Before lending or selling a streaming device

List the accounts stored on the device

Include the player account, content-service access, app-store account, email, browser sessions and any paired control apps. A streaming box may contain more personal information than the one television app you normally open.

Do not assume that removing an app signs out every related account or deletes a saved backup. Check the platform’s documented behaviour before relying on it.

Separate local removal from account revocation

Deleting a saved playlist removes a local copy when the player implements that action. It does not necessarily invalidate credentials that another person has already copied. A service may offer a separate sign-out, session or credential-replacement process.

Use the provider’s real account controls where available. Do not invent a revoke-all-devices feature or assume that the IPTV Australia account has one without confirmation.

Choose the right handover action

For a temporary loan, signing out and removing private configuration may fit the intended use, depending on the platform. For a sale or permanent return, follow the manufacturer’s proper reset and account-removal instructions.

Save only the information you legitimately need for your own setup, and store it privately. Do not create a public document containing playlists or passwords as a convenient handover checklist.

Check the handover state

After the supported action, inspect the device as a new user would. Confirm that it no longer opens your private account or displays your configuration. Remove storage cards or other media that contain personal data.

If the device was lost rather than handed over, use the account provider’s recovery and session guidance from a device you control. Protect the recovery email as well. A physical device reset you cannot verify is not evidence that remote account access has ended.

Questions about this guide

Sources and further reading

• NCSC: Hacked accounts
• OWASP: Protect Data Everywhere