1. Data Controller
The Twools service (twools.app) is published by TWOOLS, a French simplified joint-stock company (SAS) registered under SIREN number 911 061 133, with its registered office at 2 Esplanade de la Gare, 95110 Sannois, France. TWOOLS is the controller for the processing described in this policy and can be reached at contact@twools.app.
2. Data Collected
We collect: your email address and sign-in details (at sign-up, including through Google or Twitch); your overlays (configurations, text, questions, widget settings) and the images you upload, such as team logos; for the YouTube widget, the channel you enter and its public statistics (subscribers, views), read through the YouTube API Services, without access to your YouTube account; for the League of Legends widgets set to Riot ID, the Riot ID you enter and the related public game data (rank, match history); if you use Twools Buddy, your PC’s name and, while Buddy is open, the current track (title, artist, album, duration, playback position and state, player name) with its cover, reduced before sending, as well as, if you enable its Valorant sensor, the data of the Valorant account signed in to the Riot client on your PC (Riot ID, game region, rank and rank rating, latest matches: mode, map, agent, score, kills, deaths, assists, result, rank change) and, if you enable its League of Legends sensor, the data of the account signed in to the League client on your PC (Riot ID, game server, summoner level and icon, Solo/Duo and Flex ranks, rank changes, latest matches: queue, champion, kills, deaths, assists, minions killed, duration, date, result); if you subscribe to Pro, the billing data described in section 11; and product usage data (page views, key actions such as creating an overlay). Before you sign in, this usage data is anonymous; once you are signed in, it is linked to your account so we can understand how the service is actually used. Your Twitch widgets also display your viewers’ data (usernames, messages, votes): chat messages are read directly by your browser or broadcasting software and do not go through our servers; usernames shown by alerts and games may be saved in your overlay’s state until they are replaced.
3. Use of Data
Your data is used to: provide and maintain the service (performance of the contract), including showing your widgets and the data sent by Twools Buddy (current track, Valorant and League of Legends ranks and matches) on your overlays and in your control room; sync your overlays across devices; manage your subscription and send you the related emails; measure product usage to improve it (legitimate interest); and tell you about important service updates. No data is ever sold or used for advertising.
4. Storage and Security
Accounts, overlays and uploaded files are hosted by Supabase in the European Union (Paris region, eu-west-3). The application is served by Vercel Inc., a company established in the United States: your requests may be processed outside the European Union (section 5). Your overlay configurations also live in your browser’s localStorage and are synced to the cloud when you use multi-device features. Uploaded images and covers can be accessed publicly from their address, so that your broadcasting software can display them. All exchanges are encrypted (HTTPS), and technical errors, on the server and in the browser, are monitored via Sentry, without session recording.
5. Third-Party Services and Transfers
Twools relies on providers and third-party services, each for the purpose shown: Supabase (data hosting), Vercel (application hosting), Twitch and Google (sign-in; Twitch also for chat, alerts and sub goals), YouTube (public channel statistics), Riot Games (League of Legends data, obtained from Riot with the Riot ID you enter, or by Twools Buddy from your PC with the League client’s session, without our servers querying Riot; Valorant data, obtained by Twools Buddy from your PC with the Riot client’s session, without our servers querying Riot), API-Football (team search), Apple (cover search from the title and artist, when Twools Buddy provides none), Stripe (Pro payments, section 11), Resend (sending billing and withdrawal emails), PostHog (usage measurement, hosted in the European Union and configured without cookies) and Sentry (error monitoring). We only send them the data these purposes require, and their own privacy policies apply. Twools uses the YouTube API Services: Google’s Privacy Policy applies (https://policies.google.com/privacy) and the YouTube Terms of Service govern these widgets (https://www.youtube.com/t/terms). You can revoke the access granted to Twools from your Twitch account settings or from your Google account permissions page (https://myaccount.google.com/permissions). Some providers are established outside the European Union, notably in the United States; these transfers rely on the safeguards provided by the GDPR (European Commission standard contractual clauses or the EU-US Data Privacy Framework). No data is sold or shared for commercial purposes.
6. Cookies and Local Storage
Only cookies strictly necessary for authentication and session management are set. Our usage measurement tool (PostHog) works without cookies, and no advertising trackers or session-recording tools are used. Your browser’s localStorage keeps your overlay configurations. On your PC, Twools Buddy keeps its pairing token, encrypted, and its settings in its “Twools Buddy” folder.
7. Your Rights
In accordance with the GDPR, you have the rights of access, rectification, erasure, portability, restriction and objection over your personal data. To exercise them, including to request the deletion of your account and all associated data, email us at contact@twools.app; we respond within 30 days. You may also lodge a complaint with your supervisory authority (in France, the CNIL, cnil.fr).
8. Data Retention
Your account data is kept as long as the account exists. For Twools Buddy, only the last track sent, the last Valorant reading (rank and latest matches) and, for League of Legends, the last rank reading, its latest 20 changes and up to 30 matches (the 20 most recent and the 10 most recent ranked ones) are kept, in your overlay’s state; Buddy also keeps its latest League rank readings on your PC, until you delete its folder; a paired device is kept until it is disconnected or the account is deleted. After account deletion, your data, including your uploaded images, is erased within 30 days, subject to backups and legally required retention periods. Covers sent by Buddy are kept in a shared cache: identified by their content, they are not linked to any account. Accounting records are kept for 10 years (Article L. 123-22 of the French Commercial Code); contractual evidence (acceptance of the terms of sale, withdrawals) and data needed to handle a dispute are kept separately, with restricted access, until the applicable limitation periods expire. Non-identifying aggregate statistics may be retained.
9. Policy Changes
We may update this privacy policy. Any significant changes will be communicated via email or through an in-app notification. The last update date is indicated at the top of this page.
10. Contact
For any questions regarding the protection of your personal data: contact@twools.app, or by post to TWOOLS, 2 Esplanade de la Gare, 95110 Sannois, France.
TWOOLS, SAS. Share capital: €3,000. Company registry: 911 061 133 RCS Pontoise. VAT number: FR55911061133. Registered office: 2 Esplanade de la Gare, 95110 Sannois, France. Publication director: Abdelkrim Zouaoui. Website host: Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States. Business telephone: 01 83 84 96 94.
11. Subscriptions and Stripe
When you subscribe to Pro, Stripe processes payment information including billing identity, contact details, address, payment method and transactions. Twools receives customer, subscription, session and invoice references, payment status, due dates and evidence of terms acceptance. We do not store full card numbers. Processing serves contract performance, statutory billing obligations and evidence of transactions. Contractual and accounting records may remain after account closure for legally required periods with restricted access. Stripe may process data outside the EU under the safeguards described in its privacy policy (stripe.com/privacy). This information is not a request for marketing consent.