Written 14 September 2026.
vdHStream is a media player for Samsung televisions. It provides no content of its own — no channels, no films, no catalogue. It does include one public demo playlist, so that the app can be tried without a subscription: a freely published list that we did not compile and whose streams we neither host nor control. Everything else you watch comes from a playlist you supply yourself, from a provider you have your own arrangement with. We have no relationship with that provider, and no knowledge of what your playlist contains.
Your television fetches every playlist, programme guide and stream directly — the demo one included. Our server never fetches, proxies or caches any of them, and never contacts your provider or the demo list's host at all.
vdHStream is a hobby project run by one private individual, who is responsible for the data described on this page. There is no postal address; write to [email protected].
You can add a playlist and watch without creating an account. In that state nothing about you or about what you watch is sent to us.
One thing still happens: the television asks our server for its settings — a small list of on/off values that lets us change how the app behaves without shipping an update. That request carries no account and no identifier, but like any request over the internet our server sees the address it came from while it answers.
| Data | Why |
|---|---|
| Your playlist: its address, and for Xtream providers the host, username and password | So the app can fetch your channel list without asking every time. |
| Playback positions and favourites, per profile | To resume where you stopped, and to keep your list. |
| Interface language, player, parental and search preferences | Your settings. |
| Sign-in and pairing tokens, if the television is paired to an account | To stay signed in. |
Be aware: these are stored in the television's ordinary browser storage as plain text. The app does try to put provider credentials into the television's secure key store as well, but that store is not available to it in this build, so the readable copy is the one that is used. Anyone with access to the television, or with a diagnostic connection to it, could read your provider username and password. It is stated here rather than left out, so that you can weigh it.
An account exists so that several televisions in one home share one setup. Signing in is an emailed six-digit code — there is no password. The code is stored only as a one-way hash, is valid for ten minutes, and is deleted shortly after that.
| Data | Why |
|---|---|
| Your email address, and which language to write to you in | It identifies the account and is the only way to sign in. |
| Profiles: name, avatar choice, whether it is a child profile, an optional PIN (stored as a one-way hash), an age-rating limit | Several viewers on one account. |
| Playlists: your label for it, the playlist address, the guide address. For many providers the address itself contains your provider username and password. | So a newly paired television receives your setup without anyone typing it in on a remote control. |
| Playback positions, including the title of each film, episode or channel, how far in you were, how long it ran, and whether you finished it | Continue watching, on every television in the home. |
| Favourites, including titles and a small amount of descriptive information about each one | One list across your televisions. |
| Per-profile settings: subtitle language, audio language, autoplay | Your settings follow your profile. |
| Televisions: a short public identifier, an optional name you give it, the platform, the model, the app version, when it was last seen, when its trial ends and whether it has been paid for | Pairing, the trial, and letting you remove a television you no longer own. |
| A one-way fingerprint of the television itself, worked out on the set from an identifier the television already holds. The identifier itself never leaves it. | So a television that is set up again — after reinstalling the app, or a factory reset — is recognised as the one you already have, instead of appearing on your account a second time. |
| A short one-way fingerprint of your playlist address | So two televisions with the same subscription agree on what a given programme is. |
| Sign-in tokens, stored as hashes, and short-lived records of each sync | Staying signed in, and making a retried sync safe to repeat. |
| If a television has repeatedly sent timestamps from the future, one row saying so | A clock set wrongly corrupts continue-watching; this is how it can be told apart. |
Two of those rows are worth reading twice: with an account, the titles of what you watch and of what you mark as a favourite are stored on our server, and your provider credential is stored there too. Without an account, neither is.
It is encrypted in the database with AES-256-GCM, under a key the server holds, tied to your account and to that particular playlist so that a copy of it is useless anywhere else. That protects it against a stolen or restored backup, a copy of the disk, or anyone who can read the database but cannot run the application.
It does not protect it against us, or against anyone who compromises the application itself: the server must be able to read the credential, because the whole point is that a television you pair from your phone receives a working setup it was never told. The key and the database currently live on the same machine, so anyone with full control of that machine has both.
One further detail, stated rather than glossed: the encrypted column is being introduced in two releases. Until the second ships, a readable copy of the same address is still present in the database beside the encrypted one, so that a failed release can be rolled back without breaking every television.
The app records counters about its own behaviour — how long a screen took to appear, whether it fell back to a placeholder image, which setting was changed. These are held in memory only, a few hundred entries at most, and are discarded when the app closes. There is no address they are sent to and no code in the app that sends them. They are visible on the television's own system-health screen and nowhere else.
So there is no setting to switch this off, because nothing is happening that a setting could stop. An earlier version of this page offered such a setting. That was untrue, and it is the reason this page was rewritten.
Your own playlist provider. Your television talks to them directly, so they see your requests, exactly as they would with any other player. That connection is between you and them.
Whoever hosts the demo playlist, if you try it. Your television fetches that list, and the streams it names, directly — so those hosts see your requests exactly as your own provider would. It is a list published for anyone to use; there is no arrangement between them and us, and nothing about you is passed to them by us.
The company that sends our email. Sign-in codes are sent through Resend. Your email address and the contents of that message pass through Resend and are stored on their systems in the United States.
Our hosting company. The server and its backups sit on rented hardware at Hetzner, in Falkenstein, Germany.
Cloudflare. This website and the pairing page at vdhstream.com are delivered through Cloudflare, a United States company, which sees the address of visitors to these pages in order to serve them. The app itself does not go through Cloudflare: the television talks to our server directly.
Nothing is sold, and nothing is passed to advertisers.
| Data | Kept for |
|---|---|
| Sign-in codes | Ten minutes, then deleted within five. |
| Sign-in tokens | Thirty days; expired ones are deleted every six hours. |
| Playback positions | Ninety days after you watched the thing. |
| A deleted playback position or favourite | Thirty days as a marker saying it was removed, so your other televisions learn about it, then deleted. |
| Sync records | Twenty-four hours. |
| Used pairing codes | Ninety days. |
| Your email address, profiles, playlists, favourites and televisions | Until you delete them, or delete the account. |
| Server logs | No fixed period: each service keeps a rolling buffer of about thirty megabytes and the oldest entries are overwritten. |
Backups. The database is backed up every night, encrypted so that the server cannot read its own backups. Backups are kept on the same server and deleted after fourteen days; no copy is held anywhere else. So deleting something removes it from the live service at once, and it ages out of the backups afterwards.
Under the GDPR you may ask for a copy of your data, ask for it to be corrected or deleted, or object to it being processed. Two of those are built into the product:
Both are on the phone: sign in at vdhstream.com/tv and open Your data, which carries Download a copy and Delete this account. Neither is on the television.
For anything else, write to the contact address above. You may also complain to your national data protection authority.
The app is not directed at children. Child profiles exist so that an adult can restrict what a child sees: such a profile holds a name, an avatar choice, an age-rating limit and, if the adult sets one, a PIN. It holds nothing else, and a child does not create it.
The date under the title is the date of the version you are reading.