Privacy Policy
1. Introduction
At Mango Player, protecting your personal data is a priority. This Privacy Policy explains how we collect, use, store and protect information, along with rights provided by applicable laws, including the GDPR where it applies.
2. Data Controller
E BMA CONSULTING, the publisher of Mango Player, is the controller of the service's personal data.
Nice Trade and Companies Register: 851 925 784
Registered office: Nice, France
Email: [email protected]
Full company and contact details: legal notice.
3. Data We Collect
3.1 Identification Data
- Email address: For account creation and management
- Password: Stored as a non-reversible Argon2 hash, never in plain text
- Username: If you choose to set one
3.2 Technical Data
- Device information: Device type, operating system, Application version
- Device identifier: device management, synchronization and, in the versions concerned, limiting how often account-linked metrics are sent.
- IP address: For security and fraud prevention
- Usage logs: Connection timestamps, technical errors
3.3 Usage Data
- Usage and diagnostic metrics: versions that include these metrics measure the platform, app version and release channel, day of activity, sessions and time in the foreground, loading, playback and errors. Durations are added together or grouped into ranges. In new iPhone and iPad versions offering an audience choice, no new account-linked audience measurements are collected before your optional consent, after refusal or after withdrawal; periods without consent are not collected retroactively. Other versions that include these metrics retain the automatic collection described here. This choice does not affect Mango features, synchronization or diagnostics necessary for the service.
- Watch history: Titles and durations (stored locally, synced if enabled)
- Personal playlists: M3U URLs and Xtream Codes credentials (encrypted)
The server links these measurements to your internal account identifier. It also stores the sending device’s Mango identifier, a batch identifier and the receipt date to control submissions and prevent duplicates. These data remain linked to your account.
Batch contents do not include content titles or addresses, provider names, profile or source identifiers, IP addresses or detailed technical logs. These limits apply to these metrics; synchronized data and diagnostic reports serve their separate functions.
3.4 Currently free
Mango is currently free. Purchases, paid subscriptions and payments are not available.
4. Purposes of Processing
4.1 Account Management
- Create and manage your user account
- Authenticate your login
- Synchronize your data across devices
- Manage your devices and your access to Mango
4.2 App usage and improvement
- Measure active accounts, frequency of use and return visits, counting each account only once across devices for the same period.
- Analyze loading, playback and errors to improve reliability and performance.
- Monitor audience metrics to inform product and marketing decisions.
4.3 Communication
- Send you important notifications (updates, service changes)
- Respond to support requests sent through the website. The form sends your message, your email address if you provide it, and the app version if known; these requests are stored separately from crash reports.
- Inform you about new features (with your consent)
5. Legal Basis for Processing
- Contract performance: managing your account and your access to Mango
- Legitimate interests: app improvement and security, including diagnostics whose necessity and proportionality have been established. This basis does not apply to the new iPhone and iPad audience measurements described here and does not remove a consent requirement for access to information on your device.
- Consent: account-linked audience measurement in new iPhone and iPad versions offering this choice, and marketing communications (opt-in).
6. Data Sharing
We NEVER sell your personal data. The services and resources used include:
- Hosting: servers used to store data and run Mango services.
- Email service: Namecheap PrivateEmail is the provider configured to send service emails.
- Website resources: depending on the page, Google Fonts, GSAP animations from cdnjs and the TMDB logo. Loading them sends a browser request to the provider concerned.
- Chosen sign-in option: Google or Apple, when you choose one of these options to sign in.
Account-linked metrics from versions that include them are intended for Mango services. Statistical reporting is restricted to authorized administrators; reports show aggregate results, without names, contact details or lists of accounts.
We may disclose your data if required by law or to protect our legal rights.
7. Data Retention
- Active account: while your account remains active
- Deleted account: when deletion takes effect, the account and its associated data are removed from the active database. Technical receipts and deletion markers are kept separately to track the request and handle restores. Receipt cleanup is scheduled after 30 days from their last update, once the related operations are complete.
- Application logs and support requests: cleanup of device sign-in logs, crash reports, support requests sent through the website and email sending logs is configured for 90 days, with a scheduled daily process. This period does not describe the retention of other technical server logs.
- Account-linked metrics: for versions that include them, batches awaiting submission on a device expire after seven days, calculated from the UTC activity date. Expired batches are removed during the app’s processing and local saving cycles; if the app is stopped, cleanup waits until it runs again. In the active database, the configured retention period is 40 days from the UTC activity date, with a scheduled daily cleanup. They are also removed from this database when the account is effectively deleted.
8. Data Security
- Mango service transport: HTTPS/TLS for the site, account and Mango API; third-party source streams use their own protocol
- Secure transport: exchanges with our services use HTTPS
- Password hashing: Argon2 (non-reversible)
- Session tokens: Time-limited access and separate renewal; duration depends on the service and its configuration
- Access restriction: Principle of least privilege
- Backups: technical copies of the database are kept separately, on a cycle distinct from that of the active database.
9. Website cookies and storage
The website uses the mango_lang cookie and browser local storage to remember the language. This cookie may also be initialized from the language reported by the browser.
Account data and sign-in verification values are kept in browser local or session storage for the sign-in process.
The account-linked metrics described in section 3.3 concern app versions that include them. They are separate from website cookies and storage.
Since 14 September 2026, the public website also uses audience counters hosted by Mango: page views, active presence after fifteen visible seconds and an interaction, visits to installation guides and support form outcomes. These counters add no cookie or visitor identifier and send no form content, account identifier or full page address. They distinguish only the language, screen format and a broad source category. Account, device-linking and confirmation pages are excluded.
Events pass through the hosting service’s ordinary technical logs, which may contain IP addresses and network headers needed for security and operation. The audience report contains only grouped totals, without these raw data. These totals are not a count of unique people.
10. Your data rights
Depending on your jurisdiction and applicable law, including the GDPR where it applies, you may have the following rights:
- Right of access: Obtain a copy of your personal data
- Right to rectification: Correct inaccurate data
- Right to erasure: Request deletion of your data
- Right to restriction: Limit processing in certain circumstances
- Right to portability: Receive your data in a structured format (JSON)
- Right to object: object to processing based on legitimate interests on grounds relating to your particular situation; it stops unless demonstrated compelling legitimate grounds override your rights, or processing is required for legal claims. An objection to direct marketing ends processing for that purpose.
- Right to withdraw consent: you can withdraw consent at any time. For audience measurement in the new iPhone and iPad versions concerned, your choice is specific to your account in this installation and can be changed under “Privacy policy”. Withdrawal stops new audience measurements and removes the audience values already received on the basis of this consent for this account in this installation from the active database. Diagnostics and technical receipts used to check submissions remain separate, with their own retention rules. Withdrawal does not change choices in other installations or make earlier processing unlawful. You can still exercise your right to erasure using the contact below.
To exercise your rights: [email protected]. Response within 30 days maximum.
11. International Transfers
We use hosting and service providers whose locations may vary. When an international transfer is subject to the GDPR or equivalent rules, we apply the safeguards required by law and update this policy where needed.
12. Minors
Mango Player is not intended for persons under the age of 16. We do not knowingly collect personal data from children.
13. Changes
We may modify this Privacy Policy at any time. In the event of a substantial change, we will notify you by email or in-app notification.
14. Complaints
If you believe your data protection rights have been violated, you can file a complaint with:
CNIL (Commission Nationale de l'Informatique et des Libertés)
3 Place de Fontenoy, 75007 Paris, France
www.cnil.fr
15. Contact
For any questions regarding this Privacy Policy:
Email: [email protected]
Text revised on October 14, 2026