Privacy Policy

Last updated: 26 October 2026

This policy explains what personal data Silica handles, why, and what you can do about it. It covers:

• the Silica app on Android TV, Google TV, Amazon Fire TV, phones and tablets;
• account.silica.tv, where you activate a TV and can buy Silica Premium on the web; and
• silica.tv, the Silica website.

Where a word like "controller" or "lawful basis" appears, it has the meaning it has in UK data protection law (the UK GDPR and the Data Protection Act 2018).

Silica is provided by Aromacraft Ltd, a company registered in England and Wales (company number 15097606), whose registered office is at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. Aromacraft Ltd is the controller of the personal data described in this policy. In this policy, "we", "us" and "our" mean Aromacraft Ltd acting as the provider of Silica.

• Privacy contact: [email protected]

• Silica provides no content. Silica is a player and organiser. It does not provide, host, sell or bundle any TV channels, films, series or programme guide (EPG) data. Everything you watch comes from a source you add yourself.
• Your sources stay on your device. Playlist addresses, Xtream usernames and passwords, and guide addresses are stored encrypted on your device and sent to the server you set up. We never receive them. If you open a stream in another player or cast it, that app or device receives the stream address. For Xtream, that address can include your username and password.
• You do not need an account to use Silica. We hold data about you if you use Silica Premium (buying it, restoring it, or linking devices), turn on an optional feature that talks to another service, or email us, for example with a support report. Silica also keeps support diagnostics on your device. We receive them only if you send a support report (section 3).
• Optional features are clearly marked. Crash reporting, film and series information, and external subtitles are off until you turn them on.
• We do not sell your data, and there is no advertising in Silica.

The following is stored only on your device. We do not receive it.

• Your sources: playlist (M3U/M3U8) addresses and files, Xtream-compatible account details, and XMLTV guide addresses. Credentials are encrypted using the Android Keystore. Silica sends them to the server address you entered, to load your channels, guide and streams. If you open a stream in another player or cast it, that app or device receives the stream address. For Xtream, that address can include your username and password.
• Your library and activity: favourites, watchlist, continue-watching position, viewing history, search history and settings.
• Parental controls: your PIN and profile restrictions.
• Local backups: if you choose to export a backup, Silica writes an encrypted file to the location you pick. It is not uploaded anywhere automatically.
• Downloaded subtitles: kept in app-private storage and removed automatically 30 days after last use, or sooner if the cache grows beyond 100 MiB.

Support diagnostics. Silica keeps the following on your device for support reports. Android backups and moves to a new device do not include it. We receive it only if you send us a support report (section 5.6).

• Up to 32 recent playback failures: when each first and last happened, the kind of playback (for example live or on demand), the stream and connection type, the player's error code, the server's status number if it sent one, and how often it failed and paused to buffer.
• The last Java crash: when it happened, the app version, the type of error, any error that caused it, and where in the app's code it happened. The error message is not kept.

Freezes, and times Android closed Silica to free memory, are read from Android only when you create a report.

Unencrypted provider connections. Some IPTV servers only offer plain http:// addresses. If you add one, the connection between your device and that server is not encrypted. Your provider chooses this connection. We never see that traffic.

External players. If you choose to open a stream in another player app, Silica passes the stream address to that app. What that app does with it is governed by its own privacy policy.

You can remove everything in this section by clearing Silica's storage or uninstalling the app.

Silica Premium is optional. When you use it, we run an account service at account.silica.tv. We call your Premium account a household: it links your purchases and the devices (up to 5 at a time) that can use Premium.

4.1 Your household email address and sign-in codes

What: the email address you give when you sign in with an email code, attach an email to your household, or join two households. We also create a one-time code and count failed attempts.

Why: to let you manage your household, recover Premium on a new device, and link households.

How: your email address is stored encrypted. To find your household we use a keyed fingerprint of the address, not the address itself. Codes are delivered by Amazon Simple Email Service (Amazon SES) in its London region (eu-west-2). The email contains only the code; SES receives only your address and the code.

How long: codes expire after 5 minutes, after they are used, when a newer code replaces them, or after 3 wrong attempts. Your email address is kept while your household exists, and is deleted within one month of a verified deletion request (section 13).

Giving an email address is optional. You can buy Premium through Google Play or Amazon without one.

4.2 Your purchases

What: the details we need to confirm that a purchase is real and to give you Premium. The details depend on where you bought:

• Google Play: the purchase token, product and order identifiers, and purchase status. Silica sends these to Google Play for verification. Google also tells us about later changes, such as renewals, cancellations and refunds.
• Amazon Appstore: the receipt identifier, your Amazon user identifier for Silica, the product and purchase status. We send these to Amazon's receipt verification service.
• On the web (Stripe): you pay on our page at account.silica.tv using Stripe's payment form. You give your card and billing address to Stripe, not to us. Our page sends the email address you signed in with to Stripe. Stripe tells us the purchase, subscription and payment identifiers, the plan and the payment status. We do not store your card details. Through our Stripe account we can see details of your payment (for example the amount, date and the email you gave Stripe) so we can handle refunds and support.

Purchase status updates for Google Play, Amazon Appstore and Stripe purchases also reach us from those providers when your subscription renews, is cancelled or is refunded.

Why: to verify purchases, give and withdraw Premium, keep our financial records, and deal with refunds, disputes and fraud.

How long: see section 11.

4.3 Your devices

What: when you buy, restore or activate Premium, or link a device, Silica creates a cryptographic key on your device and sends us the public half, the platform ("android"), a device type (for example "TV" or "phone"), and identifiers for the installation and its Premium grant. We also record when a device was last seen.

Why: to prove that Premium requests come from your device, enforce the 5-device limit, let you see and remove devices, and prevent fraud.

When: only when you use Premium. A free install that never uses Premium does not register with us.

How long: while the device is part of your household. A removed device is revoked, and its records are deleted when your household is deleted.

4.4 Recovery codes, linking devices and joining households

• Recovery code: after a purchase we may show you a recovery code. We store only a keyed fingerprint of it, never the code. Keep it safe: anyone with it can recover your household.
• Linking a device: when you approve a new device from one you already use, or join two households together, the approving screen may show the other person's email address in a masked form (for example a*****@example.com). We never show the full address.
• Joined households: when two households are joined, we keep a record that the old household now points to the new one, so that purchases and devices keep working. These records are kept only as long as needed for that purpose.

4.5 Buying and activating on the web (account.silica.tv)

• Activation codes: when you type the code shown on your TV, the page keeps it in your browser's session storage (cleared when you close the tab) so the page can finish the activation. We store only a keyed fingerprint of the code, never the code itself. Activation records are deleted within about a week of the activation ending.
• Checkout records: we keep a short-lived record linking your activation to your Stripe Checkout session, so that a payment always reaches the right household. These are deleted 7 days after an unpaid checkout ends and 30 days after a completed one. A payment that could not be matched is kept until it is resolved, and then for 365 days.
• Cookies: see section 17.
• Abuse protection: to stop people guessing codes, we count requests using a keyed, regularly rotated value derived from your network address. We do not keep a history of your IP address in this system, and the counters expire after a short window.
• Server logs: our web server records standard access logs (such as IP address, browser type, time and the page requested). Tokens in web addresses are removed before logging. We keep these logs for 14 days.

5.1 Crash and freeze reports (off by default)

Silica includes a Settings → About → Crash reporting option. In the current release it is not shown and nothing is sent to Sentry. If a future version adds crash reporting, it will be off until you turn it on, and we will update this policy before it sends anything. This option is separate from support reports (section 5.6).

5.2 Film and series information (off by default)

This feature is off until you turn it on. If you turn on Settings → About → Metadata enrichment (TMDB), Silica sends The Movie Database (TMDB) the title (and year, where known) of films and series that are already in your own library. It sends no account details, viewing history or source details. Turn it off to withdraw consent.

5.3 External subtitles (off by default)

The feature is off until you turn it on. If you turn on Find external subtitles, Silica sends SubDL and/or OpenSubtitles a minimal match request: a TMDB identifier where available (otherwise a cleaned title and year), season and episode, and your preferred language. It never sends your playlist address, credentials, provider or viewing history.

Signing in to OpenSubtitles is optional. If you do, your OpenSubtitles username and password go directly from your device to OpenSubtitles. Signing out deletes them and your downloaded subtitles from your device. Signing out, or turning the feature off, withdraws consent.

5.4 Google Cast (Google Play version only)

The Google Play version of Silica includes Google's Cast software so you can cast to a TV. Google collects Cast data as its own controller under Google's privacy policy. We do not receive it. Our interest in including Cast in the Play version is a legitimate interest in offering casting. We cannot delete Google's copy.

5.5 These services keep data under their own policies

TMDB, SubDL, OpenSubtitles and Google (for Cast) receive requests directly from your device and handle them under their own privacy policies and retention periods, not ours.

5.6 Support reports

In Settings → Help you can create a support report. Silica builds it on your device and shows it to you first. It reaches us only if you send it. On a phone or tablet, share it or copy it into an email to [email protected]. On a TV, share it if you can, or scan the code to start an email and attach a photo of each page. The code starts an email to us with the reference in the subject. The report is not in the code. A photo can include when and where it was taken. We use the report only to answer your request.

A support report contains:

• a reference for your request and when the report was made;
• the app version and build, the app's database version, your device model and memory, the Android version and your connection type (for example Wi-Fi);
• your Premium status and where it came from (for example Google Play);
• for up to 20 playlists, shown only by number (for example "Playlist 1"): the playlist type, whether it is on, and how the last load of Live TV, Movies, Series and the TV guide went. Where the report has them, it adds any warnings, when and why the load started, roughly how many items it has, and when it will try again. Other playlists are only counted;
• how many times each step of loading playlists has happened since Silica was opened, including steps that worked;
• the 10 most recent playback failures: when each last happened, the kind of playback (for example live or on demand), the stream and connection type, the player's error name, group and code, the server's status number if it sent one, and how often it failed and paused to buffer. Older ones are only counted;
• the last crash, freeze and time Android closed Silica to free memory, where these were recorded: when each happened, the app version and, where available, the type of error and where in the app's code it happened. Error messages are never included.

It never contains playlist names or addresses, stream addresses, server names, logins, channel or programme names, or the name of anything you watched or searched for.

The website does not ask for any personal information, does not use analytics or advertising tools, and sets no cookies of its own. The site is served from equipment we run in the UK, behind Cloudflare, which handles your IP address and browser details to deliver the pages and protect the site from attacks. Our own server sees Cloudflare's network addresses, not yours. It records the page requested, the time and your browser type, and keeps these records for 14 days.

If you email us, we use your message and address to reply.

We do not collect your contacts, messages, advertising identifier or card details. The app does not access your location, photos or videos. We do not receive your IPTV sources or credentials, your viewing or search history, or the names of channels, programmes or anything you watched or searched for. A support report you choose to send can include the kind of playback that failed (section 5.6). If you email us a photo, we receive that photo and any details stored in it, such as when or where it was taken.

Where we rely on legitimate interests, you have the right to object (section 13).

You do not have to give us any personal data to use the free player. A web purchase cannot be completed without an email address, payment details and a billing address for Stripe. Our page sends the email address you signed in with to Stripe. You enter your card and billing address in Stripe's payment form on that page. Stripe then sends us the email address and payment result. Premium sign-in, recovery and linking two households need an email address; without one, those features are unavailable. A Google Play or Amazon purchase can still be restored without an email, using the store receipt. Crash reporting, external subtitles and film and series information stay off unless you turn them on.

We do not sell personal data. We share it only with the services below, and only for the purposes in this policy.

Processors (who process data on our instructions under Article 28 terms):

Independent controllers (who handle your data under their own privacy policies):

We may also disclose data if the law requires it, or to protect the rights and safety of our users or others.

Our account service, database and email delivery are in the UK, and our backups are kept in the UK. Some of the providers above process personal data outside the UK.

Where a provider in section 9 processes personal data outside the UK, the safeguard is set out below. You can ask for a copy by emailing [email protected].

TMDB, SubDL and OpenSubtitles receive requests directly from your device when you turn those features on, and may process that data outside the UK under their own terms. On the Google Play version, Google Cast receives Cast data from the device under Google's own terms. We do not receive it.

Deleting a support email does not delete a purchase record or any other record the law requires us to keep.

We keep a purchase record for six years after the end of the accounting period the transaction falls in. Tax law requires us to keep records of receipts for that period. We also keep it where we need it for a refund, a chargeback or a legal claim. When your household is deleted we delete your email address and device records. The purchase record that remains contains the date, amount, plan and the payment provider's transaction reference. For a Google Play purchase we also keep the purchase token, encrypted, for the same period. We, Stripe, Google or Amazon can still match that reference to you if we have to, and Google can match the purchase token. We do not use the record to provide Premium or to contact you. We do not keep the Amazon user identifier after deletion.

Accounting records are kept for three years as required by the Companies Act 2006. Corporation tax records of receipts are kept for six years from the end of the accounting period as required by the Finance Act 1998.

We back up our database every night. Backups are encrypted, kept on equipment we control in the UK, accessible only to us, and deleted after 30 days. After deletion from our live systems, your data may remain in an encrypted backup for up to 30 days. If we ever have to restore from a backup, we re-apply deletions made since that backup was taken before we put it back into use.

You have the right to:

• access the personal data we hold about you;
• correct it if it is wrong;
• delete it (see Delete your Silica account);
• restrict or object to how we use it, including where we rely on legitimate interests;
• data portability for data you gave us, where that right applies; and
• withdraw consent at any time, where we rely on consent (for example, turn off metadata enrichment or external subtitles).

To use any of these rights, email [email protected]. We may need to confirm that the household is yours before acting (for example by emailing the address on the household, or asking for your recovery code or a purchase receipt). We reply within one month. If a request is complex we may extend that by up to two further months, and we will tell you within the first month if we do.

When you ask us to delete your household, we find it, cancel any active Stripe subscription and erase your email address and device records. We keep only the purchase records described in section 11. We also purge your data from server access logs within our retention period and re-apply any erasure if we restore from a backup.

Much of your Silica data never reaches us (section 3), so you control it directly on your device.

If you are unhappy with how we have handled your data, tell us so we can try to put it right. You also have the right to complain to the UK Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or 0303 123 1113.

Silica is not directed at children. It includes parental controls so a household can manage what is shown on a shared TV, but Premium purchases and household accounts are for adults aged 18 or over. We apply age-appropriate defaults: optional features that send data off the device, including film and series information, stay off until an adult turns them on. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email [email protected] and we will delete it.

We encrypt your household email address and purchase tokens at rest, store only keyed fingerprints of codes, and use encrypted connections between the app, your browser and our service. Access to our systems is restricted to the people who run Silica. No system is perfectly secure; if a breach affects your personal data in a way that is likely to put you at high risk, we will tell you.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our automatic checks (for example, whether a purchase is valid) decide whether Premium is on.

• silica.tv sets no cookies.
• account.silica.tv sets its own cookies only where they are strictly necessary for the page you are using: __Host-silica-customer-session (keeps you signed in, up to 7 days), __Host-silica-customer-csrf (protects your requests from forgery) and __Host-silica-customer-otp-flow (keeps your sign-in code request together, 5 minutes). It also uses your browser's session storage for the activation code, cleared when you close the tab. Because these are strictly necessary, we do not ask for consent, and we do not use them for tracking or advertising.
• Paying for Premium on the web: We load Stripe's payment form (Stripe.js) when you open the payment step. Stripe uses __stripe_mid (about one year) and __stripe_sid (about 30 minutes) on account.silica.tv for fraud prevention and payment security. These cookies can remain after you leave that step and are sent with later requests to account.silica.tv until they expire or you clear them. Stripe also processes device and browser information for payment security under Stripe's privacy policy.

Stripe's payment form may also set security cookies on other domains: m on m.stripe.com and __cf_bm on .hcaptcha.com. Our browser check recorded lifetimes of about 400 days and 30 minutes respectively. Browser settings may shorten these periods. We do not ask for cookie consent for storage or access that is strictly necessary to process and secure a payment you request. We do not use that exception for analytics or advertising.

• The app stores data on your device only to provide the features you use (section 3).

We update this policy when what Silica collects changes. If a change is significant, we will say so in the app or on this page before it takes effect. The date at the top shows when it last changed.

• Privacy questions and requests: [email protected]
• Everything else: [email protected]