Privacy Policy

1. Who we are

Twilva is a streaming platform for original series and episodes, operated by Foxelli Group. When this policy refers to "Twilva", "we", "us", or "our", it means the entity responsible for processing your personal data in connection with this service.

If you have any questions about this policy or how we handle your data, contact us at support@twilva.com.

2. What data we collect

We collect the following categories of personal data:

• Email address collected when you create an account or sign in. Used to identify your account, send transactional messages, and contact you about your membership.
• Payment information when you complete a checkout, Stripe collects and stores your card details. We store only a reference to your Stripe customer ID and payment method ID we never see or store your full card number.
• Usage activity we log certain in-app events (e.g. page views, checkout started, checkout completed) to understand how the platform is used and to improve it.
• Device and session data your browser type, operating system, and IP address are collected automatically by our infrastructure and analytics providers as part of normal web operation.

3. How we use your data

• To create and manage your account
• To process membership payments and episode purchases
• To grant access to content you have paid for
• To send receipts, access confirmations, and support responses
• To notify you about new content or platform updates (only if you have opted in)
• To detect and prevent fraud or abuse
• To improve the platform based on aggregate usage patterns

4. Third-party services

We use the following third-party providers. Each has their own privacy policy and data processing terms.

• Supabase provides our database and authentication infrastructure. Your email address and account data are stored in Supabase. Data is hosted on servers in the EU (Frankfurt).
• Stripe processes all payments. When you enter card details at checkout, you are submitting them directly to Stripe. We do not handle raw card data.
• Mux delivers video content. Mux may collect playback metrics such as buffering events and stream quality.
• Vercel hosts the web application. Vercel logs request metadata including IP addresses for security and performance purposes.
• PostHog product analytics. We use PostHog to track anonymised usage events. No personally identifiable information is sent to PostHog beyond what you explicitly provide.
• Sentry error monitoring. If the app crashes or encounters an error, diagnostic information (including device type and error stack trace) is sent to Sentry to help us fix it.
• Meta (Facebook) we send certain conversion events (e.g. purchase completed) to Meta to measure advertising effectiveness. This is done server-side using hashed data only.

5. Data retention

We retain your account data for as long as your account is active. If you delete your account, your personal data is removed from our systems within 30 days, except where we are required to retain it for legal or financial compliance purposes (e.g. payment records are retained for 7 years in line with accounting obligations).

6. Your rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict certain processing
• Receive a copy of your data in a portable format
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, email us at support@twilva.com. We will respond within 30 days.

7. Cookies and local storage

We use cookies and browser local storage to maintain your login session and remember preferences. These are strictly necessary for the service to function. We do not use advertising cookies or third-party tracking cookies on the Twilva website.

8. Mobile app

The Twilva Android app is a native wrapper that loads the Twilva website. All data collection described in this policy applies equally to the mobile app. The app does not collect any additional data beyond what the website collects. Session credentials on mobile are stored securely using the device's encrypted storage (Android Keystore).

9. Children

Twilva is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with their data, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of Twilva after changes are posted constitutes acceptance of the updated policy.