Privacy Policy
1. Introduction
At Mango Player, protecting your personal data is a priority. This Privacy Policy explains how we collect, use, store and protect information, along with rights provided by applicable laws, including the GDPR where it applies.
2. Data Controller
Mango Player
Email: contact@mangoplayer.app
3. Data We Collect
3.1 Identification Data
- Email address: For account creation and management
- Password: Stored in encrypted form (Argon2 hashing)
- Username: If you choose to set one
3.2 Technical Data
- Device information: Device type, operating system, Application version
- Device identifier: device management, synchronization and, in the versions concerned, limiting how often account-linked metrics are sent.
- IP address: For security and fraud prevention
- Usage logs: Connection timestamps, technical errors
3.3 Usage Data
- Usage and diagnostic metrics: versions that include these metrics automatically collect measurements linked to your account: platform, app version and release channel, day of activity, sessions and time in the foreground, loading, playback and errors. Measured durations are added together or grouped into ranges.
- Watch history: Titles and durations (stored locally, synced if enabled)
- Personal playlists: M3U URLs and Xtream Codes credentials (encrypted)
The server links these measurements to your internal account identifier. It also stores the sending device’s Mango identifier, a batch identifier and the receipt date to control submissions and prevent duplicates. These data remain linked to your account.
Batch contents do not include content titles or addresses, provider names, profile or source identifiers, IP addresses or detailed technical logs. These limits apply to these metrics; synchronized data and diagnostic reports serve their separate functions.
3.4 Currently free
Mango is currently free. Purchases, paid subscriptions and payments are not available.
4. Purposes of Processing
4.1 Account Management
- Create and manage your user account
- Authenticate your login
- Synchronize your data across devices
- Manage your devices and your access to Mango
4.2 App usage and improvement
- Measure active accounts, frequency of use and return visits, counting each account only once across devices for the same period.
- Analyze loading, playback and errors to improve reliability and performance.
- Monitor audience metrics to inform product and marketing decisions.
4.3 Communication
- Send you important notifications (updates, service changes)
- Respond to your support requests
- Inform you about new features (with your consent)
5. Legal Basis for Processing
- Contract performance: managing your account and your access to Mango
- Legitimate interest: Application improvement, security
- Consent: Marketing communications (opt-in)
6. Data Sharing
We NEVER sell your personal data. The services and resources used include:
- Hosting: servers used to store data and run Mango services.
- Email service: Namecheap PrivateEmail is the provider configured to send service emails.
- Website resources: depending on the page, Google Fonts, GSAP animations from cdnjs and the TMDB logo. Loading them sends a browser request to the provider concerned.
- Chosen sign-in option: Google or Apple, when you choose one of these options to sign in.
Account-linked metrics from versions that include them are intended for Mango services. Statistical reporting is restricted to authorized administrators; reports show aggregate results, without names, contact details or lists of accounts.
We may disclose your data if required by law or to protect our legal rights.
7. Data Retention
- Active account: while your account remains active
- Deleted account: when deletion takes effect, the account and its associated data are removed from the active database. Technical receipts and deletion markers are kept separately to track the request and handle restores. Receipt cleanup is scheduled after 30 days from their last update, once the related operations are complete.
- Application logs: cleanup of device sign-in logs, crash reports and email sending logs is configured for 90 days, with a scheduled daily process. This period does not describe the retention of other technical server logs.
- Account-linked metrics: for versions that include them, batches awaiting submission on a device expire after seven days, calculated from the UTC activity date. Expired batches are removed during the app’s processing and local saving cycles; if the app is stopped, cleanup waits until it runs again. In the active database, the configured retention period is 40 days from the UTC activity date, with a scheduled daily cleanup. They are also removed from this database when the account is effectively deleted.
8. Data Security
- Encryption in transit: HTTPS/TLS for all communications
- Secure transport: exchanges with our services use HTTPS
- Password hashing: Argon2 (non-reversible)
- Strong authentication: JWT with short-lived tokens
- Access restriction: Principle of least privilege
- Backups: technical copies of the database are kept separately, on a cycle distinct from that of the active database.
9. Website cookies and storage
The website uses the mango_lang cookie and browser local storage to remember the language. This cookie may also be initialized from the language reported by the browser.
Account data and sign-in verification values are kept in browser local or session storage for the sign-in process.
The automatic account-linked metrics described in section 3.3 concern app versions that include them. They are separate from website cookies and storage.
Since 14 September 2026, the public website also uses audience counters hosted by Mango: page views, active presence after fifteen seconds, visits to installation guides and support form outcomes. These counters add no cookie or visitor identifier and send no form content, account identifier or full page address. They distinguish only the language, screen format and a broad source category. Account, device-linking and confirmation pages are excluded.
Events pass through the hosting service’s ordinary technical logs, which may contain IP addresses and network headers needed for security and operation. The audience report contains only grouped totals, without these raw data. These totals are not a count of unique people.
10. Your data rights
Depending on your jurisdiction and applicable law, including the GDPR where it applies, you may have the following rights:
- Right of access: Obtain a copy of your personal data
- Right to rectification: Correct inaccurate data
- Right to erasure: Request deletion of your data
- Right to restriction: Limit processing in certain circumstances
- Right to portability: Receive your data in a structured format (JSON)
- Right to object: Object to marketing processing
- Right to withdraw consent: for processing based on your consent, you can withdraw it at any time
To exercise your rights: contact@mangoplayer.app. Response within 30 days maximum.
11. International Transfers
We use hosting and service providers whose locations may vary. When an international transfer is subject to the GDPR or equivalent rules, we apply the safeguards required by law and update this policy where needed.
12. Minors
Mango Player is not intended for persons under the age of 16. We do not knowingly collect personal data from children.
13. Changes
We may modify this Privacy Policy at any time. In the event of a substantial change, we will notify you by email or in-app notification.
14. Complaints
If you believe your data protection rights have been violated, you can file a complaint with:
CNIL (Commission Nationale de l'Informatique et des Libertés)
3 Place de Fontenoy, 75007 Paris, France
www.cnil.fr
15. Contact
For any questions regarding this Privacy Policy:
Email: contact@mangoplayer.app
Last updated: September 12, 2026