Tuvora — Privacy Policy

Effective and last updated: October 3, 2026

This policy explains how Tuvora, operated by Hastkari LLC (“Tuvora,” “we,” or “us”), handles personal data when you use Tuvora TV, the Tuvora mobile apps, the Tuvora Apple TV app, Tuvora Desktop, tuvora.co, and related account, sync, pairing, support, and diagnostic services (collectively, the “Services”). Tuvora is a media player and does not provide, host, sell, or promote channels, movies, series, or subscriptions.

For privacy questions or requests, contact [email protected], or write to Hastkari LLC, 5900 Balcones Dr Ste 100, Austin, TX 78731-4298, USA. Tuvora is the controller of account, sync, website, and product-diagnostic data described here. Your playlist, media, and connected-service providers control their own handling of data sent directly to them.

Adults only (18+)

The Services are intended only for people who are at least 18 years old. You may not create an account or use the Services if you are under 18. Account creation records only your confirmation that you meet this requirement and the version of the terms you accepted; we do not ask for or store your date of birth. If we learn that a person under 18 provided personal data, we will disable the account and delete the data as reasonably required. A parent or guardian can contact [email protected].

Data you choose to provide

Data processed locally or by your providers

Without an account, profiles, history, preferences, and provider configurations normally remain on your device. One exception: if you set up a TV by pairing it with your phone or our website, the playlist details you enter (including the username and password) pass through our servers to reach the TV. That pairing record can be collected only once and expires after 10 minutes. Your media requests go directly from your device to the source you configured, including any backup servers you list (the app may send them a small check request to find one that is working); Tuvora does not proxy that traffic. The source can therefore receive your IP address, request details, and any credentials needed to serve the request. Some sources use unencrypted HTTP. You are responsible for selecting providers you trust and have a lawful right to use.

Data collected automatically

We do not use session replay, advertising SDKs, cross-app tracking, or intentional capture of console contents, network request bodies, full deep links, authorization codes, or playlist credentials for analytics. Diagnostic filters remove common URLs, email addresses, credentials, and token patterns before sending stack and process-exit details.

Emails we send

If you have an account, we send three kinds of email:

On by default, off in one click. Getting-started tips and product updates are switched on when you create an account. Every one of these emails has an Email preferences link and an Unsubscribe link at the bottom (no sign-in needed), and supports your email app's own one-click unsubscribe button. A change takes effect immediately for the next email. You can also use the privacy choices page or contact [email protected].

If you answer a question in one of our emails (for example, why you stopped using Tuvora), we store your answer with your account to improve Tuvora, and you can ask us to delete it.

How often. Which email you get, and when, depends on how you use Tuvora. Apart from the welcome email, we send at most one of these emails every 3 days and no more than 6 in any 30 days, and each one only once. If you haven't opened or clicked any of the last 3 we sent within 60 days, we pause them. We never email an address that bounced or reported our email as spam.

What we use to decide and personalise. Your email address; when you created your account and your place in the sign-up order (shown in some emails as a “member number”); when a Tuvora app last checked in and on which kinds of device (TV, phone, or computer); how many playlists and addons you have (a count only, never their names, addresses, or credentials); your email preferences; and which emails we have already sent you. From these we place accounts in simple stages (new, set up, engaged, quiet, or gone) so each email is relevant. We do not use your viewing history, playlist contents, provider credentials, or location to decide or personalise emails.

Email analytics. For each email we record whether it was delivered, bounced, marked as spam, opened, and which link was clicked, with times. Opens are detected with a small image; many email apps load images automatically, so opens are approximate. Links, except the email-preferences and unsubscribe links, pass through an Amazon redirect that records the click before sending you on. We discard the IP address and device details of open and click events, and we mark clicks made by automated link scanners so they are not counted. Links to tuvora.co carry campaign tags (such as utm_campaign) that identify the email and the link, not you.

Testing and comparison groups. We try different versions of the same email (for example its design, subject line, or sender name) to learn which is most useful. Each person is given one version at random, and over time more people receive the versions that get more clicks and fewer unsubscribes. About 20% of accounts are placed at random, permanently, in a comparison group that does not receive most follow-up emails, so we can tell whether the emails help at all. None of this has legal or similarly significant effects on you, and you can object to it or turn these emails off at any time.

Playful designs, never real bills. Some emails are designed to look like everyday objects, such as a cinema ticket, parking ticket, boarding pass, courier notice, receipt, or restaurant bill, and use playful sender names such as “Tuvora Box Office”. They always come from an @tuvora.co address. They are jokes: any amount shown is $0 or an optional tip, nothing is owed, no parcel is waiting, and no fine or penalty applies. Tuvora will never ask you by email for your password, payment card, or to pay a bill or fine. If an email claiming to be from Tuvora asks for any of those, it is not from us; please report it to [email protected].

Optional tips. Some emails and pages link to Ko-fi (ko-fi.com) so you can choose to tip the developer. Ko-fi and its payment processors handle the payment under their own terms and privacy policy; we never receive your card details. We receive what Ko-fi shares with creators about a tip, such as the amount, your name or display name, any message you write, and, depending on Ko-fi's settings, your email address. Tipping is entirely optional and changes nothing about your account or the Services.

Our emails are sent from [email protected], which is not monitored; please contact [email protected] instead. Each email includes our postal address.

Why we use data and our legal bases

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Grouping accounts into activity stages and choosing which version of an email to send are automated, but only decide which email you get, if any.

When data is disclosed

We disclose data only as needed to:

We do not sell personal data. We do not share personal data for cross-context behavioral advertising or targeted advertising, and we do not use personal data to serve ads.

International processing

Tuvora and its service providers may process data in the United States and other countries where they operate. Those countries may have different privacy laws. Where required for transfers from the EEA, United Kingdom, Switzerland, Brazil, or another jurisdiction, we use an applicable recognized transfer mechanism, such as an adequacy decision, certified framework, standard contractual clauses, the UK Addendum, or another lawful safeguard. Our emails are sent through Amazon Simple Email Service in the United States. Contact [email protected] to request information about safeguards relevant to your data.

Retention

Data may remain for a limited time in protected backups or provider logs until their normal overwrite cycle completes. We may retain a minimal record longer when required by law or necessary to establish or defend legal claims. We delete or de-identify data when the applicable period ends.

Your choices and privacy rights

Send requests to [email protected]. We may ask for information reasonably necessary to verify the request and your authority. We respond within the period required by applicable law. Some PostHog diagnostics use only a random installation identifier and are not linked to your account; if we cannot reasonably identify those events from the information in a request, they remain subject to the retention limit above rather than being located by email.

Security

We use reasonable administrative, technical, and access-control safeguards appropriate to the data we handle. No service can guarantee absolute security. Protect your account, choose a unique password, keep provider credentials private, and prefer sources that use HTTPS. If you believe your account or data has been compromised, contact [email protected].

Changes

We may update this policy as the Services or law changes. We will publish the new version here with a revised date and provide additional notice when a change materially affects your rights or how personal data is used. The Terms of Use also apply to the Services.

← Back to tuvora.co