The eyes are bars. By design.

Controller

• Controller. twiga is run by one person during the private beta — no company is registered yet.
• Contact. [email protected] for rights requests, deletion, and questions.
• DPO or representative. None currently designated. Use the contact above.

What we process

• Account & auth. User ID, display name, sign-in state, your account's public key (the public half of your twiga key; it checks the signature you sign in with), and session records for the duration of a session. An email address only if you added one before twiga stopped taking them; you can remove it in Settings. We do not store your IP address in these records. Accounts made with a key have no password. An older account made before keys, if it has not been given a key since, may still hold a password hash; password sign-in is switched off.
• Source credentials. Your M3U link or Xtream login. Your provider login is sealed in your browser with your key. The server stores ciphertext and opens it in memory while you’re signed in, then wipes it 30 minutes after your session goes quiet.
• Operational logs. Minimal security and reliability logs, retained briefly, then rotated.
• Recovery. Account recovery uses a recovery code that identifies your account. No email is required.

Program guide

twiga adds program-guide (EPG) data to your channels — what airs when. The guide itself is public TV schedule data. To get it, twiga asks your own provider over Tor, and that request carries your provider login, because that's how providers serve guides. It never carries your twiga account, your home IP or your viewing history. Many providers serve the guide over plain http; when yours does, the Tor exit relay that carries the request could read the login in it. Your guide is never pooled with anyone else's, and never built from anyone else's.

Payments

Paid plans are settled in Monero, from a wallet you hold. twiga stores no card number, bank detail, or billing address, and asks for no government ID. A payment funds your access without a stored link back to your account — the same principle as your sealed login, applied to paying: what we can't tie together, we don't.

What twiga does not do

No ad tracking

No customer data for third-party advertising or cross-app tracking.

No selling data

We never sell or rent personal data to anyone.

No profiling

No automated decisions with legal effects under Article 22 GDPR.

Scope

• Covered surfaces. twiga player (the web player; the Android TV / Google TV app is in testing, not part of this beta), twiga.tv, related public pages, twiga account APIs, and support or account-management interactions.
• Not covered. Third-party content providers, playlist providers, metadata providers, or websites and services not operated by twiga.

Categories of data twiga processes

• Account and authentication data. User ID, display name, sign-in state, your account's Ed25519 public key (it checks the signature your key makes at sign-in), login session records (no IP address is stored), and account-security records. An email address only where you added one before twiga stopped taking them. An older account made before keys, if it has not been given a key since, may still hold a password hash; an account made with a key has none.
• Source, playlist, and channel data. Source names, playlist or guide URLs, encrypted source credentials, imported channel metadata, and playlist selections linked to the account.
• Playback, operational, and diagnostic data. Stream session records (bytes transferred, startup timing, exit reason — no IP addresses, no channel or content identifiers), relay usage, performance data, audit records, and diagnostics needed to operate, secure, and improve the service.
• Support and communications data. Mail you send to the support address, onboarding records, account-management messages, and any email-verification records left from the retired email sign-up.
• Payment data. twiga stores no card, bank, or billing-identity data. Paid access is settled in Monero from a wallet the user holds, and is not linked to the account — twiga keeps only the fact that an account has paid-through time, never who paid or how.
• Local app data. The Android TV / Google TV app (in testing) keeps its session token and keys in the platform's encrypted storage, and caches your last channel list on the device so it opens fast. The guide and your favourites stay in memory.

Purposes and legal bases

• Account creation, sign-in, and session management. Legal basis: performance of a contract under Article 6(1)(b) GDPR, plus legitimate interests under Article 6(1)(f) for account security and fraud prevention.
• Source handling, playlist organization, EPG, and playback delivery. Legal basis: performance of a contract under Article 6(1)(b).
• Security, abuse prevention, rate limiting, and reliability. Legal basis: legitimate interests under Article 6(1)(f), including protecting infrastructure, credentials, sessions, and service availability.
• Security events and account recovery. Security events appear in your Activity tab when you sign in, and recovery works with your recovery code alone. Neither uses email. Legal basis: our legitimate interests in keeping your account secure and recoverable (Article 6(1)(f) GDPR).
• Support replies. A reply to feedback you send from your dashboard lands in your Activity tab. Mail you send to the support address is answered by a person, to the address you wrote from. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• Marketing. None. twiga sends no marketing email and no longer asks for consent to it. If you gave that consent before, you can withdraw it in Settings, and removing your email withdraws it too.
• Email addresses added before twiga stopped taking them. twiga sends nothing to them. You can remove yours in Settings at any time, and deleting the account removes it too.
• Compliance and legal requests. Legal basis: legal obligation under Article 6(1)(c), plus legitimate interests under Article 6(1)(f) where rights must be enforced or defended.
• Server access logs and operational monitoring. Legal basis: legitimate interests under Article 6(1)(f) for security, abuse prevention, and infrastructure reliability. Logs are access logs only — no behavioural or user tracking.

Recipients and service providers

• Edge and infrastructure. Cloudflare operates the edge for all twiga.tv traffic — the player, the stream path, and adding a source included. It terminates TLS at the edge, so it processes your IP address and the requests you send under its own terms as a processor — including, while you're signed in, the session copy of your vault key, and your provider login when you add a source. On the sign-up step, Cloudflare Turnstile runs a bot check. twiga also uses hosting and network infrastructure to deliver the service.
• Email. twiga sends no automated email: no alerts, no receipts, no newsletters. Security and account events appear in your Activity tab when you sign in. Mail you send to the support address is read and answered by a person.
• Relay and network infrastructure. twiga may use infrastructure or relay providers that support secure service delivery.
• Server logs and operational monitoring. twiga's application request logs record the HTTP method, path, status code, and user agent — no client IP address. Rate limiting uses in-memory counters, not stored IPs. Admin actions are audit-logged with the acting admin's own IP. Logs are rotated, not kept indefinitely. (Cloudflare, as the edge, processes IP addresses under its own terms — see above.) twiga uses self-hosted, cookieless page-view analytics (Umami) to measure aggregate traffic. No personal data is collected, no cookies are set, and no cross-site tracking is performed.
• Legal and transactional disclosures. twiga may disclose data where required by law or in connection with a merger, financing, or similar transaction.

International transfers

twiga and its service providers may process personal data in countries outside the country where the user lives. Where twiga transfers personal data outside the EEA, UK, or Switzerland, twiga intends to rely on lawful transfer mechanisms such as an adequacy decision, Standard Contractual Clauses, the UK International Data Transfer Addendum, or another mechanism permitted by applicable law.

Users may request more information about relevant transfer safeguards by contacting [email protected].

Cookies and similar technologies

• Essential session cookies. twiga uses session cookies on the web to keep users signed in, protect authenticated routes, and maintain session integrity.
• Device storage in the TV app. The Android TV / Google TV app (in testing) uses the platform's encrypted storage and local preferences instead of browser cookies.
• No advertising cookies described here. twiga does not describe the current product as using third-party advertising cookies or cross-site tracking technologies.

Retention and deletion

twiga keeps personal data only for as long as needed for service delivery, security, support, dispute resolution, and legal compliance. Account records and configured source data are generally retained while the account remains active. Session records expire and may be rotated or deleted after expiry. Security, audit, and diagnostic records are retained only for as long as needed for fraud prevention, troubleshooting, reliability analysis, and legitimate business operations. Local app data remains on the device until it is cleared, replaced, or removed by the user.

Consent records. Where you opted in to marketing email before twiga stopped offering it, withdrew that opt-in, or removed an email, twiga keeps a versioned record of that choice as an audit trail. It is kept for the life of your account and for a limited period afterwards.

Until self-service account deletion is fully shipped across every client surface, account-deletion and rights requests can be sent to [email protected].

Rights and complaints

• Rights. Subject to applicable law, users may have rights of access, correction, deletion, restriction, objection, and portability.
• Withdrawal of consent. twiga no longer asks for marketing consent. If you gave it before, you can withdraw it in Settings whenever you like, and removing your email withdraws it too. Withdrawal does not affect processing carried out before you withdrew.
• Complaint right. Users have the right to lodge a complaint with the supervisory authority in the EU or EEA member state where they live, work, or where the alleged infringement took place.
• Verification. twiga may request reasonable information to verify identity before acting on a privacy-rights request.

Whether providing data is required

• Account data. None required. An account is a key: creating one needs no email, name, or other details from you. twiga doesn't ask for an email.
• Source data. Source details and credentials are needed if you want twiga to fetch, organise, and relay that source.
• Operational data. Some session, device, and network information is processed automatically because it is necessary for authentication, delivery, and security.
• Consequence. Creating an account needs no details from you. Source features still require the relevant source details.

Privacy contact

Privacy questions, rights requests, and account-deletion requests can be sent to [email protected]. Until final company registration details are published, this page should be read as twiga's current beta privacy notice.