Privacy Policy

1. Data controller

The data controller is IORA Teknoloji Geliştirme Limited Şirketi, Türkiye (“IORA”, “we”). Contact: [email protected]. We process personal data under the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where it applies, the EU General Data Protection Regulation (GDPR).

2. What Holix Play is

Holix Play is a player for media servers that you own or operate. We do not provide, host or see your media content.

3. Data we collect

• Account: e-mail address.
• Profile information: profile name, avatar and birth date. The birth date is used only to derive the age rating limit.
• Viewing history and likes: what a profile watches and likes, used for recommendations and sync. The guest profile is excluded and keeps no history.
• Device information: device type, operating system version, app version and language.
• Crash reports: technical diagnostics when the app fails.
• Purchase status: subscription or purchase entitlement from Apple. We do not receive your payment card details.

4. Data that stays on your device

The address and credentials of your media server are stored on your device in the Keychain and are not sent to us.

5. Why we use data (legal bases)

To provide the service and your account (contract); to recommend content, sync preferences and fix crashes (legitimate interests); to comply with legal duties; and, where required, based on your consent. Under KVKK we rely on the corresponding conditions of Articles 5 and 6.

6. Third parties

• Trakt — only if you connect your account; watch history is exchanged with Trakt under its own privacy policy.
• TMDB and rating providers — we send only content identifiers (not personal data) to fetch metadata and ratings.
• Apple — handles purchases, subscriptions and Family Sharing.
• Infrastructure providers — hosting and crash reporting services that process data on our behalf.

We do not sell personal data or use it for third-party advertising.

7. Retention

We keep account and profile data while your account is active and delete it within a reasonable period after deletion, except where the law requires longer storage. Viewing history can be cleared per profile.

8. Your rights

You may request access, correction, deletion, restriction, objection and portability of your data, and may withdraw consent at any time. Under KVKK Article 11 you may also learn whether your data is processed and request information about it. Write to [email protected]. You may also complain to the Turkish Personal Data Protection Authority (KVKK) or an EU supervisory authority.

9. International transfers

Our service providers may be located outside Türkiye or the EEA. Where this happens we use the safeguards required by KVKK and GDPR.

10. Children

Child profiles are created and managed by a parent or guardian on the account. We do not knowingly allow children to create an account on their own, and we do not use child profile data for advertising.

11. Changes and contact

We will post changes to this policy on this page. Questions: [email protected].