Privacy Policy

2. What data we collect

We collect the following categories of personal data:

• Email address— collected when you create an account or sign in. Used to identify your account, send transactional messages, and contact you about your membership — and, if you have opted in, to send marketing emails about new episodes, new series, and offers.
• Payment information— when you complete a checkout, Stripe collects and stores your card details. We store only a reference to your Stripe customer ID and payment method ID — we never see or store your full card number.
• Usage activity— we log certain in-app events (e.g. page views, checkout started, checkout completed) to understand how the platform is used and to improve it.
• Device and session data— your browser type, operating system, and IP address are collected automatically by our infrastructure and analytics providers as part of normal web operation.

3. How we use your data

• To create and manage your account
• To process membership payments and episode purchases
• To grant access to content you have paid for
• To send receipts, access confirmations, and support responses
• To notify you about new content or platform updates (only if you have opted in)
• To detect and prevent fraud or abuse
• To improve the platform based on aggregate usage patterns

4. Third-party services

We use the following third-party providers. Each has their own privacy policy and data processing terms.

• Supabase— provides our database and authentication infrastructure. Your email address and account data are stored in Supabase. Data is hosted on servers in the EU (Frankfurt).
• Stripe— processes all payments. When you enter card details at checkout, you are submitting them directly to Stripe. We do not handle raw card data.
• Brevo— our email provider. Your email address and basic account attributes (membership status, plan) are stored in Brevo so we can send receipts, payment notices, and — if you have opted in — marketing emails.
• Mux— delivers video content. Mux may collect playback metrics such as buffering events and stream quality.
• Vercel— hosts the web application. Vercel logs request metadata including IP addresses for security and performance purposes.
• Mixpanel— product analytics. We use Mixpanel to track anonymised usage events. No personally identifiable information is sent to Mixpanel beyond what you explicitly provide.
• Sentry— error monitoring. If the app crashes or encounters an error, diagnostic information (including device type and error stack trace) is sent to Sentry to help us fix it.
• OneSignal— delivers push notifications. If you allow notifications, OneSignal stores a device or browser subscription identifier linked to your account so we can send you alerts about new episodes and account or payment matters. You can turn notifications off at any time in your browser or device settings.
• Klaviyo— email and lifecycle messaging. Your email address and basic account attributes are stored in Klaviyo for the same purposes described under Brevo, as we migrate between providers.
• Meta (Facebook)— we use Meta for advertising measurement, through two channels. First, the Meta advertising pixel runs in your browser on our marketing, account and checkout pages; it sets Meta advertising cookies (_fbp, and _fbc if you arrived from a Meta ad) and reports events such as viewing our plans page, starting checkout and completing a purchase. Second, we send conversion events such as a completed purchase to Meta from our servers, with your email address hashed before it is sent.

We do not report your viewing to Meta. The Meta pixel is deliberately prevented from sending any event while you are on a series page or watching an episode, and the page address of those pages is never included in the conversion events we send from our servers. Which series and episodes you watch is not shared with Meta or with any other advertising company.

5. Data retention

We retain your account data for as long as your account is active. If you delete your account, your personal data is removed from our systems within 30 days, except where we are required to retain it for legal or financial compliance purposes (e.g. payment records are retained for 7 years in line with accounting obligations).

6. Your rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict certain processing
• Receive a copy of your data in a portable format
• Withdraw consent at any time where processing is based on consent

You can turn marketing emails off at any time in Settings → Marketing emails, or via the unsubscribe link in any marketing email. This does not affect receipts, payment notices, or other account emails.

To exercise any of these rights, email us at support@twilva.com. We will respond within 30 days.

7. Cookies and local storage

We use two kinds of cookies and browser storage.

• Strictly necessary— keeping you signed in, remembering preferences, and recording where you left off in an episode. The service cannot work without these.
• Advertising and analytics— the Meta advertising pixel sets _fbp and, if you arrived from a Meta ad, _fbc. These are advertising cookies set by a third party, and they let us measure which ads lead to sign-ups. Mixpanel and Sentry also use browser storage for product analytics and error reporting.

We do not sell your personal information for money. Sharing advertising and measurement data with Meta may count as “sharing” for cross-context behavioural advertising under some US state privacy laws, so we treat it that way and give you a way to opt out — see Your privacy choices.

8. Your privacy choices

You can opt out of advertising and analytics tracking without losing access to anything you have paid for.

• Global Privacy Control — we honour the GPC signal. If your browser or a browser extension sends it, we do not load the Meta advertising pixel at all and no advertising cookies are set. Browsers that support GPC include Firefox, Brave and DuckDuckGo; other browsers can send it via an extension. This is the fastest way to opt out and it needs nothing from us.
• Browser cookie controls— you can block or delete cookies for this site in your browser settings. Blocking strictly necessary cookies will sign you out.
• Marketing emails— turn them off in Settings → Marketing emails, or use the unsubscribe link in any marketing email. Receipts and payment notices are not affected.
• Push notifications— revoke permission in your browser or device settings at any time.
• Access, correction and deletion — email support@twilva.com and we will respond within 30 days. You can also delete your account yourself at twilva.com/delete-account.

We will not discriminate against you for exercising any of these rights — your price, plan and access stay exactly the same.