Your data stays yours.

The short version

If you read one part, read this. Your media never reaches us. Your account exists so your settings, watchlist and sign-in follow you between devices. Everything else is optional and off until you turn it on. We never sell your data or use it for advertising, and you can ask us to delete all of it at any time.

What we process

• Account. When you sign in, we process your account email and authentication tokens to pair your device and keep you signed in. This is handled by tofa's cloud service.
• Settings and watchlist. Your app preferences and your watchlist are stored with your account so they follow you across devices and servers. They are deleted with your account.
• Media-server activity. When you connect to a media server, your playback activity on that server, what you play, playback position and completion, playback quality diagnostics such as buffering and startup time, and basic device information such as device model, device name, OS version and app version, is sent to that server. The operator of the server controls that data. When you use your own server, that operator is you.
• Watch history sync (optional). You can choose to sync your watch history to tofa's cloud so it follows you across servers and survives a server rebuild. This is off by default. When you turn it on, the synced history is tied to your account. You can turn it off, or delete the cloud copy, at any time from Settings, Privacy in the tofa web app.
• Playback diagnostics. Playback quality data, meaning buffering, startup time and errors, is stored only on the media server you play from, for that server's owner to diagnose problems. It is not sent to us.
• Server installs. When you install a tofa server, it tells us twice that it is there: once when it starts up, and once when it is running. Each message carries how it was installed, for example Docker or Windows, the operating system and processor type, and the version and update channel. Nothing else. We never receive your IP address, your computer's name, your file paths, or anything about your library. We use this to see where installs are failing, which is the difference between fixing a broken platform and never hearing about it. These messages are identified by your server's own key, not by you, though that key is linked to your account if you go on to connect the server. To turn it off before you first start the server, set TOFA_INSTALL_PING=0 in its environment.

This website

If you join the waitlist we collect your email address, which is the only required field, and any optional answers you choose to share: which devices you will watch on, what you run today, how big your library is, and how you heard about us. We save a little context with your signup, being the page you arrived from, your browser description, and which homepage headline you were shown, so we can see what is working. We use this to confirm you are on the list, to email you when access opens, and to decide what to build first. The optional answers are never required and never shared.

To keep the form free of spam, our content and security provider runs a quick automated check that processes your IP address and a one-time challenge to confirm you're human. The site also remembers your light or dark theme in your own browser. That preference never leaves your device, and we don't use cookies to follow you around.

Where your data lives

Account data and any watch history you choose to sync are stored on our own servers in the European Union. To operate the service we rely on a small number of service providers, each limited to its function: infrastructure hosting, network and security protection, and email delivery. We do not share your data with third parties for advertising or analytics, and we are happy to name our providers if you ask.

Connectivity and encryption

When you connect to a media server, the apps connect directly to it whenever possible. All connections use TLS, and the encrypted session terminates on the media server itself, so we cannot read the content of what you stream. When a direct connection is not possible, traffic passes through our relay. The relay forwards encrypted traffic and, like any network service, handles connection metadata such as addresses, timing, and data volume. We use that metadata only to operate the service. We do not use it to build profiles of what you watch, and we do not sell it.

How it's used

To sign you in, resume playback across your devices, manage your devices, and diagnose playback problems. That is it.

What we do not do

• We do not use your data to track you across apps or websites.
• We do not serve ads or include third-party advertising SDKs.
• We do not sell your data.

Sharing

Account data is processed by our cloud service. Media-server activity is sent only to the media server or servers you connect to. We do not share your data with other third parties except as required by law.

Retention and your choices

• Signing out of the app clears the device session.
• To manage your account, visit app.tofa.tv/account or contact us at the address below.
• Media-server data is retained per the policies of the server operator.
• If you enabled watch history sync, you can delete the cloud copy at any time from Settings, Privacy in the tofa web app, without deleting your account.
• Deleting your account removes your account data and any synced watch history from our cloud.
• We keep your waitlist entry until you ask us to remove it. Every email we send includes a clear way to opt out.
• Ask us for a copy of what we hold, or ask us to delete it, and we will.

Children

tofa is not directed to children under 13.

Changes

If we change how any of this works in a meaningful way, we will update this page and the date at the top, and let people know when it matters.

Contact

Tofa Software ehf., Kjarrhólmi 10, 200 Kópavogur, Iceland. Questions, or want your data removed? Email [email protected] and a real person will answer.