Privacy notice for beta testers

In short

The data is anonymous: the receiver gets a random identifier, with no IP address, no passwords and no channel lists of yours. We use it only to improve the image on your receiver model. Name and e-mail are optional.

The receiver also sends a fingerprint calculated from its board, so that it is counted only once even when it is installed in several slots or reinstalled. The fingerprint does not reveal the MAC address or the serial number, and these never leave the receiver.

Nothing is sent until you tick “I have read the Privacy notice and I agree to send the data ticked above.” and press “I agree”. You choose the kinds of data and can change them at any time.

If you leave “Send automatically every day” ticked, the receiver sends by itself, once a day, at night, only the kinds you ticked. You can untick it at any time.

Who receives the data

The data is received by Eduard Monea, a private individual, who makes the HD Satelit image. Monea Software and HD Satelit are the brands he works under; they are not companies.

For any question about your data, write to us at [email protected].

• Write to us at [email protected]

No payment or other rewards

Being a beta tester is voluntary and is not rewarded with money or in any other way. What you gain is ever better software on your own receiver, made the way you want it. HD Satelit is developed by a private individual, with very limited resources, used for the test receivers and for the development tools, which are expensive. If we obtain sponsorships from manufacturers, new receivers or prizes, we will offer them to the beta testers through contests, as the budget allows. Until then we work in the spirit of the open source community: everyone's contribution makes the software better for all.

What data the receiver sends

When you sign up, the receiver shows you six kinds of data, all ticked by default, each with its own short line, and under them the tick “Send automatically every day” (see below, under automatic sending). You can untick any of them, when you sign up or later, from the tester menu, under “The data I send”, on the receiver or in the web interface. Only the ticked kinds are sent.

Every package starts with the same few lines: the random identifier, the receiver fingerprint, the receiver model, the verdict of the model guard (the chip, the board type and the internal memory rounded to GB, which are values of the model, not of your particular receiver), the image version, the menu language, the hours of use and the time the data was collected. The model comes from the image, not from you: if the model guard does not recognise the receiver, the model is sent empty.

When you press “I agree”, the consent is sent (your ticks, the version of the notice and, if you filled them in, the name and the e-mail), together with a first sending of the ticked kinds. After that, each kind is sent as described for it below.

Crash and error logs

What they contain: the new logs written when the interface stopped or a screen crashed. From those written by the system, only the last lines of the interface log and the version are sent; from those of a crashed screen, the screen's name and the error trace. The image's other error logs, which the receiver keeps after a restart, are sent too: the update log (what was installed and with what result) and the logs of the extensions (installing, updating, removing). Plus the new lines of the receiver's watchdog: when the interface restarted and why. The system log is not sent.

When a channel does not work (no signal, no picture, decoding error), the log keeps the name and technical data of that channel, so that we can find out why. Which channels you watch when everything works is not sent.

Before they leave, the receiver cleans them: it removes the lines with passwords, keys, tokens and Wi-Fi, and replaces IP and MAC addresses, e-mail addresses, web addresses and the paths to your films with a placeholder. The settings, the network and the list of installed packages are not sent.

How often: only the logs that are new since the last sending. With automatic sending, the receiver looks for them 5 minutes after each start of the interface (so also after an unexpected stop or after an update that failed) and once a day, at night; otherwise, when you press “Send now”. At most 3 logs a day are sent. How big: at most the last 64 KB of text of a log are sent; a package is usually 3-20 KB, compressed.

Scanned channels

What they contain: only the satellite channels. The transponders (the satellite position, frequency, symbol rate, polarisation, FEC, the DVB-S or DVB-S2 system, modulation, roll-off and pilot) and the services on them (the SID, TSID and ONID numbers, the type of service, the name and the provider).

Not sent: cable and terrestrial channels (they would show your operator and region), favourites lists, PIDs and internet streams.

How often: when you sign up; then, with automatic sending, only after a scan that changed the list, and at most once a week; with “Send now”, whenever the list has changed since the last sending. How big: usually 20-150 KB, compressed; a list larger than 512 KB is not sent.

What they are for: the database of all receivers and SatBase (satbase.hdsatelit.com), so that the frequencies are up to date for everyone.

Memory, processor, temperature and start-up

What it contains: the memory (total, how much is free, the lowest and the average of the day, the most memory used by the interface), the processor load (the average and the peak of the day), the processor temperature (the average and the peak), how long the start-up takes, how many times the interface restarted that day and how long the receiver was on. The receiver measures them every 10 minutes, only while you are signed up.

How often: once a day, with automatic sending, or when you press “Send now”; what was gathered since the last sending is sent. How big: under 1 KB.

Screens and functions used

What it contains: how many times each screen of the receiver was opened, by its name in the program (for example ChannelSelection, the channel list; at most 150 screens), how many channel changes and how many recordings were started. The receiver counts them only while you are signed up. What channels you watched, what you recorded and file names are not sent.

How often: once a day, with automatic sending, or when you press “Send now”; the count since the last sending is sent. How big: 1-4 KB.

Receiver details

What they contain: how your receiver is built, not what you do with it. The board (the model given by the model guard, the chip, the board type, the board name reported by the system, the processor and how many cores it has), the memory (RAM, the internal memory and the names and sizes of its partitions, without what is in them), the tuners (their slot, type, modes and name), the Wi-Fi, Bluetooth and Ethernet network cards (the type, how they are connected inside the receiver, the product code, the name and the driver), the HDMI output (the picture modes, HDR and CEC), the front display, the remote control type, the driver versions, the connected USB devices (the type, the product code and the name) and the names of packages left half installed after an update.

Not sent: the MAC address of the network cards, the name of your network, IP addresses, the serial number of USB devices and the names of the files on them.

How often: when you sign up, then only when something changes. The receiver remembers a checksum of the last package sent and sends again only when the current data gives a different checksum.

What they are for: to adapt the image to each model and to complete the list of receivers on the site (memory, tuners, Wi-Fi). The server keeps only the latest package of your receiver.

Test results

What they contain: what the receiver tests you start yourself from the tester menu, under “Receiver tests”, found, when your image has them: which tests ran, which worked and which did not and why, how long they took and the measured values, with the model and the image version. The server keeps only the known fields of the tests and replaces any text that looks like a MAC or IP address with a placeholder.

How often: when you send the results yourself from the tests screen and, with automatic sending, once a day, only if the result of the last run has changed since the previous sending. How big: at most 128 KB.

What they are for: to know what works and what does not on each receiver model.

Automatic sending

If you leave “Send automatically every day” ticked, the receiver sends by itself, once a day, at night, only the kinds of data you ticked, and right after an unexpected stop of the interface or after an update that failed. Nothing is sent twice. You can untick it at any time; then only what you send yourself with “Send now”, or your messages, goes out. The tick is set by default, like the kinds of data, and you change it in the tester menu, under “The data I send”.

When: once a day, between 03:00 and 06:00 by the receiver's clock, at a minute chosen at random at each start (so that not all receivers come at once), and at least 20 hours after the previous sending. If the receiver was off at night and more than 26 hours have passed, it sends at the next start, after 5-35 minutes. It also looks for new logs 5 minutes after each start of the interface. It does not send during a recording or while packages are being installed: it tries again 10 minutes later.

“Send now”, from the tester menu or from the web interface, gathers all the ticked kinds right away and sends them, with or without the automatic tick.

Without internet, the packages wait on the receiver, in a queue: at most 20 packages and 1 MB, and beyond that the oldest are lost first. The receiver tries again after an hour. What was sent and what is waiting you see in the tester menu, under “What I sent”; the time of the last sending is written at the bottom of the tester menu.

Messages from the tester menu

After you sign up, you can send us a message from the tester menu: the kind (bug, idea or question), your text and, if you want, the screen or function you are writing about.

Only if you tick it when sending, the message also gets the log of the last error, cleaned as above, and a screenshot of the menus only, without the channel picture. On the receiver, after you press Send, you have 15 seconds to close the tester menu and open the screen you are writing about; then the receiver takes the screenshot. From the web interface, the screenshot is taken right away, with what is on the screen at that moment.

The limits: the text has at most 4000 characters, the screenshot at most 400 KB, and at most 10 messages a day are sent. You find the team's replies in the tester menu, under “Replies from the team”.

Messages do not go to the forum by themselves. If a message is useful to others too, we write a forum topic ourselves, without your data, and send you the link. Do not write passwords or other data you do not want us to know in your messages.

What the receiver does not send

• the IP address: the server does not write it anywhere (see below, under anonymisation);
• the MAC address and the serial number of the receiver or of USB devices (the fingerprint is calculated from the board, but does not reveal them);
• passwords, keys and tokens;
• the name of your Wi-Fi network;
• your own channel lists: favourites, cable and terrestrial channels, internet streams;
• the names of your films and recordings;
• anything before you press “I agree”.

Anonymisation

The identifier: when you sign up, the receiver picks at random a number of 32 hexadecimal digits. It does not come from the MAC address, the serial number or anything else of the receiver, so it does not lead to you. You can see it in the tester menu and on the receiver's web page; write it down if you want to be able to ask us something without the receiver. When you leave the programme and delete the data, the receiver forgets it.

The fingerprint: the receiver calculates it from the MAC address of the network card and the serial number of the internal memory, with a one-way function (PBKDF2-SHA256, 100,000 rounds); only the result leaves, 32 hexadecimal digits. It is the same in every slot and after every reinstall, so the server counts your receiver only once. It does not reveal the MAC address or the serial number, and these never leave the receiver. We use it for nothing else.

The IP address: the server program does not read it or write it, and the web server's log is off for the programme's addresses. The web server uses it only in memory, to stop requests that come too often from the same address, without linking it to the data.

The time: the time the data was collected is sent rounded to the minute, in UTC, without your time zone.

The way: the data is sent only over HTTPS, with the server's certificate checked. The connection goes through Cloudflare, which protects the whole stb.hdsatelit.com site, as with any of its pages.

Name and e-mail (optional)

You can leave them empty; the programme works the same. If you fill them in, they are sent only together with the consent (when you sign up and when you change the ticks) and are kept on the server in a separate table. We use the name only to be able to ask you something about a problem found on your receiver, and the e-mail only for the team's replies.

If you gave an e-mail address, the team's replies to your messages reach you there (at most one e-mail every 10 minutes), and you can unsubscribe at any time, with one click, from the link at the end of each e-mail.

They never appear in public and we give them to no one; they are not the public name described below. If you delete them in the tester menu, under “The data I send”, they are deleted from the server too.

Public name and linking an account (optional)

If you want to appear publicly as a beta tester, in the tester menu, under “Public profile”, you choose a public name: 2-40 characters, letters, digits, space, dot or hyphen. The server gives it in the public list of testers of each model, so that it appears on the site, on the beta testers page and at your receiver model. Without a public name you do not appear anywhere.

For the public name, the receiver makes a secret key of its own, kept only on the receiver, which never appears on the screen or in the web interface; the server keeps only a fingerprint of it (SHA-256). You do not type any password on the receiver.

When the receiver shows them, there are two more ways: you link an account you already have on the image's forum (stb.hdsatelit.com/forum), with a QR code scanned with the phone on which you are signed in to the forum or with a 6-digit code from the linking page; or you type an e-mail on the receiver, and the server sends you a confirmation link for a new forum account, where you set your password, from any device. The codes can be used only once, expire in 10 minutes and have a limit of attempts. These two ways appear on the receiver only after we turn them on on the server.

When you link an account, the testers' server keeps only the name of your forum account, linked to the receiver's identifier. The forum does not see the identifier or the data sent by the receiver. We use the e-mail for the account only for the account and for the team's replies.

You remove the public name at any time, from the receiver (“Stop appearing publicly”) or from the web interface; you unlink the account the same way. Leaving the programme deletes both the public name and the link; your forum account stays yours.

Remote assistance (optional)

Separately from the data above, you can turn on Remote assistance, from Menu > Settings > Remote assistance (up to 0.6.12, from the tester menu) or from the /asistenta page of the web interface. Only you turn it on, for as long as you choose (from 0.6.13, Start turns it on for 2 hours), and you turn it off at any time, on the receiver or in the web interface; at the end of the chosen time it stops by itself.

While it is on, you see a sign on the screen, and the HD Satelit team can connect at any time and can only ask for the operations in a fixed list written into the image: reads of the receiver's status and logs, a capture of the menus and a message on the screen. It cannot run commands, cannot change settings or files and cannot reach other devices in your home. Every request appears in the log on the screen.

What reaches us: the receiver model and version, the country, the time and length of the session, what you chose under “What can we help you with?” and the line you wrote, if you gave them, and the answers to the requests in the log. We do not keep your internet address. The data stays on our server for 30 days, then it is deleted.

Why we use the data

Only to improve the HD Satelit image on your receiver model: to find and fix crashes, to see how busy the receiver is, which screens matter most and what works or not on each model, and to adapt the image to each model. The scanned channels also go into the database of all receivers and into SatBase, so that the frequencies are up to date for everyone, and the receiver details help us complete the list of receivers on the site. We do not sell the data and do not use it for advertising.

The legal basis: your consent. You give it on the receiver or in the web interface, with the tick “I have read the Privacy notice and I agree to send the data ticked above.” and the “I agree” button. The tick is the only one not ticked by default, and without it the button does not work. You can withdraw your consent at any time (see below).

The only thing done automatically with the data: the server counts the receivers signed up for each model, each one only once (by its fingerprint), and the number appears on the receiver's page on the site. When a model in alpha has a tester whose receiver has run the image for a few hours, the model can move to beta on the site. The number and that date say nothing about you.

Where the data is kept

On the server of the stb.hdsatelit.com site, rented from Hetzner, in Germany (European Union). Only we, the people who work on the image, read it.

How long we keep it

• crash and error logs and test results: 6 months;
• memory, processor, temperature and start-up, and the screens and functions used: 12 months;
• scanned channels and receiver details: only the receiver's latest package, as long as you are signed up;
• the consent, the name and the e-mail, the public name and a linked account: until you leave the programme or until 12 months pass without any word from the receiver;
• the receiver fingerprint: as long as you are signed up; after you leave the programme, the server keeps only a sum of it for 12 months, with no identifier and no other data, so that a new sign-up of the same receiver is not announced as a new receiver;
• messages, replies and attached logs: also until you leave the programme or until 12 months pass without any word from the receiver; attached screenshots: 6 months;
• the daily backup copies of the database keep deleted data for at most 14 days.

“Without any word” means without any package, consent or message from the receiver. The server deletes by itself, every day, what is past its term. Only the number of testers of each model and the date a model was confirmed remain: they are nobody's data.

How to stop and ask for deletion

1. Untick a kind of data in the tester menu, under “The data I send”, on the receiver or in the web interface: that kind is no longer sent, and the server refuses it too.
2. Untick “Send automatically every day”: nothing is sent by itself any more, only what you send yourself. If you also untick all the kinds, no data is sent at all. What you sent stays anonymous until the terms above.
3. Choose “Leave the programme and delete the data”, on the receiver or in the web interface: the server deletes everything linked to your identifier (the fingerprint, the packages, the channels, the receiver details, the test results, the messages, the name and the e-mail, the public name and a linked account), and the receiver forgets the identifier.
4. Without the receiver (you gave it away, restored it or it no longer starts): write to us at [email protected] with the identifier, and we delete the data.

Withdrawing your consent does not change what was done with the data before.

Your rights

You have the right to find out what data we hold for your identifier and to get a copy of it, to correct your name, e-mail and public name, to ask for the data to be deleted and to withdraw your consent at any time. Withdrawing it does not change what was done with the data before. Write to us at [email protected], with the identifier, and we answer within one month. You can always see the last package sent on the receiver itself, under “What I am sending now”.

If you think we do not handle your data properly, you can complain to the data protection authority: in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro), or the authority in your country.

• ANSPDCP: dataprotection.ro

When the notice changes

The notice has a version; this is version 2, of 29 October 2026 (compared with version 1 it adds the receiver fingerprint and, in the logs, the data of a channel that does not work). If we change what data is sent or what we do with it, we write a new version, and the receiver tells you by itself and asks for your consent again, with your ticks so far: you press “Accept” on the new notice screen, on the receiver or in the web interface. Until you give it, it sends nothing, except a deletion, if you ask for one.

At the bottom of the tester menu you can see the date of your consent and the version of the notice you accepted.