TAVRQ
Privacy Policy
TAVRQ brings the platforms you already use into one feed. To do that it needs permission to read your feeds on those platforms. This page explains exactly what we keep, why, and how to remove it.
TAVRQ is operated by BAB Studios, based in Birmingham, England. We are the data controller for the information described here. Contact: babstudios.app@gmail.com.
The short version
- We never sell your data. TAVRQ does not insert its own ads, but embedded platforms may show theirs.
- We never store your password for any platform.
- The sign-in tokens we do keep are encrypted before they are stored.
- Posts in your feed are fetched live and are not stored by us.
- You can delete your account and everything with it from inside the app.
What we collect
Your TAVRQ account
When you sign in we receive your email address and a unique account identifier from Google Firebase, which handles sign-in. If you sign in with Google we receive only what you approve on Google's own screen.
The platforms you connect
For each platform you connect we store which platform it is, your handle there, and the access token that platform issues. How you sign in depends on the platform:
- YouTube, Twitch, Kick and Tumblr use the platform's own sign-in page. You enter your password on their site, never ours, and they give us a token.
- Instagram, TikTok, Threads, X, Vimeo and Dailymotion need no sign-in. You name public accounts or paste links to posts, and we store only that list.
- Bluesky, Lemmy and PeerTube ask you for a password or app password in TAVRQ. We pass it straight to the platform once to obtain a session token, then discard it. The password itself is never stored.
- Mastodon and other fediverse servers, Misskey and GitHub use an access token you create yourself on that service. We store that token.
- RSS stores only the feed addresses you add.
Instagram and TikTok accounts and X posts are shown in a player provided by that platform, and videos from YouTube, Twitch, Kick, Vimeo and Dailymotion play in theirs. When you open one, it loads directly from that platform. Embedded profiles, thumbnails and autoplay can make requests when their feed cards load, before you press Play. These services may receive your IP address, browser or device identifiers and viewing interactions, set cookies, infer an approximate location from your IP address, and use this information for playback, security, analytics, personalisation and advertising under their own policies. TAVRQ does not request your device's GPS location.
You can choose which platforms to add and disconnect them on the Connect page. Turning autoplay off controls playback; it does not prevent thumbnails or profile embeds from contacting their platforms. See the Google and YouTube privacy policy, TikTok privacy policy, Instagram privacy policy and X privacy policy for their data practices.
Every token is encrypted with AES-256-GCM before it is written to our database. We use a token only to load your feed, run searches you ask for, and carry out actions you take, such as a like, a comment or a post.
What you create in TAVRQ
- Posts you schedule, until they are published or you cancel them.
- Reports you send about a post: which post, the reason you chose and any note you add. We keep these for up to 180 days. What you hide is kept only on your device.
- Interactions such as likes and views, used to improve your For You feed.
- Search text you submit, passed to the platforms you search. TAVRQ does not keep a separate search-history database; those platforms apply their own retention policies.
- How many times you have used the AI assistant this month, so usage limits work.
Payments
Subscriptions are handled by Stripe. We never see or store your card details. We keep only your plan, its status and its renewal dates.
What we do not collect
We do not store the posts, photos or videos in your feed; they are fetched from each platform when you open TAVRQ. We do not add our own cross-site advertising or analytics trackers. This does not disable the data collection or ads in third-party embeds described above.
Who processes your data
| Service | What it does for TAVRQ |
|---|---|
| Cloudflare | Hosts the website and app, and runs our database. |
| Google Firebase | Handles signing in to your TAVRQ account. |
| Anthropic | Powers the AI assistant. Only the text you send to the assistant is shared, and only when you use it. |
| Stripe | Processes subscription payments, only if you subscribe. |
| jsDelivr | Delivers the video player library the web app uses, so it sees your IP address when the page loads. |
Each platform you connect has its own privacy policy, which applies to your data on that platform. Connecting it to TAVRQ does not change what that platform does with your data.
How long we keep it
- Account details, connections and tokens: until you disconnect the platform or delete your account.
- Interaction history: 30 days, then deleted automatically.
- Scheduled posts: until published or cancelled.
- Pending platform sign-ins: 10 minutes.
- Short-term counters used to prevent abuse: under an hour.
Deleting your data
Open TAVRQ, go to Settings, and choose Delete account. This permanently removes your account, every connected platform and its stored token, your scheduled posts and your history, and cancels any subscription. It does not touch your accounts on the platforms themselves.
To remove a single platform, disconnect it on the Connect page. You can also revoke TAVRQ's access from that platform's own settings at any time.
If you cannot sign in, see how to request deletion.
Your rights
Under UK data protection law you can ask to access, correct, delete or export your data, object to or restrict how we use it, and withdraw consent. Email babstudios.app@gmail.com and we will respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.
Children
TAVRQ is for adults. It is not intended for anyone under 18, and we do not knowingly collect data from anyone under 18.
Security
Connections to TAVRQ are encrypted in transit, stored tokens are encrypted at rest, and every request that touches your data must prove it comes from your signed-in account. No system is perfectly secure, and if we ever learn of a breach affecting your data we will tell you.
Changes
If we change this policy we will update the date at the top, and tell you in the app if the change is significant.