For this marketing website and support email, see Website & support privacy. For app or recording privacy questions, contact support@xstreamnetworks.com.
Your countdown stays on your TV
Countdown settings, the selected time zone, and saved show progress stay on your Apple TV. There is no account, advertising, tracking, or analytics in the app. A recording-service connection uses a random installation credential stored in the TV’s Keychain; it does not use your Apple ID, email, advertising identifier, contacts, or precise location.
Subscription purchases
Apple processes subscription payments through your Apple Account. MIDNIGHT uses StoreKit to verify subscription access on your Apple TV, including purchase status and expiration. We do not receive your payment card details. Purchase receipts and transaction identifiers are not sent to our Cloudflare recording service. You can manage or cancel your subscription in your Apple Account settings.
You choose when to share
Microphone access starts only after you tap Record greeting and allow access. Recording begins after the 3–2–1 count. Recordings and previews stay on your phone until you tap Send to TV. Get permission from everyone you record. Recordings are limited to ten seconds.
Only your connected TV
A short-lived QR connection and a Yes, Allow action on the TV are required. Saved audio travels over HTTPS to Cloudflare and is kept in a private R2 bucket. The TV downloads and prepares it locally. Recordings are not published, transcribed, or used for advertising. The service stores random installation and connection identifiers, recording checksums, expiry information, and temporary abuse-limit counters. A hashed network address is used for rate limiting. These records connect your greeting to its TV; they are not an advertising profile. The page uses no analytics or third-party scripts.
During a phone connection, the service stores your midnight voice choice, whether Silent is on, and whether the final-minute lock is active. This lets the phone confirm the TV has applied your choice. These details are kept with the connection metadata and follow the retention periods below.
Your phone connection
This browser tab temporarily keeps a connection key and confirmation details in session storage, so refreshing can reconnect to the same TV. Connection authority expires ten minutes after scanning. The page clears expired connection details when it checks them; browser session restoration may retain these details beyond tab closure, but cannot extend that authority. Audio is held in page memory for preview and is never saved to browser storage.
Retention and removal
The recording screen shows the expiry date before you send. It is one day after the New Year’s midnight selected on the TV. Use Remove Greeting on the TV to remove its local copy and revoke cloud access immediately when online. If offline, local removal happens immediately and the cloud request is retried when you reconnect. Expired and removed cloud files are deleted through scheduled cleanup; a deletion backlog or provider outage can delay physical removal. Short-lived deletion markers remain for retry protection.
Unused pairing records are normally removed after one day when no recording depends on them. Temporary abuse counters expire automatically. Deletion markers are kept for at least seven days to retry late writes. Unused installation records are eligible for removal after 370 days. In production, a 400-day R2 lifecycle rule provides an additional audio-deletion backstop if scheduled cleanup fails; it does not extend the playback expiry shown on your TV.
Who processes your recording
Cloudflare processes the recording and connection data to provide secure hosting, storage, delivery, and abuse prevention. Network requests necessarily expose connection information to the network provider. We do not sell recordings, share them for advertising, transcribe them, or use them to train AI models.
Recording other people
Only record people who agree to participate. A parent or guardian should handle a child’s participation and give permission before sending their voice. The service is for a private household greeting, not public posting.
Offline playback
The TV must finish downloading and preparing a greeting before it can play at midnight. tvOS can remove cached files between app launches. If the recording is unavailable, MIDNIGHT uses its bundled crowd celebration. Nothing is streamed at midnight.
Reloading or closing the recording page before Send to TV discards unsent audio. Your browser’s Back button may preserve a preview while the page stays in memory. Once saved, manage the recording from your connected TV.
For setup, playback, and removal instructions, visit MIDNIGHT support. Material changes to this policy will be reflected here with an updated date.