Last updated: September 12, 2026
This Privacy Policy explains how KODITVBOX handles personal information in connection with our website, KTB apps, subscriptions, device registration, app signing and installation, and support services. Privacy inquiries and requests are handled through [email protected]; please use the subject “Privacy Request.”
Important distinction: KTB’s on-device signing workflow is designed to process third-party IPA files on your device without uploading those IPA files to KODITVBOX. This does not mean that no information is held on our servers. We process account, subscription, device, signing-authorization, and installation-management information needed to operate the Service. Legacy installation methods may differ, as explained below.
1. Information we collect and use
- Account and contact information: information you provide when registering, purchasing, or contacting us, such as your name, email address, account identifiers, and billing information supplied through checkout.
- Orders and subscriptions: order references, purchased services, subscription IDs and status, device allocations, billing and renewal dates, payment status, and refund or dispute records.
- Device information: UDID, device serial number where reported, device model, operating system version, registration and enrollment status, and the association between your device and subscription.
- Signing and provisioning information: certificate or developer-account assignments, provisioning profiles containing authorized device identifiers, certificate expiration information, and service-managed signing credentials needed to provision and authorize installations.
- MDM and installation information: device push tokens, management identifiers, command identifiers and status, app bundle identifiers, versions, installation manifest URLs, and errors or diagnostic information reported during installation and management.
- Network and security information: IP addresses, request times, browser or device information sent with requests, and access or error logs needed to deliver, troubleshoot, and protect the Service.
- Support information: messages, order references, screenshots, and diagnostic material you choose to submit, along with our responses.
Information may come from you, your enrolled device, our website and apps, payment providers, or platform responses needed to deliver the Service. Which information is processed depends on the features you use; not every feature collects every category listed above.
2. Why we process this information
We use personal information to:
- Create and maintain your account, confirm payment, manage subscriptions and permitted devices, and process refunds.
- Register and provision your device, authorize credential access, deliver configuration information, and request or verify supported installations.
- Provide technical support, investigate errors, and communicate service, billing, security, or policy information.
- Protect accounts and signing resources, prevent fraud and unauthorized sharing, and investigate abuse.
- Keep necessary transaction records, resolve disputes, and comply with applicable legal obligations.
We do not treat agreement to use KTB as blanket consent for unrelated processing. Where consent is required, it must relate to the applicable purpose. If we introduce an optional use requiring additional consent, we will seek that consent before proceeding.
3. On-device files and server-side signing resources
In KTB’s on-device workflow, downloaded or imported IPA files, unpacked app files, signed output, and related working files are processed or cached on your device. The workflow does not require uploading those IPA files to our servers. The operating system may reclaim cached files, and you may need to download them again.
If the Service supplies a P12 certificate, private signing material, password, or provisioning profile to KTB, our server necessarily stores or accesses the resources needed to supply them. A provisioning profile may contain device identifiers. Credentials you import yourself are handled locally by that workflow unless a separate feature expressly asks you to send them elsewhere.
For tvOS local installation, the Service may store a manifest containing app metadata and a temporary loopback address for the signed IPA on your Apple TV. The system installer reads that file from the device; the manifest and installation status are different from the IPA itself.
When you use Wi-Fi import, your device temporarily accepts uploads over a local-network HTTP service. Use a trusted network; local HTTP traffic is not encrypted like HTTPS. Stop the service when finished and do not expose its address to the public internet.
KODITVBOX also operates legacy installation services and distributes its own KTB app. Those processes may prepare or host signed packages on the server. The local-processing description above applies to the KTB on-device workflow, not automatically to every historical service or a file you voluntarily send to support.
4. MDM enrollment and app information
If you enroll a device in MDM, it communicates with our management service and Apple’s push-notification infrastructure. Depending on the operating system and profile, the management service can receive device information and information about managed apps, including app identifiers, configuration, and installation status. A background check may request the list of managed apps to reconcile the installation status shown in KTB.
These management records can reveal which managed apps are associated with your device. App installation status is not the same as viewing history or the contents of third-party apps. Third-party apps may collect their own information under their own policies; we cannot make privacy promises on their behalf.
Review the permissions displayed before installing an MDM profile. Removing it ends that enrollment relationship and may remove managed apps and local app data, but does not itself erase server-side records, cancel billing, or remove information already provided to third parties.
5. Payments through PayPal and Stripe
PayPal and Stripe process payments and, where selected, recurring billing. They may collect payment details, billing information, device or transaction information, and information used for payment security and fraud prevention. Payment details entered into their payment interfaces are processed by those providers.
KODITVBOX receives information needed to identify and administer the payment, such as transaction references, payment status, amounts, and customer or billing information made available by the provider. Do not send full card numbers, security codes, or banking credentials to our support email.
Their handling of information is also governed by their own policies: PayPal Privacy Statement and Stripe Privacy Policy.
6. Disclosures and external services
We disclose information as reasonably necessary to operate the Service, including to:
- Apple and the developer-account resources used for provisioning: device registration, certificates, provisioning, platform verification, and push notifications may involve disclosure of device identifiers and related technical information.
- PayPal and Stripe: payment, subscription, refund, fraud-prevention, and dispute processing.
- Service providers: providers supporting hosting, storage, email, or support functions, to the extent necessary for the functions they perform.
- Legal and professional recipients: where required or permitted by law, or where reasonably necessary to investigate fraud, address a security incident, obtain professional advice, or establish, exercise, or defend legal rights.
When KTB requests a catalog, app package, image, or update from an external host such as GitHub, that host receives the network information normally associated with the request, including your IP address. Opening a support link, payment page, or Telegram contact similarly involves the selected external service. Their privacy practices are not controlled by KODITVBOX.
We do not sell personal information. Any future materially different disclosure or use will be subject to the notice and consent requirements that apply.
7. Cookies and local storage
The website and its checkout components may use cookies or similar storage for login sessions, account security, shopping carts, checkout, and service preferences. Payment providers may use their own technologies for processing and protecting transactions. Blocking these technologies can prevent some features from working.
KTB stores local settings, agreement acceptance information, installation records, and cached files needed for app features. Browser cookies and KTB’s device-local storage are separate. A cookie setting on the website does not necessarily affect information processed by an installed app or MDM enrollment.
Optional tracking or marketing technologies, if introduced, will be explained and subject to any consent requirements that apply. This policy is not authorization to enable undisclosed tracking.
8. International processing and safeguards
Our service providers and external platforms may process information in Canada or other countries. Information processed in another country may be subject to that country’s laws and lawful access by its authorities. We do not promise that all data remains in Canada.
We use safeguards appropriate to the sensitivity of information and the way it is processed. No system or transmission method can be guaranteed completely secure. Please protect your email account, activation information, device, and signing credentials. Avoid including unnecessary personal information or secrets in support attachments.
9. Retention
Account, device, subscription, and transaction records may be retained long-term for continuing service, reinstallation support, accounting, fraud prevention, and dispute handling. Cancelling a subscription, uninstalling KTB, or removing an MDM profile does not automatically delete these records.
Long-term retention does not mean we are entitled to keep all information forever. Retention must remain tied to a necessary, identified purpose or a legal requirement. Relevant factors include whether your account remains active, whether a transaction or dispute remains open, applicable recordkeeping obligations, and whether a device-to-subscription association is still needed. Operational logs and temporary installation information need not be kept for as long as transaction records.
When information is no longer necessary for an applicable purpose and no legal basis requires continued retention, it should be securely deleted or de-identified. A specific dispute, legal hold, or recordkeeping obligation may justify retaining a limited subset of records after other information is removed.
10. Access, correction, deletion, and withdrawal of consent
You may contact [email protected] to request access to your personal information, correction of inaccurate information, deletion of your account or device records, or withdrawal of consent, subject to applicable law and legitimate retention requirements.
Use your account email where possible and identify the request and relevant order or subscription. We may need proportionate verification of your identity before disclosing or changing records. Do not send an identity document or additional sensitive information unless we explain why it is necessary and how to provide it appropriately.
We will assess requests and respond within the period required by applicable law. Deletion is not always immediate or complete: records necessary for accounting, an unresolved dispute, a lawful investigation, or another applicable legal obligation may need to be retained. Where a request cannot be fully fulfilled, we will explain the applicable reason, subject to lawful restrictions.
Residual copies may remain in backups until those backups are rotated or securely removed under the applicable process. They should not be used to resume ordinary processing contrary to an accepted deletion request. Information held independently by Apple, PayPal, Stripe, or another external service is subject to that service’s own processes and applicable law.
Withdrawing information or consent necessary for provisioning, payment, or device authorization may prevent us from continuing the affected feature. We will explain relevant consequences. Please specify separately whether you also want recurring billing cancelled; deleting local app data is not a billing cancellation request.
11. Children and privacy concerns
The Service is intended for people with legal capacity to enter the service agreement, not as a service directed to children. If you believe a child has provided information without appropriate authorization, contact us so we can investigate and take appropriate action.
If you have a privacy concern, contact our privacy contact at [email protected]. You may also contact the Office of the Privacy Commissioner of Canada or another privacy authority with jurisdiction. Contacting us does not prevent you from exercising a statutory complaint right.
12. Policy updates
The full, current published policy is available at www.koditvbox.tv/privacy-policy/. In-app privacy text is a summary. Refer to this page for the latest published policy; no summary or policy update overrides applicable privacy law or permits processing that requires consent without obtaining it.
We will update the date when revising this policy and provide appropriate notice of material changes. Where a new purpose or processing activity requires fresh consent, we will obtain it before proceeding. An update does not retrospectively authorize a use that was not permitted when information was collected.
Privacy contact: KODITVBOX — [email protected].