CouchPotato SuiteEffective from 2026-10-28. These terms cover the desktop application; Android and Apple mobile/TV policies are separate.
Controller and contact
BW-Tech GmbH IT-Service für Systemintegration und Datensicherheit, Albert-Bassermann-Straße 31, 68782 Brühl, Deutschland. Contact: info@bw-tech.de; support: info@bw-tech.de.
Local profiles and playback
The app stores provider addresses, usernames, passwords/tokens, favorites, viewing history/progress, parental-control settings and other preferences locally through secure storage: Windows DPAPI and macOS Keychain. Operating-system and device security still matter; secure storage does not protect an unlocked or compromised device from every form of access. Playback uses GStreamer. BW-Tech does not receive your local profiles merely because they are saved.
Connections go directly to your selected Xtream/M3U, programme-guide, artwork and media endpoints. Their operators receive your IP address, connection/request information and the credentials needed by your chosen source. Their privacy rules apply independently. Unencrypted HTTP can expose credentials and viewing traffic; prefer HTTPS. The player supplies no content or provider accounts.
Manual encrypted profile transfer
Export/import is manual, without a BW-Tech cloud synchronization service. Export can include provider credentials and settings. The app encrypts the transfer code locally with AES-256-GCM, using a passphrase-derived key (PBKDF2-HMAC-SHA256, 120,000 iterations). Choose a strong passphrase; the minimum length is eight characters. Export copies the encrypted code to the system clipboard. Clipboard history/synchronization and any transfer tool you choose may retain copies or disclose them to their operators. Send the passphrase separately and delete codes, clipboard copies and transferred files when no longer needed. Import/decryption happens locally.
Updates, diagnostics and casting
Automatic and manual update checks request the desktop feed at https://couchpotatosuite.com/couchpotatoplayer/updates/download/desktop.json . The server receives IP address, request time and ordinary HTTP metadata. Installer downloads require confirmation; size and SHA-256 are checked before an explicitly confirmed installer launch. Update requests do not include provider credentials or viewing history.
Connection/playback diagnostic information is displayed locally; the desktop implementation described here has no automatic diagnostic-report submission to BW-Tech. If you send support information yourself, review it and remove credentials, stream URLs and other secrets first.
Casting controls open operating-system/browser casting settings. If you enable screen/audio mirroring there, the system/browser and chosen receiver handle that connection and may receive the mirrored content. Their own terms apply.
Service recipients and retention
BW-Tech operates the website/update service itself using WordPress on its own infrastructure. No particular hosting country or certification is asserted. Service/access/error logs are retained for up to 90 days, backups up to 90 days. Contact enquiries are handled on BW-Tech's own Exchange server and retained up to 90 days, unless mandatory retention or necessary legal claims require longer storage. Your selected sources, OS/browser services and transfer tools act under their own rules and may process data abroad. Legally required disclosures remain possible. BW-Tech does not sell personal data or use it for advertising or cross-app tracking.
Purposes, legal basis, deletion and rights
Processing provides requested playback, local profiles, transfer, updates and support (Article 6(1)(b) GDPR); secure service operation and answering enquiries also rely on legitimate interests (Article 6(1)(f)). Optional processing requiring consent relies on Article 6(1)(a). Necessary storage for an expressly requested function falls under section 25(2)(2) TDDDG.
Remove profiles and related data through the app. Uninstalling alone may leave operating-system secure-storage records, exported codes, clipboard history or backups; remove these separately using the relevant controls. Deleting local data does not delete records held independently by your provider or chosen services.
Subject to legal conditions, you have rights to access, rectification, erasure, restriction, portability and objection (Articles 15–21 GDPR). You can withdraw consent for the future and complain to a supervisory authority, including https://www.baden-wuerttemberg.datenschutz.de/ . Contact info@bw-tech.de or the company postal address. No automated decisions with legal or similarly significant effects are used.