Privacy Policy

Effective as of 26 October 2026. This policy describes what DragoXStream actually collects and does today. We do not sell your personal information for money.

Notice at collection for U.S. residents: see the U.S. state privacy rights section for your rights under state privacy laws. Users in Europe and India: see the Notice to European users and Users in India sections.

DragoXStream ("DragoXStream", "we", "us" or "our") provides a web player at dragoplayer.in and an Android app that play and download videos from DiskWala, TeraBox, Flezen and VidBunker share links you provide. The website needs no account; accounts, Google sign-in, notifications and DragoXStream Ad-Free exist only in the Android app. We do not offer a paid API or any other subscription. This Privacy Policy explains how we process personal information collected through the website, the Android app, our emails and our support channels (together, the "Service").

Contents: Information we collect · Cookies and tracking · How we use it · Retention · How we share it · Your choices · Security · International transfer · Children · Contact · App Privacy · U.S. state rights · India · Europe · Trust & Safety

Personal information we collect

Information you provide to us

• Account data. Accounts are optional and are created in the Android app. If you create one, we store the username you choose, your email address if you give one, your password as a salted one-way hash (we cannot see it), whether your email is verified, your plan and its expiry date, and when the account was created and last active.
• Google sign-in data. If you sign in with Google, Google sends us your Google account ID, email address, name and profile picture address. We never receive your Google password or access your Gmail, Drive or contacts.
• Communications data. When you contact support, we keep your name, email address, the subject and message, and the conversation that follows.
• Ad-Free purchase data. DragoXStream Ad-Free is bought in the Android app through Google Play, which handles the payment. We never see your card, bank or UPI details. When you buy or restore it, the app sends us the Google Play purchase token, which we check with Google and store encrypted, together with the product, its status (for example active, cancelled, expired or refunded), its start and expiry dates and when we last checked it. Older records of the former Premium plan are kept as history.
• Share links. When you open a share link, we process it to fetch the file's name, size and thumbnail and to stream it. The link and result are kept in server memory for up to 30 minutes and are not written to our database. We do record that a link was opened, from which provider, and by which account or device identifier (on the website, a keyed one-way hash of your IP address), to count usage and stop abuse.

Information from third parties

• Google, when you choose to sign in with Google (see above).
• Link-processing services, which return file details for the links you open.

Information collected automatically

• Device data, such as your IP address, browser type and version, operating system, app version and, in the app, the device identifier that Android provides (the device build ID).
• Usage data, such as when a link was processed and from which provider (for the "links opened today" figure), how many videos a signed-in user has played and their total watch time, app opens, and app update events (which version was offered and whether it was installed).
• Notification data. If you allow notifications, a Firebase Cloud Messaging token for your device, and when you read or dismiss a notification.
• Website analytics data. If you accept analytics cookies, Google Analytics collects pages viewed, time on page and the events we send: a link opened (with the provider name and number of files), a video started (with its format) and a file downloaded (with the provider name). We never send it the share link or the file name.
• Server logs, with IP address, requested address, time, response code and app version, used for security and troubleshooting. Playback addresses are redacted from logs.
• Security reports. If the app detects a rooted or modified device, it sends one report with only the app version, Android version and whether the app was blocked.

We do not collect your contacts, phone number, precise location, call logs, SMS or browsing history, and we never upload the videos or audio stored on your device.

Cookies and other tracking technologies

Some automatic collection on the website uses cookies and browser storage. Google's analytics and personalised-ad cookies stay off until you accept them in our cookie banner, and we store a record of your choice on your device. See our Cookie Notice for the full list and how to change your choice.

The website shows ads from Google AdSense and measures traffic with Google Analytics 4. These Google services receive your IP address, browser details and the pages you view, and handle that data under Google's policies.

How we use your personal information

Service delivery and operations

• Provide the player, downloads, accounts and DragoXStream Ad-Free, including checking Ad-Free purchases with Google Play.
• Send notifications and emails you need, such as email verification, password reset, plan changes, app updates, service announcements and replies to your support requests.
• Answer your questions and support requests.
• Offer the right app update for your device.

Service improvement and analytics

Understand how the Service is used, for example which features are used and where playback fails, so we can fix and improve it. On the website we use Google Analytics for this, with your consent.

Advertising

Ads pay for the free Service. On the website, Google AdSense may personalise ads if you accept advertising cookies. In the app, Google AdMob shows banner, app-open, interstitial and rewarded ads, including a rewarded ad before each download. Users with an active DragoXStream Ad-Free subscription are not shown ads in the app, and the ad SDK is not started for them. We do not send you marketing emails.

Compliance and protection

• Keep the Service secure and prevent abuse, fraud, automated scraping and attacks, including through rate limits and device checks.
• Enforce our Terms of Use and handle copyright complaints.
• Comply with the law and respond to lawful requests from authorities.

Aggregated and de-identified data

We may create aggregated or de-identified statistics, such as total plays per day, which cannot identify you. We do not try to re-identify such data.

Retention

• Account data is kept while your account exists. When you delete your account, your username, email, name, Google details, profile picture and password are erased, your sign-ins end, and your devices, notification history, statistics and support messages are deleted. Usage records are kept without any link to you. Ad-Free purchase records are detached from you and their encrypted purchase token deleted; we keep a one-way hash of the token so the same purchase cannot be claimed twice. Older Premium records stay attached to the now-anonymous account.
• Support messages are kept until your request is handled and at the latest until your account is deleted, unless you ask us to delete them sooner.
• Server logs are kept for 14 days (web server) and up to 30 days (application).
• Share link results are kept in memory for up to 30 minutes. Playback addresses expire after about one hour.
• Usage records (link opened, provider, account or device identifier, time) are kept for statistics. When you delete your account, the account link is removed from them.
• Ad-Free purchase records are kept while your account exists, and as long as tax and accounting law requires.

When we no longer need personal information, we delete or anonymise it.

How we share your personal information

• Google Play, which processes Ad-Free payments and which we ask to confirm the status of your purchase.
• Service providers that help us run the Service: our server hosting provider; Brevo, which delivers our emails; Google Firebase Cloud Messaging, which delivers push notifications; and independent link-processing services, which receive the share links you open (but not your account details).
• Advertising and analytics partners: Google AdSense and Google Analytics on the website, and Google AdMob in the app, as described above.
• File hosts. When you play a file, our server requests it from the file host (DiskWala, TeraBox, Flezen or VidBunker) on your behalf. They see our server, not your browser.
• Linked services. If you sign in with Google, Google knows you used it to sign in to DragoXStream.
• Professional advisors, such as lawyers and accountants, when they need it to advise us.
• Authorities and others, when we believe in good faith that the law requires it or that it is needed to protect rights, safety or property.
• Business transferees, if DragoXStream is sold, merged or reorganised. Your information would remain subject to this policy.

Nothing you do on DragoXStream is shown to other users.

Your choices

• Access, correct or delete your data. Delete your account at any time in the app (Settings → Account → Delete Cloud Account), see Delete your account, or email us to ask for a copy of your data, a correction, or deletion of specific data.
• Cookies. Change your choice at any time with Cookie settings. See the Cookie Notice.
• Notifications and permissions. Turn notifications off, or revoke the media permission, in the app's settings or in Android settings.
• Local data. Clear your history, search history and app data in the app (Settings → Data Management), or the Recently Opened list on the website.
• Do Not Track and Global Privacy Control. We do not respond to "Do Not Track" signals. We do honour Global Privacy Control as an opt-out of personalised advertising on the website.
• Declining to provide information. You can use the Service as a guest. Some features, such as Ad-Free and support replies by email, need an account or an email address.

Other sites and services

The Service links to and works with services we do not control, including DiskWala, TeraBox, Flezen, VidBunker and Google. Linking to them is not an endorsement, and we are not responsible for their practices. Please read their privacy policies.

Security

• All connections use HTTPS, and the app checks our server's certificate (certificate pinning).
• Passwords and sign-in tokens are stored only as one-way hashes. On your phone, tokens are kept in Android's encrypted secure storage.
• Playback addresses are encrypted and authenticated (AES-256-GCM) and expire after about an hour, so the file host's own links are never exposed. They are not tied to one connection, because mobile networks change IP addresses mid-video, but a playback address passed on to many other networks can be made to stop working.
• Rate limits use your IP address in memory. Where a guest without a device identifier needs one, we store a keyed one-way hash of your IP address, not the address itself.
• To stop other services from reselling this service, a security log records each link lookup and each refused request: time, IP address, app or browser version and, for signed-in users, the account. It never records the share link or the file name, and entries are deleted after 30 days.

No system is completely secure, and we cannot guarantee the security of your information.

International data transfer

DragoXStream is operated from India. Our hosting and service providers, including Google and Brevo, may process your information in other countries, including the United States, where privacy laws may differ from those where you live.

Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you are under the age of majority where you live, use the Service only with a parent or guardian's involvement. If you believe a child has given us personal information, contact us and we will delete it.

Changes to this Privacy Policy

We may update this policy when the Service or our practices change. We will update the date at the top and, for significant changes, tell you in the app or on the website. Changes take effect when posted.

How to contact us

For privacy questions or to exercise any of your rights, contact us at:

• Email: privacy@dragoplayer.in
• In the app: Settings → Legal & Support → Contact Support
• General support: support@dragoplayer.in

App Privacy

This section adds detail for the DragoXStream Android app. The full app policy is also shown in the app under Settings → Legal & Support.

Data stored only on your device

Your viewing history, favorites, playback positions, search history, downloads list and settings stay on your phone. They are not sent to us and are not synced between devices. Downloaded files are saved to Download/DragoXStream (or the app's own storage), and we are not told which files you download.

Permissions

• Internet and network state: to open links, stream and check your connection.
• Notifications: to show download progress and messages from us. Download progress notifications are created on your device.
• Videos and audio (or storage on older Android): only if you use the Local Media library. The library is built on your device and is never uploaded. The app does not access your photos.
• Foreground service: to keep downloads running when the app is in the background.
• Install packages: to install app updates downloaded from our server, after they are checked.

Ads in the app

The app shows Google AdMob ads: a banner on the main screens, an ad when you return to the app or close the player (at most every few minutes, never during playback), and a short rewarded ad before each download, which starts once the ad has finished. If the ad cannot be loaded, the download does not start and you can try again; when ads are switched off, downloads start without one. Where the law requires it, such as in the EEA and UK, the app asks for consent through Google's consent form before requesting an ad. Google may process your advertising ID, IP address and device information. When ads are not switched on, the ad SDK is not started.

Device checks

The app may check, on your device, whether it is rooted or whether an ad-blocking DNS or ad blocker is active. The ad-blocker check never leaves your device. A rooted-device report contains no identifier, account or IP address.

No analytics SDKs

The app does not include Firebase Analytics, Crashlytics or any other analytics or crash-reporting SDK.

U.S. state privacy rights

This section applies to residents of U.S. states whose privacy laws apply to us, such as California, Colorado, Connecticut, Virginia and Texas ("State Privacy Laws"). Not every right is available in every state, and we may decline a request where the law allows.

Your rights

• Information and access: ask what categories of personal information we collected, from where, why, and with whom we shared it, and get a copy of it.
• Correction and deletion of your personal information.
• Opt out of targeted advertising and "sale" or "sharing": we do not sell personal information for money, but State Privacy Laws may treat personalised ads from Google on our website as a "sale" or "sharing". Opt out with Cookie settings (choose Reject non-essential), by sending a Global Privacy Control signal, or by emailing privacy@dragoplayer.in.
• Appeal: if we decline your request, you can appeal by replying to our decision.
• Non-discrimination: we will not treat you differently for using these rights.

We do not use personal information for profiling that produces legal or similarly significant effects, we do not knowingly sell or share the personal information of anyone under 16, and we do not collect sensitive personal information to infer characteristics about you.

To make a request, email privacy@dragoplayer.in. We may need to confirm your identity, for example by asking you to write from the email address on your account. An authorized agent may make a request for you if they show us your written permission.

What we collect and disclose

This table covers the 12 months before the date of this policy.

California "Shine the Light": we do not disclose personal information to third parties for their own direct marketing.

Users in India

Under India's Digital Personal Data Protection Act, 2023 and its rules, you can ask us for a summary of the personal data we process about you, ask us to correct, complete, update or erase it, withdraw any consent you gave (for example, with Cookie settings), and nominate another person to exercise these rights if you die or become unable to. To do so, or to raise a grievance, email privacy@dragoplayer.in. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Notice to European users

This section applies only to people in the European Economic Area and the United Kingdom ("Europe"). "Personal information" in this policy includes "personal data" as defined in the GDPR and UK GDPR.

Controller

DragoXStream is the controller of the personal information described in this policy. See How to contact us for our contact details.

Legal bases for processing

Your rights

You can ask us to give you access to, correct, delete, transfer (in a machine-readable format) or restrict the processing of your personal information, and object to processing based on our legitimate interests. Where we rely on consent, you can withdraw it at any time, for example with Cookie settings. Email privacy@dragoplayer.in. If we decline a request, we will tell you why. You can also complain to the data protection authority where you live. In the UK, that is the Information Commissioner's Office (ico.org.uk).

Transfers outside Europe

We operate from India, and our providers may process data in the United States and other countries that may not have an adequacy decision. Where required, we rely on safeguards such as the European Commission's standard contractual clauses offered by our providers. Contact us for more information.

No sensitive data or automated decisions

Please do not send us sensitive personal information, such as health or religious information, in support messages. We do not make automated decisions that have legal or similarly significant effects on you.

Trust & Safety

How we keep DragoXStream safe and lawful, and what we expect from people who use it.

What we do

• No file hosting. We do not host, store or index files. Video is relayed from the file host to you as you watch and is not kept on our servers.
• Secure by default. HTTPS everywhere, encrypted short-lived playback addresses, hashed passwords and tokens, and rate limits against abuse.
• Copyright. We block links named in valid copyright notices and may suspend the accounts of repeat infringers. See our DMCA policy.
• Privacy. We do not sell personal information for money, and we do not record which user opened which link.

What we expect from you

• Only open links to files you have the right to access.
• Do not use the Service to share or obtain content that infringes copyright or is illegal.
• Do not try to get around limits, security checks or rate limits, or use bots against the Service.
• Follow our Terms of Use and the law where you live.

Reporting harmful content or copyright violations

• Copyright: send a notice to dmca@dragoplayer.in as described on the DMCA page.
• Illegal or harmful material: email support@dragoplayer.in with the exact share link and what is wrong with it.
• We aim to acknowledge reports within 48 hours and block links once a report is verified. Because the file stays with its host, please also report it to the file host.

Last updated: 6 November 2026.