Your Live TV Player.
Without Compromises.

We take the protection of your personal data very seriously. This Privacy Policy informs you in accordance with Art. 13 GDPR about the type, scope, and purpose of processing personal data within our website, the app "ViPDashPlayer Pro", and our support forum.

1. Data Controller (within the meaning of the GDPR)
ViPDashPlayer (owner: Thorsten Burmann), Lüneburger Str. 23a, 21368 Dahlenburg, Germany
E-mail: vipdashplayer@web.de

2. Website Hosting (Data Processing Agreement)
This website is hosted by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. A Data Processing Agreement (DPA) under Art. 28 GDPR is in place with Strato. All data is processed exclusively on servers located within the European Union. Strato privacy policy: strato.de/datenschutz

2a. Content Delivery Network & security proxy (Cloudflare)
Our website is delivered via the content delivery network of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Cloudflare is placed in front of our server as a proxy in order to protect the site (including against overload/DDoS attacks) and to deliver it faster. For technical reasons, Cloudflare processes each visitor's IP address as well as connection and security data on every page request. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security, availability and performant delivery). A Data Processing Agreement under Art. 28 GDPR is in place with Cloudflare. Third-country transfer to the USA: Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework; in addition, Standard Contractual Clauses (SCC) under Art. 46(2)(c) GDPR are in place. Privacy policy: cloudflare.com/privacypolicy

2b. Database backups (server)
To ensure resilience and recoverability (integrity and availability pursuant to Art. 32 GDPR), we occasionally create backups of the database operated on the server mentioned above (Strato, EU). Such backups may contain personal data (e.g. activation codes, e-mail addresses, device and payment metadata). They are created exclusively by the operator within the password-protected admin area and only over an encrypted connection (HTTPS), can additionally be stored end-to-end encrypted (RSA-3072 + AES-256-GCM), and every backup operation is logged (accountability, Art. 5(2) GDPR). They are not shared with any third party. Backups are deleted as soon as they are no longer required for the backup purpose, and at the latest upon expiry of the retention periods applicable to the respective data. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in data security and business continuity) in conjunction with Art. 32 GDPR.

3. What Data We Process and Why

• Server log files (IP addresses): Every time you visit our website or trigger the online activation flow of the app, your device automatically transmits technical data (IP address, date, time, user agent, requested resource). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stability and security). Retention period: a maximum of 14 days, then automatic deletion.
• Activation code & device ID: When you activate the Premium version, we store an anonymized device identifier generated locally on the device (Device ID, no real name, no hardware serial number) together with your activation code. This is used to enforce the contractually agreed device limit. On each (online) activation the app additionally transmits a non-reversible device check value (hw_fingerprint – a truncated, non-reversible SHA-256 hash, not a plaintext identifier) and a device-integrity status (security flag – the result of local checks for tampering, e.g. root, emulator, debugger, hooking/clone environments or a modified app signature). These serve to enforce the device limit and to protect against multiple use, tampering and license abuse; the hw_fingerprint is stored linked to the respective device. Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(f) GDPR (protection against abuse/tampering). During the online check, the app also receives a server-signed offline ticket bound to the device ID with limited validity (currently up to 12 months), which is stored locally on your device only and enables use without a permanent internet connection; no additional personal data is stored on the server for this purpose. Legal basis: Art. 6(1)(b) GDPR (performance of contract). Retention period: for the duration of the license plus statutory commercial retention periods; the local offline ticket remains on the device until the next online check or until sign-out.
• License-abuse & sharing detection: To enforce the contractually agreed device limit and to defend against license abuse, we automatically analyse the already-mentioned pseudonymous activation data (device ID, device check value/hw_fingerprint, security flag, app version, salted IP hash, country code) for anomalies – for example one activation code on an unusually large number of devices, one device check value across several codes, or a conspicuous country/IP spread. No additional personal data is collected and no plaintext data is stored; the result is solely internal, pseudonymous indications for manual review. Any blocking is always carried out by a natural person and never by a solely automated decision (Art. 22 GDPR therefore does not apply). Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(f) GDPR (legitimate interest in defending against license abuse). Retention period: the internal indications a maximum of 180 days, then automatic deletion. In the event of such a measure, we may inform you about it via the e-mail address you provided at purchase (a contractual notice, not advertising); you can object to the assessment at any time at vipdashplayer@web.de.
• Pseudonymized app identifier (demo abuse prevention): When activating the free 7-day demo mode, the app additionally transmits a locally computed cryptographic hash (16 hex characters, truncated SHA-256) derived from Android's own pseudonymous App Set ID (Settings.Secure.ANDROID_ID) and immutable device model properties (manufacturer, model name, board, hardware variant). We expressly use no MAC address, no IMEI, no hardware serial number (Build.SERIAL) and no memory-chip identifier. The input data cannot be reconstructed from the hash. Purpose: preventing the same device installation from circumventing the 7-day demo period by repeated reinstalling or changing codes. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in abuse prevention). Retention period: 30 days after the end of the demo period, then automatic deletion. The ANDROID_ID is regenerated when your device is factory-reset; after a reset the device is treated as a new device for our demo purposes.
• Demo reuse prevention (device hash): To prevent the free 7-day demo mode from being started again on the same device after it has expired, we store in a separate blocklist exclusively a one-way, salted SHA-256 hash of the device identifier – no IP address, no device model, no other data. The input data cannot be reconstructed from the hash. Purpose: preventing repeated demo use. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in abuse prevention). Retention period: a maximum of 12 months, then automatic deletion.
• Audit log of rejected demo requests: If a demo request is refused on suspicion of multiple use, we log the date/time, device ID, the pseudonymized app identifier described above, app version, security flag and a cryptographic SHA-256 hash of the IP address (12 hex characters, salted) — never the IP address in plaintext. The IP address cannot be reconstructed from the hash. This information serves solely for traceability in support requests ("why was my demo rejected?"). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in abuse prevention and support). Retention period: 90 days, then automatic deletion.
• Device change log: When you remove (delete) a device in the customer portal or in the device manager app, we log the type of change (delete), the affected device ID and a cryptographic hash (SHA-256) of your IP address — never the IP address in plaintext. This serves traceability for support requests and protection against misuse. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in traceability and abuse prevention). Retention period: change entries for the duration of the license; IP hashes are automatically anonymized after 90 days.
• Protection against unauthorized login attempts (login throttling): To prevent the systematic guessing of activation codes in the web customer portal and in the device manager app, on failed login attempts we briefly store a salted SHA-256 hash of your IP address and a salted SHA-256 hash of the entered code together with a timestamp — never the IP address or the code in plaintext. The original inputs cannot be reconstructed from the hashes. Purpose: defending against automated login/guessing attacks (brute force). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in IT security). Retention period: a maximum of 24 hours, then automatic deletion.
• Page view statistics: For anonymous analysis of our website usage, we store a SHA-256 hash of your IP address, the page visited and a timestamp per page view. Your IP address is never stored in plaintext. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in website usage analysis). Retention period: a maximum of 180 days, then automatic deletion.
• Download statistics (app downloads): When you download one of our Android apps – the player (demo) or the Device Manager app – we store, for anonymous reach and abuse analysis, a salted SHA-256 hash of your IP address, the country or city derived from the country code, the downloaded variant (32-bit, 64-bit or Manager), the transmitted user agent and a timestamp. Your IP address is never stored in plaintext and cannot be reconstructed from the hash. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reach measurement and abuse prevention). Retention period: a maximum of 180 days, then automatic deletion.
• Consent documentation: When purchasing a license, we store the timestamp of your agreement to our Terms and Privacy Policy, the timestamp of your waiver of the right of withdrawal (§ 356(5) BGB), the PayPal transaction ID as proof, and your e-mail address. In the forum, we store the timestamp of your privacy consent as well as the timestamp of your acceptance of the board rules, each together with a SHA-256 hash of your IP address. This serves our accountability obligation under Art. 5(2) GDPR. Legal basis: Art. 6(1)(c) GDPR (legal obligation). Retention period: for the duration of statutory retention periods (at least 3 years after the end of the contract pursuant to § 195 BGB, up to 10 years pursuant to § 147 AO for tax-relevant transactions).
• Technical PayPal webhook log (payment & refund security): When automatically processing PayPal payment and refund notifications (webhooks), we keep a technical server log to make payments, cancellations and refunds traceable and to detect abuse (e.g. forged or duplicate notifications). It stores only pseudonymous PayPal event and transaction identifiers, a salted SHA-256 hash of the IP address and, in error cases, a masked e-mail address (e.g. "a***@provider.com") — no plaintext master data and no payment-method or account data. The binding purchase/transaction records themselves are held in the customer database (see "Consent documentation") and at PayPal. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in IT security and traceability of payments). Retention period: the log is automatically discarded and started anew once it reaches 5 MB; it serves solely for short-term technical traceability.
• Deletion log (accountability record): When an administrator or the system deletes an account, license or device, we store — to fulfil our accountability obligation (Art. 5(2) GDPR) — an audit entry documenting that and when the deletion took place (timestamp, initiating party, license or device identifier, plan, price, reason). Any associated e-mail address is stored exclusively as a salted SHA-256 hash — never in plaintext; it cannot be reconstructed from the hash. This means no plaintext contact data survives a deletion, while the proper deletion itself remains verifiable (e.g. if a supervisory authority enquires). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in being able to demonstrate proper deletions) in conjunction with Art. 5(2) GDPR. Retention period: for the duration of statutory limitation and retention periods.
• Location determination for VAT (buyer's country): When you purchase a license, we determine the buyer's country in order to apply the correct VAT treatment and to comply with our tax record-keeping and reporting obligations (in particular the EU One-Stop-Shop scheme and the location evidence required under Art. 24f of the EU VAT Implementing Regulation). The authoritative source is the billing/country code transmitted by PayPal. As an additional item of location evidence permitted under EU law, we derive the buyer's country from the country code provided by our upstream security/CDN service Cloudflare via the "CF-IPCountry" header. In doing so we do not process or store any IP address — we only receive and store the two-letter country code (e.g. "DE"). Legal basis: Art. 6(1)(c) GDPR (compliance with a legal — here tax — obligation) in conjunction with § 22 UStG. Retention period: until the statutory, in particular tax-related, retention periods expire (up to 10 years pursuant to § 147 AO / Art. 63c EU VAT Implementing Regulation).
• Support forum (custom software): Our forum is a custom PHP application running on the same server (Strato, EU). We store your chosen username, your e-mail address (for Magic-Link/OTP login) and the posts you publish yourself. Once logged in, you may optionally set a password; this is stored exclusively as a cryptographic hash (bcrypt/Argon2) and never in plaintext. If you use the "Keep me signed in" option at login, we additionally store a randomly generated remember token in an HttpOnly cookie and in the database so that you don't have to request a new OTP code on every visit. To prevent spam and abuse, we also briefly store a salted SHA-256 hash of your IP address (table forum_rate_limits) together with the type of action (e.g. login attempt, post creation) and a timestamp in order to limit the number of attempts per time window. For general page-view statistics (table page_views) your IP address is stored exclusively as a SHA-256 hash, never in plaintext. Legal basis: Art. 6(1)(b) GDPR (contract initiation/performance), or Art. 6(1)(a) GDPR (consent for forum posts); for rate limiting and remember tokens Art. 6(1)(f) GDPR (legitimate interest in abuse prevention and user convenience). Retention period: forum account and posts until you request deletion; remember tokens until logout or expiry (max. 30 days); rate-limit IP hashes a maximum of 24 hours, then automatic deletion.
• Sending login & transaction e-mails (Resend): For sending login codes (forum) and license e-mails (purchases) we use the e-mail service Resend by Resend Inc., Delaware (USA). Only your e-mail address and the respective mail content are transferred. Legal basis: Art. 6(1)(b) GDPR. Note on the actual sending location: The actual mail delivery is handled via Amazon SES infrastructure in the region eu-west-1 (Dublin, Ireland) and therefore takes place within the European Union. Only account metadata and delivery statistics in the Resend dashboard are processed in the USA. Third-country transfer to the USA: For this part, Resend is certified under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR are in place. A data processing agreement under Art. 28 GDPR with Resend Inc. is in place (automatically effective upon signup via the Resend Terms). Retention period: login codes are discarded immediately after sending; license e-mails are archived until the statutory retention periods expire.
• Contact form (contact.php): When you write to us via the contact form, we process the data you provide (optionally your name, your e-mail address, subject and message) in order to answer your enquiry; delivery is handled via the Resend service mentioned above. To prevent spam/abuse we briefly store a salted SHA-256 hash of your IP address with a timestamp — never in plain text. Legal basis: Art. 6(1)(b) GDPR (pre-contractual/contractual enquiries) or Art. 6(1)(f) GDPR (answering other enquiries, abuse prevention). Retention period: your message for as long as needed to process your enquiry and any follow-up; the rate-limit IP hash a maximum of 1 hour.
• Post reports & moderation (forum): When you report a forum post, we store your (pseudonymous) reporter ID, a salted SHA-256 hash of your IP address, the stated reason, and the status and timestamp — in order to process reports and detect abuse. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in content moderation and security). Retention period: until the report has been resolved plus a reasonable evidence period.
• Cookies & sessions: We use only technically necessary session cookies (PHPSESSID) to maintain your login state in the dashboard and forum. We do not use any tracking, analytics or advertising cookies. Legal basis: § 25(2)(2) TDDDG, Art. 6(1)(f) GDPR. Retention period: until the end of the browser session or logout.
• Online withdrawal function: If you withdraw from a contract via our withdrawal function (vipdashplayer.net/widerruf.php), we store the data you provide (name, e-mail address, optionally order/transaction ID and message), a timestamp and a SHA-256 hash of your IP address (never in plain text, for spam prevention). This serves to receive, confirm and document your withdrawal declaration. Legal basis: Art. 6(1)(c) GDPR (legal obligation to provide a withdrawal function) and Art. 6(1)(f) GDPR (legitimate interest in abuse prevention). Retention period: for the duration of the statutory retention and proof periods.
• GDPR request form (abuse prevention): If you submit a request to exercise your data-subject rights via our online form (vipdashplayer.net/privacy_request.php), we briefly store a salted cryptographic SHA-256 hash of your IP address together with a timestamp to prevent mass/spam submissions — never the IP address in plaintext. The IP address cannot be reconstructed from the hash. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in abuse prevention). Retention period: a maximum of 1 hour, then automatic deletion.

4. Payment Processing (PayPal)
When you purchase a license, payment is processed exclusively via PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. We ourselves do not receive or store any credit card, bank account or payment data — we only receive a payment confirmation and the transaction details required to fulfil the contract. Legal basis: Art. 6(1)(b) GDPR.
Note on third-country transfer: PayPal may transfer data to the USA for intra-group purposes. PayPal provides Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR for this purpose and is certified under the EU-U.S. Data Privacy Framework.
PayPal privacy policy: paypal.com/webapps/mpp/ua/privacy-full

5. Data Processing inside the App (Zero-Cloud)
The "ViPDashPlayer Pro" app contains no analytics, advertising or crash trackers (no Google Firebase Analytics, no Crashlytics, no AppsFlyer or similar). Your playback behavior (which streams or channels you watch) is neither collected, stored nor shared with third parties.

Remote-control web dashboard (NanoHTTPD): If you enable the built-in dashboard, the app starts a PIN-protected, TLS-encrypted web server on your device. It can be accessed (a) locally on your own Wi-Fi or (b) from the internet if you set up port forwarding on your router yourself. In both cases the connection runs directly between your browser and your device – it is not routed through our servers and we have no access to it. To display the reachable address, the app can determine your internet connection's public IP address via an external service (api.ipify.org, checkip.amazonaws.com or icanhazip.com, USA); in doing so your IP address is technically transmitted to that service. Legal basis: Art. 6(1)(b) GDPR (feature requested by you).

Encrypted backups (AES-GCM): Backups of your settings and playlists are encrypted using AES-GCM and stored exclusively locally on your device or on the storage location you choose (USB, NAS). We have no access to backup contents at any time.

Optional support log (disabled by default): The app contains a switch you can voluntarily enable (Settings → Device Info → "Support log"). Only if you turn this switch on yourself does the app collect technical diagnostic data (e.g. playback events, error and network messages, device model, app and Android version) in a ring buffer in the device's memory. Explicitly, NONE of your M3U playlist links, NO EPG source addresses, NO stream or server addresses and NO credentials (username, password, access tokens) are recorded. Before any line is written to the diagnostic buffer at all, it automatically passes through a filter that irreversibly replaces every internet address (URL), server name, IP and MAC address and any credentials with placeholders – when in doubt, it removes too much rather than too little. No personal master data is recorded either. This data is not saved or transmitted automatically. The switch turns itself off automatically after no more than 5 minutes, so no unintended permanent logging can occur. Only when you actively choose "Export log" is the buffer content encrypted (RSA-3072 key wrapping + AES-256-GCM) and written as a .vlog file to your device's Downloads folder. You then decide yourself whether and when to send us this file for troubleshooting. Only we can decrypt it, using the corresponding private key; without this file and without the switch enabled, no diagnostic data is processed at all. Legal basis: Art. 6(1)(a) GDPR (your consent, given by enabling the switch and voluntarily sending the file). You can turn the switch off again at any time; the memory buffer is then cleared immediately. Retention period: the in-memory buffer only until you disable the switch or close the app; a .vlog file sent to us only for as long as required to handle your support request, then deleted.

5b. Voice search (microphone) – optional, disabled by default
The player includes an optional voice search. It is off by default and only appears after you enable it in the settings; in addition, the app requests the Android "Microphone" permission (RECORD_AUDIO) the first time you tap the microphone icon. Once enabled, your speech input is passed to your device's speech-recognition service (on most devices, Google) and converted to text there. This processing of the audio is carried out by the provider of the respective speech-recognition service under its own privacy terms; this may involve a transfer to third countries (e.g. the USA). We ourselves do not record, store or transmit any audio to our server – the app only receives the recognized text and enters it into the search field. Legal basis: Art. 6(1)(a) GDPR (your consent by enabling the feature and granting the microphone permission). You can disable the feature at any time in the settings and revoke the permission in the Android system settings.

5c. Optional per-playlist VPN (WireGuard)
You can optionally import your own WireGuard configuration (.conf / wg-quick) and assign it to individual playlists so that their streaming connection runs through a VPN tunnel. The configuration files come exclusively from you and are stored AES-256-encrypted in the app-private storage of your device; they are not transmitted to our server. The VPN server is operated not by us but by the provider you choose – the data passing through the tunnel is subject to that provider's privacy policy. Legal basis: Art. 6(1)(b) GDPR (feature requested by you). Retention period: until you delete the respective profile.

5d. Cross-device playback on your home network (mesh)
So that you can resume ongoing playback on another ViPDashPlayer device on the same network, the app registers a service on the local network (Wi-Fi/LAN) via mDNS and looks for other ViPDashPlayer devices. In doing so, only the current playback status (paused/playing), the currently played channel/stream address, the playback position and a device name (device model) are made available within your local network. This data does not leave your local network and is not sent to our servers or any third party. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in convenient cross-device operation within your own network).

5e. Automatic app updates (updates outside the Play Store)
If the app is obtained outside the Google Play Store, on startup and on manual request it retrieves a static version file from our server over an encrypted connection (HTTPS) to check whether a newer version is available. We do not carry out any further processing of personal data in doing so; for server-side logs, section 3 ("Server log files") applies. If a newer version is available, the app can download the matching installation file (APK) over HTTPS; before installation, the signature of the downloaded file is compared with that of the installed app, and the installation only starts after your confirmation via the Android system. This requires the "Install unknown apps" permission (REQUEST_INSTALL_PACKAGES). Legal basis: Art. 6(1)(b) and (f) GDPR (provision of updates and legitimate interest in security/currency).

5f. Access to local files and recordings
For importing/exporting playlists and backups, for timeshift, and for the optional recording feature (PVR), the app accesses the storage you choose (device, USB, NAS, or SMB network shares you configure). This content remains local on your storage; we have no access to it and do not transmit it. Credentials for SMB network shares you set up and any profile names you create (multi-profile) are likewise stored only locally on your device. Legal basis: Art. 6(1)(b) GDPR.

5g. Note on unencrypted connections
Because you embed your own content/playlists, the player may also establish unencrypted connections (HTTP) to the sources you specify if they do not offer HTTPS. We have no influence over the security of these third-party sources embedded by you. Communication with our own servers (activation, update check, companion app) always takes place encrypted (HTTPS).

5a. Companion app "VIP Dash Player Manager" (device management)
The separate companion app "VIP Dash Player Manager" is used solely to manage the devices linked to your activation code (view, name and delete devices). Devices bind automatically when the player starts; manually adding or changing the technical device ID is no longer provided.

Device names (aliases): In the app and the web customer portal you can optionally give your devices a freely chosen display name so you don't have to remember the technical device IDs. This name is stored on our server and linked to your license and the respective device so that it is shown both in the app and in the web customer portal. Providing it is optional and the name is freely chosen; please do not enter sensitive or special-category personal data. Legal basis: Art. 6(1)(b) GDPR (performance of the contract as part of convenient device management). You can change or remove the display name at any time in the app or the customer portal. Retention period: until you remove the name or the associated device is deleted.

Transmitted data: When signing in, your activation code is sent once over a TLS-encrypted connection (HTTPS with certificate pinning) to our server to verify your access. After that, the app manages only your device IDs. The app does not store the activation code permanently, only a random, revocable session token that is stored encrypted on the device using the Android Keystore (AES-256-GCM).

Server-side logging: The time of a device action and your IP address are stored solely as a non-reversible SHA-256 hash – never in plain text. All communication is exclusively encrypted (HTTPS). The app contains no analytics, advertising or tracking components and requires only the INTERNET permission. Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR (protection against abuse/multi-use). In addition, we record on your license the time of the first and last app login as well as the number of logins, so that, in the context of support and abuse prevention, we can tell whether and when the management app is used; these markers contain no IP address. Retention period: session tokens expire after 90 days of inactivity and are removed automatically on the server; the device assignment and the aforementioned login markers exist as long as your access is active. Using "Sign out" revokes the session token on the respective device.

6. Your Rights as a Data Subject
Under the GDPR you have the right at any time to:

• access the data stored about you (Art. 15 GDPR)
• have inaccurate data corrected (Art. 16 GDPR)
• have your data erased (Art. 17 GDPR)
• restrict processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing (Art. 21 GDPR)

No automated decision-making producing legal or similarly significant effects within the meaning of Art. 22 GDPR takes place. Technical protective measures (e.g. device or login blocks to prevent abuse) are purely rule-based and have no such effect.

To exercise these rights, an informal e-mail to the address listed under section 1 above is sufficient. Alternatively, you can submit your request directly via our GDPR request form. Processing takes place within one month (Art. 12 para. 3 GDPR) and is free of charge.

7. Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)
You have the right to lodge a complaint with a data protection supervisory authority at any time if you believe that the processing of your personal data violates the GDPR. The competent authority for our place of business is:

The State Commissioner for Data Protection of Lower Saxony
Prinzenstraße 5
30159 Hannover, Germany
lfd.niedersachsen.de

Last updated: 2026-07-28 · Version 2.0

Quick navigation: § 1 Scope · § 2 Service · § 3 Conclusion · § 4 Prices · § 5 Delivery · § 6 Withdrawal · § 7 No Refund · § 8 License · § 9 Duties · § 10 Warranty · § 11 Liability · § 12 Privacy · § 13 Support · § 14 ADR · § 15 Changes · § 16 Discontinuation · § 17 Final

§ 1 Scope, Provider, Contracting Parties

(1) These Terms and Conditions ("T&C") apply to all contracts concluded via the website vipdashplayer.net between the provider and the customer regarding the purchase of digital license keys ("activation codes") for the software "ViPDashPlayer Pro".
(2) Provider and contracting party: ViPDashPlayer (owner: Thorsten Burmann), Lüneburger Str. 23a, 21368 Dahlenburg, Germany, e-mail: vipdashplayer@web.de. Further provider details are listed in the Imprint.
(3) Customer within the meaning of these T&C is any natural or legal person who enters into a contract with the provider. Offers are directed at both consumers (§ 13 BGB) and entrepreneurs (§ 14 BGB).
(4) The version of these T&C valid at the time of contract conclusion is decisive. Any deviating, conflicting or supplementary general terms of the customer shall only become part of the contract if and to the extent the provider has expressly agreed to their validity in writing.

§ 2 Subject of the Contract, Description of Services

(1) The subject of the contract is solely the provision of a digital activation code to unlock the premium features of "ViPDashPlayer Pro" (a media player application for Android TV / Leanback). The feature set and term depend on the tariff selected by the customer. Current tariffs are available on the pricing page.
(2) ViPDashPlayer Pro is purely a blank software (media player). No content, channels, movies, series, streams, playlists, subscriptions or references to commercial streaming services are sold, delivered, preloaded or otherwise provided. The customer is solely responsible for importing and playing back only such content for which they hold the necessary rights.
(3) The player does not circumvent any technical protection measures within the meaning of § 95a UrhG. All DRM handling (e.g. ClearKey, Widevine) is performed exclusively through the official Android / Media3 interfaces. Detailed information is provided in the Disclaimer & Licenses.
(4) The non-binding service descriptions on the website do not constitute a binding offer by the provider but an invitation to the customer to submit a binding purchase offer (invitatio ad offerendum).

§ 3 Conclusion of the Contract

(1) The order process works as follows: (a) selecting the desired tariff on the pricing page, (b) entering the required order data (e-mail), (c) acknowledging these T&C and the Privacy Policy, (d) expressly consenting to early commencement of contract execution and to the expiration of the right of withdrawal (mandatory checkbox, see § 6), (e) redirect to PayPal and completion of payment.
(2) By clicking the order / PayPal button, the customer submits a binding offer. The contract is concluded upon payment confirmation via PayPal and subsequent provision of the activation code by e-mail or in the customer portal.
(3) The contract text (order data + T&C + withdrawal instructions) is stored by the provider and sent to the customer in text form by e-mail (§ 312f BGB). The currently valid T&C can be viewed, downloaded and saved at any time on the website.
(4) Contract languages are German and English.

§ 4 Prices and Payment

(1) The prices displayed on the pricing page at the time of ordering apply. All prices are final prices in euros. Under the small-business rule pursuant to § 19 UStG (German VAT Act), no VAT is shown.
(2) Payment is processed exclusively through PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. The PayPal terms of use and privacy notices apply additionally.
(3) The provider does not receive or store any credit card, bank account or payment data of the customer — only the payment confirmation and the transaction details required for contract performance.
(4) The purchase price is due immediately upon conclusion of the contract.

§ 5 Delivery, Provision of the Activation Code

(1) Delivery is digital only. After successful payment confirmation, the customer receives the activation code without undue delay (usually within minutes) by e-mail and additionally in the customer portal.
(2) The customer is obliged to provide a valid, regularly checked e-mail address and is responsible for any delivery issues (e.g. full mailbox, spam filter).
(3) Should the activation code fail to arrive for technical reasons, the customer shall contact the provider at the e-mail address listed in § 1(2); the provider will re-send or regenerate the code without undue delay.

§ 6 Withdrawal Instructions for Consumers

Right of Withdrawal
You have the right to withdraw from this contract within fourteen days without giving any reason. The withdrawal period is fourteen days from the day of the conclusion of the contract.

To exercise the right of withdrawal, you must inform us — Thorsten Burmann (ViPDashPlayer), Lüneburger Str. 23a, 21368 Dahlenburg, Germany, e-mail: vipdashplayer@web.de — of your decision to withdraw from this contract by an unequivocal statement (e.g. a letter sent by post, an e-mail or conveniently via our online withdrawal function at vipdashplayer.net/widerruf.php). You may use the model withdrawal form below, but it is not obligatory.

To meet the withdrawal deadline, it is sufficient for you to send your communication concerning the exercise of the right of withdrawal before the withdrawal period has expired.

Effects of Withdrawal
If you withdraw from this contract, we shall reimburse to you all payments received from you, including the costs of delivery (with the exception of the supplementary costs resulting from your choice of a type of delivery other than the least expensive type of standard delivery offered by us), without undue delay and not later than fourteen days from the day on which we are informed about your decision to withdraw from this contract. We will carry out such reimbursement using the same means of payment as you used for the initial transaction, unless you have expressly agreed otherwise; in any event, you will not incur any fees as a result of such reimbursement.

IMPORTANT — EARLY EXPIRATION OF THE RIGHT OF WITHDRAWAL:
For a contract on the supply of digital content not delivered on a tangible medium, the right of withdrawal expires under § 356(5) BGB if the provider has begun execution of the contract after the consumer has (a) expressly consented to execution beginning before the end of the withdrawal period, (b) confirmed awareness that the right of withdrawal expires upon such consent and commencement, and (c) been provided with a confirmation in text form pursuant to § 312f BGB.

By clicking the mandatory checkbox in the order process ("Yes, I expressly consent to the commencement of contract execution before the expiry of the withdrawal period. I acknowledge that my right of withdrawal expires upon commencement of execution."), the consumer provides this consent. The right of withdrawal therefore expires definitively upon generation and dispatch or deposit of the activation code.

Model Withdrawal Form (pursuant to Annex 2 of Art. 246a § 1(2)(1)(1) EGBGB)
(If you wish to withdraw from the contract, please complete and return this form.)

To: Thorsten Burmann (ViPDashPlayer), Lüneburger Str. 23a, 21368 Dahlenburg, Germany, e-mail: vipdashplayer@web.de

I/We (*) hereby give notice that I/we (*) withdraw from my/our (*) contract for the sale of the following goods (*) / the provision of the following service (*):
_______________________________________________

Ordered on (*) / received on (*): _______________
Name of consumer(s): _______________
Address of consumer(s): _______________
Signature of consumer(s) (only if this form is notified on paper): _______________
Date: _______________

(*) Delete as appropriate.

§ 7 No Refund After Full Performance of the Contract

REFUND ONLY UNTIL THE RIGHT OF WITHDRAWAL EXPIRES:
The product offered here consists exclusively of digital content (a software activation code). You may withdraw from the contract within the period pursuant to § 6 as long as the right of withdrawal has not yet expired. Pursuant to § 356(5) BGB it expires only once you have expressly consented to us beginning performance before the end of the withdrawal period, have confirmed your knowledge of the loss of the right of withdrawal, and we have begun providing the activation code. Only after this effective expiry are a withdrawal and a (partial) refund of the purchase price excluded.

Unaffected by this are your mandatory statutory warranty rights in the event of a defective product pursuant to §§ 327 et seq. BGB (see § 10 of these T&C) as well as any goodwill we may grant.

§ 8 Rights of Use, License, Device Limit

(1) Upon receipt of payment, the customer receives a simple, non-exclusive, non-transferable and non-sublicensable right to use the premium features of "ViPDashPlayer Pro" within the tariff purchased and for its duration.
(2) The activation code may only be used within the device limit agreed at the time of purchase (e.g. 1 or 5 simultaneously active devices). Management of linked devices takes place in the customer portal. Sharing, making publicly available, commercially renting or publishing the code is prohibited.
(3) In case of a justified suspicion of account sharing, circumvention of the device limit or other misuse, the provider is entitled, after one warning, to permanently block the affected activation code without refund.
(4) Decompilation, reverse engineering, removal of protection mechanisms or modification of the software is only permitted within the limits strictly allowed by law (§§ 69d, 69e UrhG).

§ 9 Customer Obligations, No Circumvention, Content Responsibility

(1) The customer is solely responsible for which content, playlists or streams they import into and play back through the software. The customer warrants that they hold the required rights or consents from the rights holders.
(2) Use of the software to play back copyright-protected content without the required permission of the rights holder is prohibited. Any third-party claims resulting therefrom shall be borne solely by the customer.
(3) The customer shall indemnify the provider against all third-party claims arising from unlawful use of the software by the customer, including reasonable costs of legal defense.
(4) The customer shall treat login credentials for the customer portal and the activation code as confidential and protect them from access by unauthorized third parties.

§ 10 Warranty

(1) Statutory warranty provisions apply. For defects of the software, the provider is liable towards consumers under §§ 327 et seq. BGB (consumer contract for digital products) or, in business dealings, under §§ 434 et seq. BGB.
(2) In case of a defect, the customer is initially entitled to supplementary performance (restoration of the contractual condition). If this fails or is refused, the customer may reduce the price or — in the case of not insignificant defects — withdraw from the contract.
(3) Insignificant deviations of the delivered software from the descriptions on the website do not constitute a defect. In particular, the provider is not liable for the permanent compatibility of specific streaming formats, playlists or third-party services of the customer, provided the software conforms to generally accepted standards (HLS, DASH, MP4, M3U).

§ 11 Liability

(1) The provider is liable without limitation in cases of intent and gross negligence, for injury to life, body or health, under the provisions of the German Product Liability Act, and within the scope of any guarantee assumed by the provider.
(2) In the case of slightly negligent breach of a duty whose fulfillment is essential for the proper execution of the contract and on which the customer may regularly rely (cardinal duty), the liability of the provider is limited to the foreseeable damage typical of the contract at the time of its conclusion.
(3) Otherwise, liability for slightly negligent damages is excluded.
(4) The provider is not liable for the continuous availability of the app on third-party platforms (e.g. Google Play Store, Amazon Appstore) or for damages arising from the use of incompatible streams by the customer.
(5) Any further liability of the provider is excluded. Detailed user-responsibility information is provided in the Disclaimer.

§ 12 Data Protection

The collection and processing of personal data of the customer is governed exclusively by the provider\'s Privacy Policy, which is accessible at any time via the corresponding link in the footer of the website and acknowledged by confirming the corresponding checkbox in the order process.

§ 13 Customer Support

(1) Customer support is provided by e-mail at vipdashplayer@web.de as well as via the public Support Forum.
(2) No specific response time is guaranteed unless the selected tariff expressly specifies otherwise.

§ 14 Consumer Dispute Resolution (§ 36 VSBG)

The European Commission provided an online dispute resolution (ODR) platform until 20 July 2025; this platform has been shut down following the repeal of Regulation (EU) No 524/2013 by Regulation (EU) 2024/3228 and is no longer available.
The provider is neither willing nor obliged to participate in dispute resolution proceedings before a consumer arbitration board (§ 36(1)(1) VSBG).

§ 15 Amendment of these T&C

(1) The provider is entitled to amend these T&C with effect for the future, insofar as this is necessary for compelling reasons — in particular due to changes in legislation, supreme court case law, technical changes or extensions of the scope of services — and does not unreasonably disadvantage the customer.
(2) The changes shall be notified to the customer in text form at least six weeks before their planned entry into force. If the customer does not object within this period, the changes shall be deemed accepted; the customer will be expressly informed of this in the notification of amendment.
(3) For individual contracts that have already been fully performed (in particular for activation codes already delivered), the version valid at the time of contract conclusion remains applicable.

§ 16 Availability, Updates and Discontinuation of Service

(1) The provider is under no obligation to operate, maintain, update or further develop the software "ViPDashPlayer Pro", the associated website or the activation server indefinitely. The customer has no claim to specific updates, new features or permanent availability of the infrastructure.
(2) The provider may discontinue operation of the software, the website or individual services (e.g. activation server, customer portal, forum) in whole or in part at any time. Licenses already paid for remain usable until the end of their respective term; beyond that, no further obligations arise for the provider — in particular no right to a refund, further development, substitute performance or damages for lost use.
(3) After the last successful server contact, the app remains usable without an internet connection for the remaining validity of a signed offline ticket (currently up to 12 months from the last contact). Should the activation server or online verification therefore be permanently shut down, already-activated devices continue to work for that remaining validity; beyond that, the provider will endeavour to provide an offline activation mechanism or a final working version of the app, but is not obliged to do so.
(4) Material changes (e.g. reduction of functionality) or complete discontinuation of the service will — where reasonable — be communicated to the customer in advance with appropriate notice by e-mail or on the website.

§ 17 Final Provisions

(1) The law of the Federal Republic of Germany applies exclusively, to the exclusion of the UN Convention on Contracts for the International Sale of Goods (CISG). Mandatory consumer-protection provisions of the state in which the consumer has his habitual residence remain unaffected.
(2) If the customer is a merchant, legal entity under public law or a special fund under public law, the exclusive place of jurisdiction for all disputes arising from this contractual relationship is the registered office of the provider.
(3) Should individual provisions of these T&C be wholly or partly invalid, the validity of the remaining provisions shall not be affected. The invalid provision shall be replaced by the statutory regulation.
(4) Side agreements, changes or additions to this contract require text form to be effective. This also applies to any waiver of this text-form requirement.

Related documents: Privacy Policy · Imprint · Disclaimer & Licenses

LEGAL DISCLAIMER:
ViPDashPlayer Pro is solely a media player application (blank software). The app does NOT contain any pre-loaded media content, channels, movies, series, playlists or references to commercial streaming services. The user is solely responsible for providing their own content or playlists (M3U/URL) and for only playing back content for which they hold the necessary rights.

NO CIRCUMVENTION OF TECHNICAL PROTECTION MEASURES:
The player does not circumvent any technical protection measures within the meaning of § 95a UrhG. All DRM handling (e.g. ClearKey, Widevine) is performed exclusively through the official Android / Media3 interfaces. The player does not generate licence keys, does not manipulate CDM sessions and does not convert between DRM schemes. Hardware DRM is executed entirely by the device's hardware-backed Trusted Execution Environment, not by the player.

NO AFFILIATION WITH THIRD-PARTY PROVIDERS:
The developer has no business, contractual or promotional affiliation with any commercial streaming or pay-TV provider. The developer expressly does not permit, endorse or promote the use of this player for streaming copyright-protected material without the explicit permission of the copyright holder. Any user who does so acts entirely on their own responsibility.

OPTIONAL SUPPORT LOG:
The app includes an optional diagnostic log that is disabled by default (Settings → Device Info → "Support log"). It only becomes active if the user enables the switch themselves, and then collects purely technical diagnostic data in the device's memory. Explicitly, NO M3U playlist links, NO EPG source addresses, NO stream or server addresses and NO credentials are recorded – an automatic filter replaces every internet address, server name, IP/MAC address and any credentials with placeholders before a line ever reaches the buffer. The switch turns itself off automatically after no more than 5 minutes. An export creates an encrypted .vlog file in the local Downloads folder; it is only transmitted to support if the user sends the file themselves. No data is transferred automatically. Details are set out in the Privacy Policy (section 5).

DEMO CONTENT & SCREENSHOTS:
The screenshots shown on this website use a purely fictional demo data set (invented channel, movie and series names, self-made logos and sample EPG data – with no connection to any real provider or content). The only video that actually plays in every demo entry is the freely usable short film "Big Buck Bunny" (© copyright 2008, Blender Foundation / www.bigbuckbunny.org), licensed under Creative Commons Attribution 3.0 (CC BY 3.0). The film is used without modification.

OPEN SOURCE LICENSES & LIBRARIES:
This application uses open-source software and assets.

ANDROID APPLICATION LIBRARIES:
• AndroidX (Core, AppCompat, Lifecycle, Leanback, Room, WorkManager, Security-Crypto) - © Google LLC (Apache 2.0)
• Media3 (ExoPlayer, DASH, HLS, UI, Session) - © Google LLC (Apache 2.0)
• Material Components - © Google LLC (Apache 2.0)
• Kotlinx Coroutines - © JetBrains s.r.o. (Apache 2.0)
• OkHttp - © Square, Inc. (Apache 2.0)
• Coil (Image Loader) - © Coil Contributors (Apache 2.0)
• NanoHTTPD - © Paul S. Hawke, Konstantinos Togias et al. (BSD 3-Clause)
• Bouncy Castle - © The Legion of the Bouncy Castle Inc. (Bouncy Castle License / MIT-style)
• jcifs-ng - © AgNO3 GmbH & Co. KG (LGPL v2.1)
• FFmpeg - © FFmpeg developers (selbst kompiliert, dynamisch gelinkt, n6.1.1, LGPL v2.1)
• libxml2 - © Daniel Veillard (MIT License; FFmpeg-Build-Abhängigkeit für DASH)
• WireGuard for Android - © Jason A. Donenfeld & WireGuard LLC (Apache 2.0)
• XZ for Java - © Lasse Collin and contributors / Tukaani Project (BSD Zero Clause License, public domain)

WEBSITE LIBRARIES (self-hosted):
• Tailwind CSS - © Tailwind Labs, Inc. (MIT License)
• Font Awesome Free - © Fonticons, Inc. (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT)
• SweetAlert2 - © Limon Monte (MIT License)
All website libraries listed above are served exclusively from our own server (STRATO AG, EU). No third-party CDNs are used to deliver assets.

MEDIA ASSETS (DEMO / SCREENSHOTS):
• „Big Buck Bunny“ – © copyright 2008, Blender Foundation / www.bigbuckbunny.org, licensed under Creative Commons Attribution 3.0 (CC BY 3.0). Used unmodified as the demo playback stream for the website screenshots. All other demo data (channel/movie/series names, logos, EPG) is fictional and self-created.

MIT LICENSE:
Tailwind CSS and SweetAlert2 are distributed under the MIT License.
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

APACHE LICENSE, VERSION 2.0:
Several of the libraries listed above are distributed under the Apache License, Version 2.0 (apache.org/licenses/LICENSE-2.0). Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

GNU LESSER GENERAL PUBLIC LICENSE (LGPL):
FFmpeg and jcifs-ng are licensed under the GNU Lesser General Public License (LGPL v2.1). The application dynamically links to these libraries; they are not statically modified. In accordance with the LGPL, end users are entitled to receive the corresponding source code of these libraries and to relink the application with modified versions of them. Full license texts and source code can be found at:
• LGPL v2.1: gnu.org/licenses/old-licenses/lgpl-2.1.html
• FFmpeg sources: ffmpeg.org/download.html
• jcifs-ng sources: github.com/AgNO3/jcifs-ng
Source code requests for the exact LGPL library versions used in this build can also be sent by e-mail to the address listed in the Imprint.
→ Complete list of all Open Source libraries with version numbers and download links (LGPL Written Offer)

WIREGUARD FOR ANDROID (Apache License 2.0):
This application embeds the WireGuard for Android tunnel library (github.com/WireGuard/wireguard-android), © Jason A. Donenfeld and WireGuard LLC, licensed under the Apache License, Version 2.0 (apache.org/licenses/LICENSE-2.0). "WireGuard" is a registered trademark of Jason A. Donenfeld.

Last updated: 2026-07-28 · Please read before signing up.

1. Purpose of the Forum
This forum is exclusively for technical support and discussion related to the „ViPDashPlayer Pro" media player software — i.e. installation, setup, settings, supported formats (HLS, DASH, MP4, M3U), device/compatibility questions and troubleshooting. Posts unrelated to the technical use of the app are not welcome here.

2. Expressly Prohibited Content
The following posts, links, files or requests are prohibited in particular:

• Card sharing of any kind (e.g. CCcam, OSCam, Newcamd lines, sharing servers, credentials, or seeking/offering such services).
• Provider scripts, Stalker/Xtream Codes panels, portal URLs, MAC addresses or credentials of commercial pay-TV/IPTV services.
• Selling, trading, sharing or advertising IPTV subscriptions, "lines", restream servers, cutters or copyright-protected playlists (M3U) without the rights holder's consent.
• Links to illegal streams or pirated movies, series, channels or other protected content.
• Instructions for circumventing technical protection measures (§ 95a UrhG), e.g. DRM decryption or key extraction.
• Any other illegal, offensive, harmful-to-minors, discriminatory content or spam/advertising.

3. User Responsibility
Each user is solely responsible for their own posts. ViPDashPlayer is purely blank software (a media player) and ships with no content. The operator merely provides the technical platform and does not adopt user content as its own. There is no general obligation to monitor third-party content (§§ 7–10 DDG); once aware of an infringement, the relevant content is removed without delay.

4. Moderation & Consequences
The operator may edit or delete posts that violate these rules at any time and without prior notice, and may warn or permanently block the accounts concerned. In the event of serious or criminally relevant violations, the operator reserves the right to take legal action.

5. Reporting Violations (Notice-and-Action)
You can report illegal or rule-breaking content at any time to vipdashplayer@web.de — ideally with a link or screenshot and a short explanation. We review every report promptly and remove illegal content without delay once we become aware of it (notice-and-action mechanism under Art. 16 DSA, §§ 7–10 DDG).

6. Minimum Age
Registration and use of the forum are intended for persons aged 16 or older. If you are younger, use is only permitted with the consent of a parent or legal guardian.

7. Your Content & Third-Party Rights
You warrant that you hold the necessary rights to the content you post (text, images, logs, screenshots) and that you do not infringe any third-party rights. You grant the operator a simple, unrestricted right to store and display your contributions for the purpose of operating the forum. Personal data of third parties (e.g. names, addresses, credentials) may not be published without their consent.

8. Consent
By ticking the box during registration, you confirm that you have read these board rules and will comply with them. The time of consent and a cryptographic hash (SHA-256) of your IP address are stored as proof (details in the Privacy Policy).