Privacy Policy

1. Who we are, and how to reach us

This website is published by Rebel IPTV ("we", "us"), and for the purposes of the UK GDPR and EU GDPR we are the data controller for the limited personal data described below.

For anything in this policy — including a data-rights request under section 9 — write to privacy@rebeliptv.com. For general enquiries, contact@rebeliptv.com. Technical support runs through our public issue tracker instead, so don't post anything there you wouldn't want visible. Our Contact page lists every route in one place.

2. We have no accounts and no forms

There is nothing on this site to sign up for. We operate no user accounts, no login, no newsletter, no contact form, no comments and no shopping cart, so we never ask you for your name, email address, postal address or payment details, and we hold no such database. The software itself is downloaded from Docker Hub and GitHub, not from us, and requires no registration.

3. Server logs

Like effectively every website, our web server records standard request logs: IP address, timestamp, the URL requested, HTTP status, referring page and user-agent string. These exist to keep the site running and secure — diagnosing errors, spotting abuse and blocking attacks. Our lawful basis is legitimate interest in operating a secure service. Logs rotate and are discarded within 30 days, and we do not use them to build profiles of visitors.

4. Cookies and local storage

We set no cookies of our own. We do use your browser's local storage for two things, both purely functional and neither transmitted anywhere:

• rebeliptv-theme — remembers whether you chose light or dark mode, so the site doesn't flip back on your next visit.
• rebeliptv-latest-release — caches the current version number so we don't re-query GitHub on every page you open.

Clearing your browser's site data removes both. Third-party cookies are a separate matter — see the next two sections.

5. Advertising (Google AdSense)

We display advertising served by Google AdSense. Google and its partners are third-party vendors who use cookies and similar technologies to serve and measure ads.

• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and other sites on the internet.
• Google uses the DoubleClick DART cookie and equivalent identifiers for this purpose.
• Third-party vendors and ad networks may also serve ads on this site and may themselves set or read cookies in your browser.
• We do not control these cookies, we do not receive the data they collect, and we cannot see who any individual visitor is.

Consent in the EEA, UK and Switzerland

If you are visiting from the European Economic Area, the United Kingdom or Switzerland, you are shown a consent message before any personalised advertising cookies are set. It is served by Google's certified consent management platform and registered under the IAB Transparency & Consent Framework, and it asks whether you agree to Google and its advertising partners using cookies and similar technologies for personalised ads and ad measurement.

Your choice is recorded and passed to those partners. Consenting is entirely optional — if you decline, you may still see advertising, but it will be non-personalised, meaning it is based on general context such as the page you are reading rather than on a profile of you. While the message is on screen you can set your preferences vendor by vendor under "Manage options". To change your answer afterwards, clear this site's cookies in your browser — the message then appears again on your next visit and you can answer differently. Withdrawing consent is always as easy as giving it, and costs you nothing but personalised ads.

Opting out anywhere in the world

Wherever you are, you can opt out of personalised advertising by Google at Google Ads Settings, and out of many other vendors at aboutads.info or Your Online Choices. Google's own handling of data is described in its privacy & terms for partner sites.

6. Analytics

We load Google Tag Manager, which in turn loads Google Analytics. This tells us aggregate things — which pages get read, roughly where visitors come from, which browsers and screen sizes to support — so we know which documentation is worth expanding. Analytics data is pseudonymous and we never attempt to identify an individual from it. You can block it entirely with the Google Analytics opt-out add-on or any mainstream content blocker.

If you are in the EEA, the UK or Switzerland, analytics and advertising storage start out denied on every page of this site. Until you consent, no analytics or advertising cookies are set and measurement runs in a cookieless mode that counts the visit without identifying the browser. On our policy and information pages, where no consent message is shown at all, that denied state simply stays in place.

7. Other third parties this site contacts

To show the current release number, your browser makes a direct request to the GitHub API (api.github.com). That request comes from you, not from us, so GitHub sees your IP address and user-agent; it is governed by GitHub's privacy statement. The result is cached locally for six hours, so it happens at most a few times a day even if you read the whole site. Our site assets are otherwise served from our own server — we load no external fonts, trackers, social widgets or embeds beyond those named in this policy.

8. Your self-hosted instance

When you run Rebel IPTV, it runs on your hardware. Your channel lineup, your guide data, your dashboard credentials, your custom sources and your settings live in a database on your machine, encrypted at rest. We hold no copy of any of it, and nothing described below carries the contents of that database off your machine.

Your instance does, however, stay in touch with our servers, and this is a required part of how it works rather than something you switch on. On first start it registers to obtain an instance identifier and an access token; from then on it checks in periodically to pick up updated source definitions and configuration, so that channels keep working as upstream sources change. Each check-in reports back:

• The version it is running and the hostname it reports for itself.
• How much it is carrying — the number of online channels, sports events and guide entries, and when it last refreshed.
• How much it is being used — streams started, current and peak concurrent streams, watch time and bytes served, counted separately for our curated sources and for any custom sources you add.
• Which curated channels or sports events have a live stream at the moment of the check-in.
• Health and diagnostic figures — memory and process statistics, refresh outcomes, stream failover counts and per-source success rates.

We use this to keep the curated source definitions working, to spot a source or a release that is failing across many instances and fix it, and to size our own infrastructure. Our lawful basis is legitimate interest in maintaining and supporting the software. What we do not receive: the URLs or contents of any custom sources you add, your playlist or guide data, your dashboard password, or your API key — and what is playing from your own custom sources is deliberately excluded from the report above, leaving only an aggregate count. The figures are held against the instance identifier, not against a named person, and only the most recent set is kept.

Because these check-ins come from your network, our servers see the originating IP address in the same way as described in section 3. If you would like to know what is held against a particular instance, or want it deleted, email privacy@rebeliptv.com with the instance identifier from Settings → Server.

If you switch on relay mode ("Hosted Feeds"), your instance also fetches feeds through our relay — that relay is pass-through, stores no media, and keeps only short-lived operational logs of the kind described in section 3. Securing your own instance, its dashboard login and the network it sits on is your responsibility.

9. Your rights

If you are in the UK, EEA or another jurisdiction with comparable law, you have the right to access, correct, erase, restrict or object to the processing of your personal data, and to data portability. Practically speaking there are two things to ask about: the short-lived website server logs described in section 3, which we cannot realistically link back to you as an individual without you telling us the IP address and time window to look for; and, if you run the software, the instance record described in section 8, which we can look up from its instance identifier. Requests about advertising or analytics data are better directed at Google, which controls it. To exercise any of these rights, email privacy@rebeliptv.com — we'll respond within one month, as the GDPR requires. You also have the right to complain to your local supervisory authority — in the UK, the Information Commissioner's Office.

If you are a California resident, we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not knowingly collect it beyond the server logs and instance record above.

10. Children

This site is aimed at adults setting up home-server software and is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, email privacy@rebeliptv.com and we will delete it.

11. Changes to this policy

We will update this page when what the site does changes, and we'll move the "last updated" date at the top. Material changes will be summarised here rather than slipped in quietly.