Twiikle Privacy Policy

This English-language Privacy Policy is the governing version. Translations into other languages are provided for convenience only. In the event of any conflict, this English version shall prevail.

This Privacy Policy forms part of our Terms of Service.

Table of Contents

1. Introduction

Twiikle, Inc. (the "Company," "we," "us," or "our"), a Delaware C-Corporation, operates the Twiikle platform (the "Service") — a shoppable short-form video platform where creators tag products in their videos and viewers can discover, save, and purchase those products.

This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our mobile application, website, and related services.

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

• Account Registration: Email address, username, display name, profile photo
• Social Sign-In: Name, email, and profile photo from Google OAuth or Apple Sign-In
• Content You Upload: Videos, images, text, comments, and associated metadata (titles, descriptions, tags)
• Product Tagging Data: Product names, brands, prices, descriptions, categories, and product images
• Affiliate Links: Original product URLs and affiliate tracking URLs you register
• Reports and Blocks: Content reports and user blocks you submit
• Commerce Creator KYC: For creators participating in affiliate commerce, identity verification is handled exclusively by Stripe Connect (see Section 5). We do not store your SSN, tax ID, or banking information.

2.2 Information Collected Automatically

We collect behavioral and usage data to improve the Service and personalize your experience:

Event Tracking

Interaction Tracking

Device and Technical Information

• Device type, operating system, and version
• App version
• IP address and approximate geographic location
• Device ID: An anonymous, app-generated identifier used for attribution and anti-fraud purposes (see Section 2b)
• UI Language Preference: Your chosen interface language (one of: English, Korean, Japanese, Chinese, Spanish, Portuguese, French, German)
• Residence Country (Self-Declared): A single country you declare as your residence for tax, payout, and regulatory compliance purposes. This is independent of your UI language and the geographic origin of content you view (Three-Axis Separation — see §28 of the Technical Design Document)

2.3 Information from Third Parties

• Google OAuth: Profile name, email address, profile photo
• Apple Sign-In: Name, email address (may be anonymized via Apple's relay service)
• Affiliate Networks: Purchase confirmation and conversion data from CJ Affiliate, Awin, Impact.com, Rakuten, and Amazon Associates

2b. Anonymous Viewing & Attribution Tracking

Twiikle permits viewing of the public content feed without creating an account. When you use Twiikle as an anonymous viewer, we collect and process the following data:

2b.1 What We Collect From Anonymous Viewers

• Device ID: A randomly-generated identifier stored locally on your device. This is not linked to your real identity
• IP address (standard HTTP header)
• Approximate geographic location (country-level, derived from IP)
• Browser/OS user agent
• Behavioral events: Video views, skips, taps on product tags, and click-through events to affiliate destinations (same event schema as Section 2.2, but tied to device_id rather than a user account)
• Attribution cookies: When you arrive via a shared link, we store the sharer's identifier so the correct creator receives attribution if you later make a purchase

2b.2 Why We Track Anonymous Viewers

• Affiliate attribution lock-in: If you arrive via a shared link and later make a purchase, the original sharer receives proper commission credit even if you never log in
• Series creator attribution: For paid series content, attribution lock-in lasts 30 days; for general affiliate products, the window is 7 days
• Anti-fraud: Prevent self-purchase abuse, click spam, and bot patterns
• Service operation: Provide content feeds, count views, surface trending content

2b.3 Anonymous → Registered Migration

2b.4 What Anonymous Viewers Cannot Do

• Upload content, comment, like, follow, save to MY PICK, or share
• Receive S2E (Share-to-Earn) commissions — these require a registered account, KYC-verified payout method, and FTC-compliant disclosure
• Earn Wiikle tokens (Review-to-Earn, Buyer Cashback)
• Receive notifications

Anonymous viewers may copy and paste a content URL for personal sharing (e.g., via private messaging), but this does not generate commission attribution to the anonymous viewer. Only the original creator and the original on-platform sharer (if any) receive attribution.

3. How We Use Your Information

• Provide the Service: Operate the platform, display content, process interactions
• Personalize Experience: Customize your content feed based on viewing and interaction history
• Affiliate Commerce: Process product purchases, track affiliate commissions, reconcile payments
• Analytics: Understand how the Service is used, identify trends, and improve features
• Safety and Moderation: Enforce Terms of Service and Community Guidelines, review reports, prevent abuse
• Communication: Send service updates, security alerts, and account notifications
• Legal Compliance: Comply with applicable laws, regulations, and legal processes

4. Affiliate Commerce and Tracking

Twiikle is a shoppable video platform. When you click a purchase link ("Buy Now"), you are redirected to the merchant's website through an affiliate tracking URL.

4.1 How Affiliate Tracking Works

• Twiikle partners with affiliate networks (CJ Affiliate, Awin, Impact.com, Rakuten, Amazon Associates) to track purchases
• When you click a purchase link, the affiliate network may set a tracking cookie on your device
• Cookie duration varies by network (typically 24 hours to 30 days) and is determined by the affiliate network, not by Twiikle
• We record a PURCHASE_CLICK event with the product ID and timestamp

4.1b Twiikle-Internal Attribution Windows

In addition to the affiliate networks' own cookies, Twiikle maintains its own internal attribution records for the purpose of distributing commissions among multiple participants (creator, sharer, reviewer). The Twiikle-internal windows are:

4.2 Data Shared with Affiliate Networks

• Click timestamp and referring URL
• SubID (anonymized identifier for attribution — not your personal identity)
• IP address and user agent (standard HTTP headers)

For details on each network's privacy practices, please visit their respective privacy policies.

4.3 FTC Disclosure

All product recommendations on Twiikle carry affiliate relationships. Products tagged by creators generate commissions when purchased. This is automatically disclosed in accordance with FTC guidelines (e.g., "Earns commission" badge on every product).

4b. Sub-Affiliate Distribution & Buyer Cashback (Wiikle)

Twiikle distributes a portion of every affiliate commission across multiple participants. This section explains the data we process to enable that distribution.

4b.1 Revenue Share Recipients (5 Lock-Ins)

For each qualifying purchase, we record and process attribution data for the following participants where applicable:

• (1) Creator Lock-In — the original creator of the tagged content
• (2) S2E Sharer Lock-In — the user who shared the content link that drove the click (Share-to-Earn)
• (3) Series Sub-Affiliate Lock-In — applies to paid series content; sharer attribution lasts 30 days
• (4) Buyer Cashback Lock-In (Wiikle) — the purchaser receives 3% cashback in Wiikle tokens (6-month expiry; 5% bonus on first purchase)
• (5) Review-to-Earn Lock-In — the user whose verified review (within 90 days of purchase) influenced the purchase; capped at 3 rewarded reviews per day

4b.2 Data Processed for Distribution

• Click chain: Which sharer's link you arrived from (last-touch), timestamps, and locked share ratio at the time of click
• Purchase confirmation: Amount, currency, merchant, network commission, our split among recipients
• Review attribution: Reviews you wrote and reviews that influenced your purchase (verified purchase + 90-day window)
• Wiikle token ledger: Issuance, redemption, expiry, and breakage for cashback tokens
• Self-purchase detection: We cross-check buyer identity / device against sharer identity to block self-attribution abuse

4b.3 Wiikle Tokens (Buyer Cashback)

• Wiikle tokens accrued via affiliate purchases are off-chain platform credits, not cryptocurrency
• 3% of qualifying purchase value (truncated to whole tokens) is credited to your Wiikle balance
• First-purchase bonus: additional 5% (total 8% on first purchase)
• Tokens expire 6 months after issuance
• Self-purchase via your own affiliate link does not earn cashback

4b.4 Lawful Basis (GDPR)

For users in the EEA/UK, the legal basis for processing attribution data is:

• Contractual necessity (Art. 6(1)(b)): Distributing commissions among multiple participants is core to the Service we provide to creators and sharers
• Legitimate interest (Art. 6(1)(f)): Fraud prevention (self-purchase blocking, click-chain integrity)
• Consent (Art. 6(1)(a)): For optional Wiikle cashback enrollment

5. Data Sharing and Third-Party Processors

We share your data only with service providers necessary to operate the platform:

6. Data Retention

6.1 Active Account Data

Your account data, content, and activity history are retained for as long as your account is active.

6.2 Content Deletion (Soft Delete)

6.3 Account Deletion

When you delete your account (Settings > Danger Zone > Delete Account):

• Immediately deleted: Your user profile, videos, posts, comments, likes, follows, picks, reshares, and affiliate links
• Anonymized (not deleted): Event and interaction data associated with your account is anonymized by removing your user ID. This anonymized data is retained indefinitely for aggregate analytics and service improvement. It cannot be traced back to you.
• Authentication record: Your login credentials are permanently deleted from the authentication system

Account deletion is permanent and cannot be undone.

6.4 Event and Analytics Data

Aggregate analytics data (page views, interaction counts, search trends) may be retained indefinitely in anonymized form. This data is used to improve the feed algorithm and overall Service quality.

6.5 Series & Monetization Records (Extended Retention)

The following records are retained longer than the standard 90-day soft-delete window because of financial, tax, or fraud-prevention obligations:

6.6 Anonymous Viewer Attribution Records

Attribution records tied only to a device_id (no associated user account) are retained for the duration of the active attribution window (7 or 30 days). After the window expires and no purchase event has occurred, the record is hashed and aggregated for anti-fraud signal training; raw device_id values are purged after 13 months unless required for an ongoing fraud or legal investigation.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption in Transit: All data transmitted between the app and our servers uses HTTPS/TLS encryption
• Encryption at Rest: Data stored in our database and file storage is encrypted at rest via our infrastructure provider (Supabase)
• Row Level Security (RLS): Database-level access controls ensure users can only access their own data
• Secure Token Storage: Authentication tokens are stored securely on your device using platform-native secure storage
• Password Requirements: Minimum 8 characters with uppercase, lowercase, number, and special character
• KYC Data Isolation: Creator identity verification data (SSN, tax ID, banking info) is processed and stored exclusively by Stripe Connect — we never receive or store this information

While we take reasonable measures to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

8. Children's Privacy (COPPA)

• The Service is not directed to children under 13 years of age
• Users in the EEA must be at least 16 years old to use the Service
• Commerce features (affiliate shopping, product tagging) require users to be at least 18 years old
• We do not knowingly collect personal information from children under 13. If we become aware that a user is under 13, we will promptly delete their account and all associated data
• Parents or guardians who believe their child has provided personal information to us should contact us at privacy@twiikle.com

9. Your Privacy Rights

9.1 All Users

Regardless of your location, you have the right to:

• Access: View the personal information we hold about you
• Correction: Update inaccurate information via your profile settings, including your UI language and residence country (subject to the 30-day audit limit for residence)
• Deletion: Delete your account and personal data (Settings > Delete Account)
• Data Export: Request a copy of your data in a portable format (JSON/CSV) including your viewing history, attribution records, Wiikle ledger, and content
• Anonymous Viewing: You may use the Service as an anonymous viewer (see Section 2b) without creating an account; you may also clear your local device_id by reinstalling the app, which severs anonymous attribution chains tied to the prior device identifier

9.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to Know: What personal information we collect, use, and share
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out of Sale: We do not sell personal information, so this right is satisfied by default
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise your rights, contact us at privacy@twiikle.com or use the in-app account deletion feature.

9.3 EEA/UK Residents (GDPR)

If you are in the European Economic Area or United Kingdom, you have the following rights under the General Data Protection Regulation:

• Legal Basis for Processing: We process your data based on (a) your consent, (b) contractual necessity (to provide the Service), and (c) legitimate interests (analytics, safety)
• Right of Access (Art. 15): Obtain a copy of your personal data
• Right to Rectification (Art. 16): Correct inaccurate personal data
• Right to Erasure (Art. 17): Request deletion of your personal data. Note: soft-deleted content is retained for 90 days for legitimate purposes (see Section 6.2) before permanent deletion
• Right to Restrict Processing (Art. 18): Limit how we process your data
• Right to Data Portability (Art. 20): Receive your data in a machine-readable format (JSON/CSV)
• Right to Object (Art. 21): Object to processing based on legitimate interests
• Right to Lodge a Complaint: You may file a complaint with your local data protection authority

To exercise your GDPR rights, contact our Data Protection contact at privacy@twiikle.com.

10. Do Not Track / Global Privacy Control

• We honor Global Privacy Control (GPC) signals
• We do not currently respond to browser "Do Not Track" (DNT) signals, as there is no industry-standard protocol for DNT

11. Content Moderation Data

When you report content or users, or when you are reported, we collect and retain moderation data:

• Reports: Reporter identity, target content/user, report reason (spam, harassment, violence, nudity, hate speech, misinformation, copyright, other), and description
• Blocks: Blocking user and blocked user identifiers
• Moderation Actions: Any actions taken (content removal, warnings, account suspension)

Moderation data is retained for as long as necessary for safety, legal compliance, and dispute resolution. Soft-deleted content subject to active reports may be retained beyond the standard 90-day period until the report is fully resolved.

12. International Data Transfers & Language Support

12.1 Storage Location

• Twiikle, Inc. is a Delaware C-Corporation based in the United States
• Your data is processed and stored in the United States via our infrastructure provider (Supabase)
• For EEA/UK users: data transfers to the US are protected by Standard Contractual Clauses (SCCs) as approved by the European Commission
• By using the Service, you consent to the transfer and processing of your data in the United States

12.2 Three-Axis Separation

12.3 Supported UI Languages

The Service offers a UI in 8 languages: English (en), Korean (ko), Japanese (ja), Chinese (zh, Simplified), Spanish (es), Portuguese (pt), French (fr), German (de). English is the default fallback. Privacy policy translations are provided for convenience; the English version is governing.

12.4 Residence Country and Payout Eligibility

• Payout eligibility is determined by your declared residence country, not your UI language or IP location
• Residence-country changes are recorded in residence_country_audit for fraud detection and tax compliance
• You may view non-monetizable content from any country regardless of your residence; monetization (S2E, Review-to-Earn, series sales) is gated by Stripe Connect supported countries

13. Changes to This Privacy Policy

• We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law
• For material changes, we will provide at least 30 days advance notice via in-app notification or email
• The "Last Updated" date at the top of this page indicates when the most recent changes were made
• Your continued use of the Service after the effective date of any changes constitutes acceptance of the updated Privacy Policy

14. Contact Information

Twiikle, Inc.
Delaware C-Corporation
[Address TBD]

Terms of Service