How TYGA-Liberty v.o.f. handles personal data for twiyo.app and TWIYO.
Last updated: September 2026
Data controller: TYGA-Liberty v.o.f., Lankhorsterweg 13, 7951 PM Staphorst, the Netherlands. Contact: info@twiyo.app or the form at twiyo.app/contact.
App content (photos, words, progress, settings): stored in your browser/device (IndexedDB). That content reaches our servers only if you choose to store an emergency copy with Premium (one device).
Contact and organization forms: name, email address, and message you submit.
Subscriptions: payment and customer data via Stripe (e.g. email, subscription status, billing details). We do not store card details ourselves.
Website statistics: visit statistics via Google Analytics and Vercel Web Analytics (only after consent in the cookie banner).
Parent account: the email you sign in with, a one-time verification code by email, and a session token in your browser (localStorage) to keep you signed in.
Device and license data: an anonymous device ID (localStorage and twiyo_did cookie), functional cookies twiyo_cus (Stripe customer ID) and twiyo_trial / twiyo_tid (trial), and subscription status in localStorage.
Dynamic speech (Premium): words or sentences you type in the speller or phonetic AAC text are briefly sent to our server to generate mp3 audio (/api/tts). We do not permanently store that text.
Optional: your child’s first name in parent settings (device only) and search terms when picking images (Openverse/ARASAAC); chosen images are stored locally.
Premium trial: you do not need to provide an email address to start the trial. When you start, we store the start date — locally, in cookies (twiyo_did, twiyo_trial, twiyo_tid), and on our server keyed to the anonymous device ID — so the trial does not restart after reinstalling on the same device. For the one-time extension you confirm an email address (parent sign-in code). We use that address only for two reminders: three days before the trial ends and on the day Premium stops. We then remove it from the reminder list. An optional answer to “what’s stopping you?” after the trial ends is stored anonymously to improve TWIYO.
AI help assistant: questions you type in the website chat and a short conversation history (max. a few turns) are sent via our server to OpenAI to generate an answer. We do not store chat messages in a database. Questions the assistant cannot match may appear briefly in server logs (no name or email, a few days) so we can improve the FAQ.
Organization portal (pilot/subscription): word packs, device links, and an optional organization logo uploaded by an admin are stored in our cloud storage (Cloudflare R2), separated per organization (Stripe customer ID).
Emergency copy (Premium, one device): if you start it yourself, we store one copy of your words, photos, recordings, and AAC settings with your subscription (Cloudflare R2, one path per Stripe customer). The parent PIN is not stored. A new copy replaces the previous one. You can delete the copy in the app. After the subscription ends it stays available for 30 days and is then deleted. The confirmation email has no file attached.
Providing and improving TWIYO, customer support, subscription management, reminders when an extended trial is ending, security, and answering inquiries.
Contract performance (app and Premium), legitimate interest (security, statistics), and consent where required (e.g. forms you submit).
App data stays on your device until you delete it or clear app data. An emergency copy stored with Premium stays until you delete it, or until 30 days after the subscription ends. Form messages and Stripe data are kept only as long as needed for support, administration, and legal obligations. Email addresses for trial reminders are kept until those emails are sent or until you start Premium.
Stripe (payments) — stripe.com/privacy. May process data outside the EU with appropriate safeguards.
Formspree (contact forms) — formspree.io/legal/privacy-policy. Data may be processed in the United States.
Vercel (hosting, website analytics, and API) — vercel.com/legal/privacy-policy. May process data outside the EU with appropriate safeguards.
Resend (transactional email: login code, Premium welcome email, reminders for an extended trial) — resend.com/legal/privacy-policy.
Upstash Redis (short-term storage of login codes, max. ~10 minutes; trial status and optional reminder email until reminders are sent or Premium starts, max. ~400 days) — upstash.com/trust/privacy.html. Via Vercel Storage when configured.
Microsoft (Edge TTS via our /api/tts route for dynamic speech) — privacy.microsoft.com. Text is briefly processed to generate mp3 audio; we do not permanently store that text.
Openverse and ARASAAC (in-app image / pictogram search; search terms) and our image proxy for importing chosen images — see those services’ privacy policies.
Google Analytics (website statistics and ad measurement, only after consent) — policies.google.com/privacy. May process data outside the EU with appropriate safeguards.
OpenAI (website AI help assistant: your question and recent chat history are processed to generate an answer) — openai.com/policies/privacy-policy. May process data in the United States with appropriate safeguards. We do not store chat messages in a database.
Cloudflare R2 (cloud storage for organization packs, device registry, organization logos, and Premium emergency copies, one copy per subscription) — cloudflare.com/privacypolicy. Objects are stored under a path per Stripe customer; we use one bucket.
You may request access, correction, deletion, restriction, objection, and portability where applicable. Email info@twiyo.app. You may file a complaint with your supervisory authority.
TWIYO is intended for use by or under guidance of parents/caregivers. Adults purchase subscriptions. We do not knowingly collect children’s data via forms. A parent can choose to store an emergency copy with photos and recordings on a Premium subscription; that copy can be deleted in the app.
We use HTTPS, limit system access, and choose reliable processors. No method is 100% secure; report issues via contact.
TWIYO only uses necessary storage for operation and security. For website statistics, we ask permission first via the cookie banner. Without consent, we do not load Google Analytics, Vercel Analytics, or Speed Insights.
You can always change your choice via “Cookie settings” in the footer. We only store your consent choice (statistics on/off) locally in your browser.
Necessary storage and cookies (no separate consent): device ID (localStorage + twiyo_did cookie), cookie choice, parent session, settings, subscription cache, twiyo_cus (Stripe customer ID) and twiyo_trial / twiyo_tid cookies (trial, max. ~400 days), and anonymous server registration of the Premium trial (see “What data?”).
We may update this policy. The date above will change. Material updates will be noted on the site.
De app kon niet starten. Vernieuw de pagina of open twiyo.app opnieuw in de browser.
The app could not start. Refresh or open twiyo.app again in your browser.