Legal
Privacy policy
Provisional version. The identity of the data controller will be published as soon as the legal entity that publishes MoroView is formed: the highlighted fields are waiting for it. The rest of this document describes how the service works today.
Last updated: 30 September 2026. This is a translation of the French version, which prevails in case of discrepancy. In short: we process what your account needs to work; the vault holding your sources is encrypted on your device and we cannot open it; in the web version, your requests to your provider go through our relay, which forwards them without recording them; we do not record what you watch.
1. Data controller
The data controller is the publisher of MoroView: [Publisher: legal name, legal form and share capital], [Registered office address]. For any question about your data: [Verified contact email address].
Until this address is published, no request channel is open; exporting your data and deleting your account remain available as self-service actions in the app (section 7).
2. On this website (moroview.com)
- No cookies, no trackers, no audience measurement. Fonts and images are served by this website; the pages call no third-party service.
- No email address is requested on this website.
- Hosting logs: when you view a page, Render and Cloudflare (section 5) process your IP address, the page address, the date and your browser’s identification to deliver it and protect the service. Basis: legitimate interest. Retention: as set by these providers.
3. In the app, if you create an account
| Data | Why | Legal basis |
|---|---|---|
| Email address | Identify your account and sign you in. | Performance of the contract |
| Sign-in verifier, derived from your password on your device (we keep only a hash of it) | Authenticate you without ever receiving your password in clear. | Performance of the contract |
| For an account opened before this verifier was introduced: the hash of the former sign-in credential, which derives from the password, and a sealed copy of that hash (encrypted with a key that is not in the database) | Keep recognising devices still on an older version, and be able to roll back a service update without locking those accounts out. | Performance of the contract |
| Version of the terms accepted and date of acceptance, when the app asks you to accept them | Know which terms apply to your account. | Performance of the contract |
| Encrypted vault: your source credentials, profiles, favourites, history and resume points, synced settings | Sync your devices. It is encrypted on your device (AES-256-GCM, key derived with PBKDF2-HMAC-SHA256, 600,000 iterations); we cannot open it. | Performance of the contract |
| If you create a recovery code: a verification hash of that code and a copy of your vault key encrypted with that code | Let you reopen your account and vault if you forget your password. Without your code, we cannot use that copy. | Performance of the contract |
| Sign-in sessions: technical identifier, creation, last-use and expiry dates | Keep your devices signed in and let you sign a device out. | Performance of the contract |
| Connected devices: name, platform and last activity; devices you removed | “Play on…”, remote control, and preventing a removed device from coming back to the account. | Performance of the contract |
| Pairing: a hash of the pairing code and an encrypted message relayed between your devices | Link a new device. The message is encrypted with a key derived from the pairing code, which we never receive. | Performance of the contract |
| Security log: event type (sign-up, successful or refused sign-in, sign-out, pairing, sync, deletion), email address concerned, technical request identifier, date | Protect accounts and detect abuse. | Legitimate interest |
| IP address | Route responses and limit abuse (one-minute counters). It is not written to our application logs. | Legitimate interest |
| App crash reports: error message, technical trace, device model, system and app versions, with your source credentials removed | Fix errors. Off by default: you turn them on in Settings and can turn them off at any time. | Consent |
| TMDB enrichment: title, year and type of the item you open, interface language | Show posters and synopses, if you allow it. Our server queries TMDB without your account or any identifier; your device then loads the images from TMDB. | Consent |
| Plans and recharge codes, once the offers open: plan, validity dates, counted devices, codes used (stored as a hash) | Apply your plan. | Performance of the contract |
What you watch is recorded nowhere on our servers. Your history and resume points live on your devices and, encrypted, in your vault. No usage statistics are collected. No payment is open: we process no banking data; if payment opens, the provider and the data concerned will be described here first. No advertising is shown and no email is sent today; an ad network or an email provider would be named here before being used.
4. The web version and its relay
A browser cannot reach most provider servers directly: a secure (https) page may not call an http address, and those servers do not allow calls coming from another website (CORS). The web version (app.moroview.com) therefore goes through three relays on our servers: /api/fetch for your source’s catalogue, /api/img for images served over http and /api/stream for some video streams.
- What the relay sees, for the duration of each request: your IP address and the full address requested from your provider. For an Xtream source, that address contains your username and password with that provider. The relay also sees the response pass through: catalogue, image or stream.
- What it keeps: nothing. The requested address, its parameters and the relayed content are written neither to our database nor to our logs; the logs keep only the relay’s path (without parameters), the response code and the duration, and the image and stream relays are not logged at all. Our error reports contain no IP address, no address parameters and no request content.
- What intermediaries see: these requests travel encrypted to Cloudflare and Render (section 5), which carry our servers’ traffic and may keep technical logs under their own rules.
- What your provider sees: our servers’ IP address instead of yours.
- The native apps (Android, Windows, televisions) contact your provider directly, without this relay.
5. Service providers and recipients
We neither sell nor rent any data. Only the providers below process data, each for the purpose stated.
| Provider | Role | Data concerned | Location |
|---|---|---|---|
| Render (Render Services, Inc., United States) | Hosting of the API, database and cache; hosting of the website and web app files | All the service data described above | Frankfurt (Germany) for the API and account data; public files served by a global network |
| Cloudflare (Cloudflare, Inc., United States) | Delivery and protection network in front of the services hosted by Render | Requests in transit, including the web relay’s; IP address | Global network |
| Sentry (Functional Software, Inc., United States) | Error reports: internal errors of our servers and, if you turn them on, app crash reports | Redacted technical messages, without address parameters or request content | Sentry’s European Union region (Germany) |
| TMDB (The Movie Database, United States) | Posters, synopses and cast, if you allow it | Title, year and type of the item, interface language (sent by our server, without any identifier); your device’s IP address when images load | United States |
| Google Fonts (Google) | Web app only: when a name in your catalogue contains characters our embedded fonts do not cover (Chinese, Cyrillic, emoji…), your browser downloads a font from fonts.gstatic.com | IP address, browser identification, font requested | Google’s global network |
The moroview.com website and the television apps do not call Google Fonts. Your content provider is not our service provider: it receives your playback requests, directly or through our relay, under its own terms.
These providers are companies established in the United States. Your account data is stored in Frankfurt, but may be accessible from the United States or pass through these providers’ global networks. These transfers rely on the safeguards in their data processing terms (the European Commission’s standard contractual clauses, or the EU–US Data Privacy Framework for certified companies). Those terms will be entered into in the publisher’s name when its legal entity is formed.
6. Retention periods
| Data | Period |
|---|---|
| Account, encrypted vault, recovery code, removed devices, acceptance of the terms | As long as the account exists; erased immediately when it is deleted |
| Sign-in sessions | A session expires at most 30 days after it was opened or last renewed; a session expired for more than a day is erased at the account’s next sign-in or at the next restart of the service, and all of them are erased when the account is deleted |
| Hash of the former sign-in credential and its sealed copy (accounts opened before the verifier) | Erased at the first sign-in after 1 February 2027 of an account that has moved to the verifier; kept while they remain the account’s only way to sign in; erased when the account is deleted |
| Security log | 90 days; at most the last 20 failed sign-ins per email address; erased when the account is deleted |
| List of connected devices | 30 days after the device’s last activity, or as soon as you remove it |
| Pairing | 2 minutes at most |
| “Play on…” commands and relayed playback states | 90 seconds, in memory |
| Web relay requests | Not kept: processed in memory for the duration of the request |
| Anti-abuse counters tied to the IP address | 1 minute |
| Our servers’ technical logs (path without parameters, response code, duration, technical identifier; no IP address, no account) | According to the hosting provider’s log retention |
| Error reports (Sentry) | According to Sentry’s retention, then deleted automatically |
| Data stored on your devices | Until you sign out, clear the browser’s data or uninstall the app |
After an account is deleted, a copy may remain in the database’s automatic backups, if the hosting plan includes them, until they are automatically replaced.
7. Your rights and how to exercise them
You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw your consent at any time.
- Access and portability: in the app, Settings › Account & sync › Export my data gives you your account and your encrypted vault, which your devices can open.
- Erasure: Settings › Account & sync › Delete account, on the web as in the apps, after confirming the account password; deletion is immediate. Steps and what is erased.
- Withdrawing consent: crash reports and TMDB enrichment are turned off in the app’s Settings.
- Any other request (security log, correcting the email address, objection, restriction): [Verified contact email address]. We answer within the one-month period set by the GDPR.
You may lodge a complaint with the data protection authority of your country of residence: in France the CNIL, in Morocco the CNDP.
8. Security
End-to-end encryption of the vault, encrypted transport (TLS), brute-force-resistant key derivation, logs free of secrets, restricted server access. The security and privacy section of the home page describes how this works and its limits. The private channel for reporting a vulnerability will be the publisher’s contact address: [Verified contact email address].
9. Minors
Creating an account is reserved for adults. Kid profiles are created by the account holder; they contain only a name chosen by the holder and stay in the encrypted vault.
10. Changes
Any substantial change is announced on this page, with its date. The version in force is the one published here.
Legal notice · Terms and conditions · Delete my account · All documents, in French, English and Arabic