its cached images are cleared. If Rivulet cannot remove the stored login, it tells you that the delete did not complete instead of failing silently. Clearing the image cache is best effort; if it fails, uninstalling the app removes those images. Uninstalling the app removes everything else, including your preferences.

7. Backup

Rivulet opts out of Android cloud backup and of device-to-device transfer: allowBackup is off, and the app declares data-extraction rules that exclude all of its data from both. A new device starts empty, and the app copies nothing to a Google or Amazon account.

8. Third parties

On our side there is one: Google, through the phone app's advertising component (section 4) and, if you turn casting on, Google Play services' Cast component. The TV app has no advertising component. Your provider is a party you chose; its own policy governs what it sees, which includes your login and the streams you request. Traffic to your provider may be unencrypted (HTTP) if your provider only offers HTTP. GitHub, which hosts this page, keeps its own server logs under its own policy.

9. Open-source software

Rivulet uses FFmpeg (LGPL v2.1) for AC-3, E-AC-3 and DTS audio decoding, as three separately replaceable shared libraries: libavcodec, libavutil and libswresample, linked dynamically. The licence notice, the licence text and the source-offer bundle for each version are on the licences page (/licences/) and the releases page (/releases/) of this site.

10. Children

Rivulet is not directed to children. It has no age-gated content of its own, and parental controls are planned for a later version.

11. Changes to this policy

This policy is versioned with the app. A change is published with the release that needs it, and earlier versions stay available.

12. Contact

Questions about this policy: rivuletsupport@gmail.com