What leaves your Mac

What the app stores

The app keeps your library in a single database file, ~/Library/Application Support/default.store: playlist names and addresses, channel names, stream and logo addresses, groups and favourites. The file is not encrypted, and the app does not use the macOS Keychain. Xtream usernames and passwords are stored in plain text — in the address of the playlist and again in the address of every one of its channels. An M3U link is stored exactly as you entered it, including any token or password it contains. Any program running under your macOS user account can read the file, and Time Machine backs it up like any other file.

Next to it, the app leaves:

• ~/Library/Caches/lu.daumedia.MikaPlusPlayer — the macOS network cache. It holds the requests for an Xtream channel list including username and password, the panel’s answers, downloaded M3U lists with their addresses, and the channel logos.
• ~/Library/HTTPStorages/lu.daumedia.MikaPlusPlayer and lu.daumedia.MikaPlusPlayer.binarycookies next to it — cookies, if a playlist or logo server sets any.
• ~/Library/Preferences/lu.daumedia.MikaPlusPlayer.plist — settings such as when the app last checked for updates.

There is no sync and no cloud service. Deleting a playlist removes it and its channels from the database, but not from the network cache, and names and addresses of deleted channels can stay inside the database file until it reuses that space.

Removing everything

Deleting the app does not remove any of this. To remove all of it, quit the app, move MikaPlusPlayer from Applications to the Trash, then choose Go → Go to Folder… in the Finder and delete:

• ~/Library/Application Support/default.store, together with default.store-shm and default.store-wal in the same folder
• ~/Library/Caches/lu.daumedia.MikaPlusPlayer
• ~/Library/HTTPStorages/lu.daumedia.MikaPlusPlayer and lu.daumedia.MikaPlusPlayer.binarycookies
• ~/Library/Preferences/lu.daumedia.MikaPlusPlayer.plist

One caution: default.store is the name Apple’s SwiftData framework gives a database by default, not a name that belongs to Mika+Player, and another app that runs outside the macOS sandbox can use the same file. If you are not sure, move it to the Trash first and check that your other apps still have their data before you empty it. Copies in Time Machine backups stay until those backups are deleted.

What the app connects to

Every connection below carries your IP address, as any connection does. The app’s own requests — channel lists and logos — also name the app, its build number and the version of macOS’s network components in the User-Agent header, and send your system language (Accept-Language).

• Your provider. The channel list comes from the host you entered — the Xtream panel, or the server in an M3U link — and so does every refresh. Your provider sees your IP address and what you request, on their terms — their privacy policy applies, not this one. If that server answers with a redirect, the app follows the redirect and sends the same request, credentials included, to the new address. Servers can set cookies; the app keeps them and sends them back with later requests.
• Stream servers. Each channel plays from the address in the playlist. For Xtream that is normally the panel, and the address contains your username and password. An M3U playlist can point every channel at any other server. Whichever server it is sees your IP address and which channel you are watching.
• Channel logo servers. Playlists name a logo image for each channel, on any host. The app loads them automatically whenever it shows a channel list or your favourites — over plain HTTP if that is what the address says, and following redirects to other hosts. Besides your IP address and the headers above, a logo server learns from which logos are requested which list you are looking at and what you searched or filtered for, and every time you open the Favourites tab it receives requests for exactly the logos of your favourites. Version 1.1 has no setting to turn logos off.
• GitHub. Sparkle, the component that updates the Mac app, checks for a new version automatically, about once a day — the first time right after the first launch, without asking first. Version 1.1 has no switch to turn this off. Each check fetches a small update feed from raw.githubusercontent.com and tells GitHub your IP address and, in the User-Agent header, the app’s name and version and the Sparkle version. It sends no system profile and nothing from your library. When you install an update, the new version is downloaded from github.com.

Xtream logins travel over plain HTTP

Worth knowing before you type credentials: the app talks to Xtream panels over http://, and rewrites an https:// host to plain HTTP, because most panels serve nothing else. Your username and password are therefore sent unencrypted, and anyone between you and the panel could read them. They travel with every request to the panel: the channel list, each refresh and every stream you play. The same applies to an M3U link that starts with http://, including any token in it. That is a property of IPTV panels rather than a choice we would defend — treat those credentials as low-value and never reuse a password there.

This website

No cookies, no analytics, no tracking scripts, no fonts loaded from third parties. The site is hosted on Vercel, which keeps standard server logs, and the download button points at GitHub, which counts downloads per release. Both receive your IP address, as any web server does. The address /download is a small server function on Vercel that forwards to the newest file on GitHub.

Content

Mika+Player ships no channels and resolves no subscriptions. It plays the playlist you supply, and what you are entitled to watch is between you and your provider.