Privacy

When you browse, without an account

• A random identifier stored in a cookie, and what you do with it on the site: videos watched and for how long, likes, saves, playlists, creators followed, filters used. It is used to order the videos for you. While you browse without an account it isn't linked to your name or e-mail; if you create an account or sign in, this history is attached to your account so it follows you on every device.
• Speed measurements: how fast pages and videos load on your device, sent with only the kind of page and of device, without any identifier.
• Your network address is used to keep the site safe (limits on sign-in codes and forms); in our database we only keep a scrambled (keyed hash) version of it. Our host's technical logs (Vercel) record it for a short time, as for any website, to run and protect the service.

When you create an account

• Your e-mail address; if you continue with Google or Apple, the e-mail, name and account identifier they give us (never your password with them).
• For creators we invited: a password, stored only in scrambled form (scrypt).
• What you add: display name, photo, bio and links (creators), your role (fan or creator) and your confirmation that you are 18 or older.
• Your requests, offers, messages, delivered videos, reviews and reports.
• Records of payments and payouts (amounts, dates, status). Card and bank details go to Stripe, not to us (section 4).
• Security logs: sign-ins and important actions, to prevent fraud and abuse.

When you contact us

• What you write in the contact form: e-mail, name, message, the link concerned, your state (for privacy requests) and your typed signature (copyright and intimate image requests).

• To run the site: sign-in, your library, recommendations, requests, payments, payouts, messages and deliveries.
• To personalise the order of videos (based on what you watch and like). We don't make decisions about you with legal or similarly significant effects by automated means.
• To keep the platform safe and lawful: moderation of requests and messages (adults only, no sexual content, no contact details), fraud prevention, disputes, answering legal requests.
• To keep the site fast and working (speed measurements, error logs).
• To meet legal obligations, such as accounting and tax records of payments.

We don't use your information to infer health conditions. Watching videos for sleep or relaxation is used only to recommend similar videos; we don't collect “consumer health data” as defined by Washington, Nevada or other state laws.

Only service providers that work for us, under contract, for these purposes only:

• Vercel (hosting), Supabase (database, United States), Stripe (payments and payouts), Resend (sign-in e-mails), Apple iCloud (our contact mailbox), Google and Apple (only if you sign in with them), YouTube (video player).
• The other person in a conversation sees what you send there (fan and creator).
• Authorities, when the law requires it, or to protect someone's safety (for example reports to NCMEC).
• A buyer or successor, if our business is sold or merged, under this policy.

We have not sold personal information or shared it for cross-context behavioural (targeted) advertising, in the last 12 months or ever, and we don't knowingly sell or share the information of anyone under 16.

Payments and creators' payouts are handled by Stripe. Card details go directly to Stripe. Creators confirm their identity, tax information and bank account with Stripe inside their wallet on our site; we receive only whether payouts are ready, balances and the amounts paid. Stripe's privacy policy applies to what it collects.

Videos play in YouTube's official player, in its privacy-enhanced mode (youtube-nocookie.com). When a video plays, YouTube receives information as described in Google's privacy policy. This site uses YouTube API Services; see the YouTube Terms of Service. Creator pages show public information from YouTube channels (name, photo, description, public videos), with contact details removed. To sort videos by trigger, mood and voice, public videos are analysed automatically (including with Google's Gemini AI); this concerns the public videos, not visitors. Creators who haven't joined Tingly Room are not affiliated with us; any creator can ask us to remove her page through the contact form.

• af_viewer: random identifier for your library and recommendations (1 year). af_has_viewer: tells the page a library exists (1 year).
• af_session, af_role: keep you signed in (30 days). af_admin: our team's admin session (12 hours).
• Local storage in your browser: your chosen look, sound setting and the last videos shown, so the site remembers them.

All of them are needed for the site to work; none is used for advertising or by third-party analytics. Your browser lets you delete them; the site then starts fresh. Do Not Track and Global Privacy Control: since we don't sell, share for targeted advertising or track you across other sites, there is nothing for these signals to switch off; we treat a Global Privacy Control signal as a valid request to opt out, and would honour it for any such use.

• Browsing data: linked to the random identifier in your browser (and to your account if you have one). If you delete your cookies without an account, that history can no longer be linked to you; we keep it, anonymous, to improve recommendations. When an account is deleted, its history is detached from it.
• Speed measurements: 90 days.
• Account data: as long as your account exists. When it is deleted we erase or anonymise it, except what we must keep by law (payment and tax records, usually 7 years) or to handle an open dispute.
• Sign-in codes stop working after 10 minutes. Sessions end after 30 days.
• Contact form messages: up to 3 years, longer for copyright and legal notices when the law requires it.

Data travels encrypted (HTTPS). Sign-in codes, passwords and session tokens are stored only in scrambled form. Access to the database is restricted to the site's servers and our team. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

Depending on where you live, and in particular if you live in California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, you may have the right to:

• know what personal information we have about you and get a copy of it in a portable format;
• have it corrected or deleted;
• opt out of its sale, of its sharing for targeted advertising and of profiling with significant effects (we don't do any of these);
• limit the use of sensitive information (we use account passwords and message contents only to provide the service);
• not be treated differently for using these rights.

How to ask: through the contact form (“My personal data”) or at contact@tinglyroom.com. We confirm within 10 days and answer within 45 days (we may extend once by 45 days, telling you why). To protect you, we check that the request comes from the account's owner, usually by e-mail. You can use an authorized agent; we may ask for proof of their authority and confirm with you directly.

Appeals: if we refuse your request, you can appeal by replying to our answer or through the contact form (“appeal”). We answer within 45 days (60 days in Colorado). If you disagree with the outcome, you can contact your state attorney general.

California. In the last 12 months we collected the categories listed in section 1: identifiers (e-mail, account and browser identifiers), account credentials, commercial information (requests and payments), internet activity on our site (including the videos watched, linked to your account if you have one), the contents of messages you send through the site, inferences about the videos you may like, and, for creators, professional information. We collected them from you, your browser, Google or Apple (if you sign in with them), YouTube (public channel information) and Stripe (payout status), for the purposes in section 2, and disclosed them only to the providers in section 3. We don't disclose personal information to third parties for their own direct marketing (California “Shine the Light”).

Nevada. We don't sell covered information; you can still send us an opt-out request through the contact form.

The site is not directed to children under 13 and we don't knowingly collect personal information from them. Videos marked “made for kids” on YouTube are never shown. Accounts are for adults (18 or older, and of legal age where they live); if we learn an account belongs to a minor, we close it. A parent who thinks we hold information about their child can ask us to delete it through the contact form.

If the GDPR or the UK GDPR applies to you: the controller is TONEY DIGITAL LLC, a Wyoming limited liability company, 30 N Gould St, Ste R, Sheridan, WY 82801, USA. We process your data to provide the service you ask for (contract), for our legitimate interests in recommending videos, keeping the site fast and safe and preventing fraud, to meet legal obligations, and with your consent where we ask for it. Your data is stored in the United States; our providers transfer it under the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. You can ask for access, correction, deletion, restriction, portability, object to processing, and withdraw consent at any time, through the contact form; you can also complain to your data protection authority.

If this policy changes in an important way, we will say so on the site before the change applies. Questions or requests: contact form or contact@tinglyroom.com. See also our Terms of use.