Twiikle Privacy Policy

This English-language Privacy Policy is the governing version. Translations into other languages are provided for convenience only. In the event of any conflict, this English version shall prevail.

This Privacy Policy forms part of our Terms of Service.

Table of Contents

1. Introduction

Twiikle, Inc. (the "Company," "we," "us," or "our"), a Delaware C-Corporation, operates the Twiikle platform (the "Service") — a shoppable short-form video platform where creators tag products in their videos and viewers can discover, save, and purchase those products.

This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our mobile application, website, and related services.

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

• Account Registration: Email address, username, display name, profile photo
• Social Sign-In: Name, email, and profile photo from Google OAuth or Apple Sign-In
• Content You Upload: Videos, images, text, comments, and associated metadata (titles, descriptions, tags)
• Product Tagging Data: Product names, brands, prices, descriptions, categories, and product images
• Affiliate Links: Original product URLs and affiliate tracking URLs you register
• Reports and Blocks: Content reports and user blocks you submit
• Commerce Creator KYC: For creators participating in affiliate commerce, identity verification is handled exclusively by Stripe Connect (see Section 5). We do not store your SSN, tax ID, or banking information.

2.2 Information Collected Automatically

We collect behavioral and usage data to improve the Service and personalize your experience:

Event Tracking

Interaction Tracking

Device and Technical Information

• Device type, operating system, and version
• App version
• IP address and approximate geographic location

2.3 Information from Third Parties

• Google OAuth: Profile name, email address, profile photo
• Apple Sign-In: Name, email address (may be anonymized via Apple's relay service)
• Affiliate Networks: Purchase confirmation and conversion data from CJ Affiliate, Awin, Impact.com, Rakuten, and Amazon Associates

3. How We Use Your Information

• Provide the Service: Operate the platform, display content, process interactions
• Personalize Experience: Customize your content feed based on viewing and interaction history
• Affiliate Commerce: Process product purchases, track affiliate commissions, reconcile payments
• Analytics: Understand how the Service is used, identify trends, and improve features
• Safety and Moderation: Enforce Terms of Service and Community Guidelines, review reports, prevent abuse
• Communication: Send service updates, security alerts, and account notifications
• Legal Compliance: Comply with applicable laws, regulations, and legal processes

4. Affiliate Commerce and Tracking

Twiikle is a shoppable video platform. When you click a purchase link ("Buy Now"), you are redirected to the merchant's website through an affiliate tracking URL.

4.1 How Affiliate Tracking Works

• Twiikle partners with affiliate networks (CJ Affiliate, Awin, Impact.com, Rakuten, Amazon Associates) to track purchases
• When you click a purchase link, the affiliate network may set a tracking cookie on your device
• Cookie duration varies by network (typically 24 hours to 30 days) and is determined by the affiliate network, not by Twiikle
• We record a PURCHASE_CLICK event with the product ID and timestamp

4.2 Data Shared with Affiliate Networks

• Click timestamp and referring URL
• SubID (anonymized identifier for attribution — not your personal identity)
• IP address and user agent (standard HTTP headers)

For details on each network's privacy practices, please visit their respective privacy policies.

4.3 FTC Disclosure

All product recommendations on Twiikle carry affiliate relationships. Products tagged by creators generate commissions when purchased. This is automatically disclosed in accordance with FTC guidelines.

5. Data Sharing and Third-Party Processors

We share your data only with service providers necessary to operate the platform:

6. Data Retention

6.1 Active Account Data

Your account data, content, and activity history are retained for as long as your account is active.

6.2 Content Deletion (Soft Delete)

6.3 Account Deletion

When you delete your account (Settings > Danger Zone > Delete Account):

• Immediately deleted: Your user profile, videos, posts, comments, likes, follows, picks, reshares, and affiliate links
• Anonymized (not deleted): Event and interaction data associated with your account is anonymized by removing your user ID. This anonymized data is retained indefinitely for aggregate analytics and service improvement. It cannot be traced back to you.
• Authentication record: Your login credentials are permanently deleted from the authentication system

Account deletion is permanent and cannot be undone.

6.4 Event and Analytics Data

Aggregate analytics data (page views, interaction counts, search trends) may be retained indefinitely in anonymized form. This data is used to improve the feed algorithm and overall Service quality.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption in Transit: All data transmitted between the app and our servers uses HTTPS/TLS encryption
• Encryption at Rest: Data stored in our database and file storage is encrypted at rest via our infrastructure provider (Supabase)
• Row Level Security (RLS): Database-level access controls ensure users can only access their own data
• Secure Token Storage: Authentication tokens are stored securely on your device using platform-native secure storage
• Password Requirements: Minimum 8 characters with uppercase, lowercase, number, and special character
• KYC Data Isolation: Creator identity verification data (SSN, tax ID, banking info) is processed and stored exclusively by Stripe Connect — we never receive or store this information

While we take reasonable measures to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

8. Children's Privacy (COPPA)

• The Service is not directed to children under 13 years of age
• Users in the EEA must be at least 16 years old to use the Service
• Commerce features (affiliate shopping, product tagging) require users to be at least 18 years old
• We do not knowingly collect personal information from children under 13. If we become aware that a user is under 13, we will promptly delete their account and all associated data
• Parents or guardians who believe their child has provided personal information to us should contact us at privacy@twiikle.com

9. Your Privacy Rights

9.1 All Users

Regardless of your location, you have the right to:

• Access: View the personal information we hold about you
• Correction: Update inaccurate information via your profile settings
• Deletion: Delete your account and personal data (Settings > Delete Account)
• Data Export: Request a copy of your data in a portable format

9.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to Know: What personal information we collect, use, and share
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out of Sale: We do not sell personal information, so this right is satisfied by default
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise your rights, contact us at privacy@twiikle.com or use the in-app account deletion feature.

9.3 EEA/UK Residents (GDPR)

If you are in the European Economic Area or United Kingdom, you have the following rights under the General Data Protection Regulation:

• Legal Basis for Processing: We process your data based on (a) your consent, (b) contractual necessity (to provide the Service), and (c) legitimate interests (analytics, safety)
• Right of Access (Art. 15): Obtain a copy of your personal data
• Right to Rectification (Art. 16): Correct inaccurate personal data
• Right to Erasure (Art. 17): Request deletion of your personal data. Note: soft-deleted content is retained for 90 days for legitimate purposes (see Section 6.2) before permanent deletion
• Right to Restrict Processing (Art. 18): Limit how we process your data
• Right to Data Portability (Art. 20): Receive your data in a machine-readable format (JSON/CSV)
• Right to Object (Art. 21): Object to processing based on legitimate interests
• Right to Lodge a Complaint: You may file a complaint with your local data protection authority

To exercise your GDPR rights, contact our Data Protection contact at privacy@twiikle.com.

10. Do Not Track / Global Privacy Control

• We honor Global Privacy Control (GPC) signals
• We do not currently respond to browser "Do Not Track" (DNT) signals, as there is no industry-standard protocol for DNT

11. Content Moderation Data

When you report content or users, or when you are reported, we collect and retain moderation data:

• Reports: Reporter identity, target content/user, report reason (spam, harassment, violence, nudity, hate speech, misinformation, copyright, other), and description
• Blocks: Blocking user and blocked user identifiers
• Moderation Actions: Any actions taken (content removal, warnings, account suspension)

Moderation data is retained for as long as necessary for safety, legal compliance, and dispute resolution. Soft-deleted content subject to active reports may be retained beyond the standard 90-day period until the report is fully resolved.

12. International Data Transfers

• Twiikle, Inc. is based in the United States
• Your data is processed and stored in the United States via our infrastructure provider (Supabase)
• For EEA/UK users: data transfers to the US are protected by Standard Contractual Clauses (SCCs) as approved by the European Commission
• By using the Service, you consent to the transfer and processing of your data in the United States

13. Changes to This Privacy Policy

• We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law
• For material changes, we will provide at least 30 days advance notice via in-app notification or email
• The "Last Updated" date at the top of this page indicates when the most recent changes were made
• Your continued use of the Service after the effective date of any changes constitutes acceptance of the updated Privacy Policy

14. Contact Information

Twiikle, Inc.
Delaware C-Corporation
[Address TBD]

Terms of Service