Privacy policy
Last updated 2 November 2026
The short version: Legato keeps your provider login on your device, plays streams straight from your provider, and has no ads, analytics or tracking. If you turn on Legato Sync (coming), we store the things it keeps in step across your devices, in London, and nothing else.
Who we are
Legato is run by Empire Software Ltd (registered in England and Wales, company number 14800561, registered office Suite A, 82 James Carter Road, Mildenhall, Suffolk IP28 7DE, United Kingdom). We are the data controller for the personal data described here. Contact us at hello@legato.tv.
Legato provides no content
Legato is a player for your own subscription from an IPTV provider. We don’t provide channels, films or playlists, and your provider is not part of Legato. What your provider does with your data is governed by your agreement with them.
The app, without an account
Everything below stays on your device. We never receive it.
- Your provider login. The server address and username, and the password in your device’s secure storage: the Keychain on iPhone, iPad and Mac, the Android Keystore (through encrypted storage) on Android and Fire TV, Credential Manager on Windows and the Secret Service on Linux.
- Your provider’s catalogue: channels, groups, the programme guide, films and series, cached on the device so Live TV opens quickly. It’s rebuilt from your provider and never leaves the device.
- What you choose and watch: favourites, My List, hidden and reordered groups, where you got to in films and episodes, recent channels and searches, and your settings.
- The playback log: a record of recent playback (channel changes, stalls, reconnects, errors and stream health), kept so you can send it to us when something goes wrong. It holds the stream’s host, never your password or full stream addresses. It only leaves the device if you export it yourself (Settings → About → Export playback log) and send it.
Who the app talks to
- Your provider. The app signs in to your provider and fetches its lists, the guide and the streams directly from your device. On the desktop apps, films go through a small relay that runs on your own computer, not on a server. Your provider sees your IP address, as with any player.
- Wherever your provider points it for channel logos and artwork, which may be hosted by others.
- YouTube, only if you choose to watch a trailer: it opens in the YouTube app or your browser, under YouTube’s own privacy policy.
Today the app sends nothing to us. It contains no advertising, analytics, crash-reporting or tracking software, and it doesn’t use advertising identifiers.
If you’ve allowed your device to share diagnostics with app developers, Apple, Google or Amazon may pass us crash reports and aggregate statistics about the app under their own policies. We use these only to fix problems.
Legato Sync Coming
Sync is optional and paid. It isn’t available yet; this is what it will store when it is. You can always use Legato without it.
| What | Why |
|---|---|
| Your account: email address (or the address Sign in with Apple gives us) | To sign you in and tell you about your account |
| Your providers: server address, username and password | To set up your other devices. Passwords are kept encrypted in Supabase Vault and can only be read back by your own signed-in devices |
| Favourites, My List, group order and names, hidden groups | To keep them the same on every device |
| Where you got to, what you’ve watched, recent channels | So you can pause on one device and carry on on another |
| Settings (not device-only ones like the decoder or display settings) | To set up new devices the way you like |
| Whether your subscription is active | To turn Sync on and off |
We don’t store your provider’s catalogue, the guide or your playback log in Sync.
Where it’s kept, and who helps us
- Supabase hosts the Sync database and sign-in, in its London region (UK). Only you can read your rows.
- Resend sends the sign-in emails, so it handles your email address and the email itself.
- Apple, Google and Amazon handle purchases made in their stores, and Stripe purchases on the desktop apps. We don’t receive your card details. RevenueCat tells our server which purchases are active, using an identifier for your account and the store’s receipts.
- Apple, if you use Sign in with Apple.
Some of these companies are based in the US, so your data may be processed outside the UK. Where it is, they provide safeguards recognised under UK law, such as the UK International Data Transfer Addendum or the UK Extension to the EU–US Data Privacy Framework.
Film and series details
Coming Legato will match your provider’s films and series to TMDB for artwork, ratings and cast. The lookups go through our server with the title’s name or id and nothing about who you are or what you watch; artwork then loads from TMDB’s image servers, which see your IP address. Recommendations are worked out on your device from your own viewing.
This website
legato.tv sets no cookies and has no analytics or advertising. Fonts and images are served from the site itself. Our host, Vercel, keeps short-lived server logs (such as your IP address and browser) to run and protect the site.
Email and Discord
If you email us, we keep the conversation only as long as we need it to help you. Our beta community is on Discord, a separate service with its own privacy policy that isn’t part of Legato. Anything you post there can be seen by everyone in the server, so never post your provider’s address, username or password (see the community rules).
Our legal bases
- Contract: to provide Sync when you sign up for it.
- Legitimate interests: to answer your messages, keep the website secure and fix problems you report.
- Legal obligation: to keep records of purchases where the law requires it.
How long we keep it
- On your device: until you remove it or delete the app.
- Sync: while your account is open. Something you delete is removed from every device, and its record is purged from our database within 30 days. If your subscription lapses, Sync pauses, your devices keep their copy, and we keep the cloud copy for 90 days so you can pick up where you left off.
- If you delete your account, we delete its Sync data, including stored passwords.
Deleting your data
- On a device: remove a provider in Settings → Providers, or delete the app to remove everything it stored.
- Sync: delete your account in the app (coming with Sync), or email hello@legato.tv from the address on the account and we’ll delete it.
Your rights
Under UK data protection law (the UK GDPR and the Data Protection Act 2018) you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Email hello@legato.tv. We’ll reply within a month.
If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We’d appreciate the chance to put it right first.
Children
Legato isn’t aimed at children, and Sync accounts are for adults. We don’t knowingly collect personal data from children.
Changes
We’ll update this page before anything here changes, including when Sync launches, and say so in the app when the change matters to you.