Privacy policy

Data controller

Robin Synnergren Jonasson, Armlängdsgatan 1, 421 72 Västra Frölunda, Sverige. Privacy contact: Rsynnergren@gmail.com.

Data we process

• When you buy: the purchase is made with Paddle, which receives and processes your payment and purchase details in its own right and is itself the data controller (see Paddle’s privacy notice). Robin Synnergren Jonasson does not receive or store your card details. According to Paddle’s Data Sharing Addendum, we as the supplier get access to the buyer’s name and address, e-mail address and purchase history in Paddle’s tools. Our own system stores only the order number, amount, currency, status, a reference to any discount code and the link to your EvoTok account – not the buyer’s name, address, card details or the e-mail address used for the purchase.
• Account, license and delivery: when you create an EvoTok account we store your e-mail address, an identifier for your sign-in at Firebase Authentication (e-mail and password, or Google) and a sign-in session (only a hash of the session key). The password is handled by Firebase and is not stored by us. The license ID, type and status, the history of changes, the computer the license was activated on (a technical device key, as a hash, and a label) and your purchases are linked to the account so we can deliver the license and download link, troubleshoot and revoke the right license when a refund has been granted.
• Support and feedback forms: subject, message, request category, language and – if you provide them – email address (required for support, optional for feedback), name and app version. Never send passwords or payment card details; the form rejects messages that look like they contain such data.
• Abuse protection: the forms use Cloudflare Turnstile to tell people from automated programs. Cloudflare then processes technical signals from your browser – according to Cloudflare your IP address, TLS fingerprint, User-Agent header and the site key and its origin. Cloudflare processes them on our behalf to detect and block bots, and is also itself the data controller for improving Turnstile’s bot detection. To limit the number of submissions we ourselves do not store your IP address in clear text, only a one-way hash of it, and such records are cleaned up automatically after two days.
• Discord: if you contact us on Discord, Discord’s own terms and privacy policy also apply. Discord is itself the data controller for data collected in its service.
• Notifications to Discord: when a request is submitted we may receive a notice in a private Discord channel. It contains only the request number, the category (support or feedback) and a link to our login-protected admin view – never your name, your email address or your message.
• The app – locally on your computer: the app stores the license, the signed revocation list, your settings, scenes and goals in your user profile on your own computer. You enter your TikTok username in the app; no password is needed. The app receives events from TikTok LIVE, such as chat comments, gifts and follows with viewers’ usernames, and shows them in your overlays. The built-in read-aloud of the chat runs locally on your computer without internet.
• The app – updates and revocation list: the app downloads signed updates and the revocation list from a storage server. The storage provider (Cloudflare R2) then technically sees your IP address.
• The app – optional Google TTS: read-aloud is off until you enable it and choose a voice engine. If you choose Google and enter your own Google API key, the text to be read aloud is sent together with the key straight from your computer to Google (texttospeech.googleapis.com) each time an item is read aloud, and Google’s terms and privacy policy then apply. The key is stored only on your computer and is not sent to us.
• The app – telemetry and crash reports: the app does not send usage or crash data. We have reviewed the app’s source code and find no such collection.
• The app – account and license proof (from the version that is activated with an account): the app contacts the account service to sign in and to receive a time-limited license proof that is renewed when the app is online. A technical device key is sent. Sign-in happens in the browser and no password is sent to the app.
• The website: uses no marketing cookies. If you accept in the cookie banner we use Google Analytics (Google LLC) to count visitors; it sets analytics cookies in your browser and Google may process the data in the United States. Without your consent Google Analytics is not loaded. You can change your mind at any time by clearing the site’s data in your browser. Our hosting provider may log IP addresses for security reasons.

Purposes and legal basis

• Account, sign-in, license, delivery and updates – to perform our contract with you.
• Support – to perform our contract with you and our legitimate interest in being able to help you. Feedback – our legitimate interest in improving the product.
• Handling refunds and disputed payments – to perform the contract and our legitimate interest in revoking the right license.
• Bookkeeping – to meet legal obligations.
• Security and protection against spam and abuse – our legitimate interest.

Recipients

Website and hosting: Netlify. Support inbox (forms, ticket database, abuse protection and access control): Cloudflare – Workers, D1 database with EU jurisdiction, Turnstile and Cloudflare Access. Notices about new requests (request number and category only): Discord. The app’s updates and revocation list: storage server (see above).

For accounts and purchases we also use: Paddle as Merchant of Record and payment handler; Cloudflare Workers and a D1 database (EU jurisdiction) for the account service at konto.evotok.com, where accounts, licenses and orders are stored; Firebase Authentication (Google) for sign-in with e-mail and password or Google; Netlify, which serves the address konto.evotok.com; and a storage server for the app’s download and updates (see above).

Transfers outside the EU/EEA: Cloudflare, Netlify and Discord may process data outside the EU/EEA, including in the United States. According to the providers themselves, they base such transfers on the EU–U.S. Data Privacy Framework and/or the European Commission’s standard contractual clauses. Paddle states in its privacy notice that data may move between Paddle entities and to sub-processors in other countries and that standard contractual clauses and other appropriate safeguards are used. The D1 database is stored in the EU jurisdiction, but Cloudflare Workers may handle a request anywhere in the world. According to Google, Firebase Authentication runs only from data centers in the United States, and Google LLC states that it is certified under the EU–U.S. Data Privacy Framework.

Retention

Support and feedback requests that have been marked as closed are deleted automatically, together with their notes, 180 days after the request was last updated. The deletion is run by a scheduled job every night. Requests that are not closed are not deleted automatically. After deletion the data may remain in the database provider’s restore history for up to 7 days. We cannot guarantee that the data disappears from every restore option immediately upon deletion. Data the app stores locally is on your computer and under your control. Account data is kept for as long as you have the account. You can ask for the account to be deleted; the e-mail address and sign-in identities are then removed and orders are kept without personal data. Order and license data (order number, amount, currency, status, license ID, type, status and history, and the link to your account) is kept for as long as you have the account, because we need it so you can use and activate the license, for support and to handle refunds and disputed payments. When the account is deleted the link to you is removed and the order is kept without personal data (order number, amount, currency and status) for our accounting and to handle later refunds. The purchase, payment and receipt are handled by Paddle, which keeps its data under its own rules (see Paddle’s privacy notice). Accounting records we hold are kept as required by the Swedish bookkeeping law, for seven years after the end of the financial year, and only the records the law requires.

Your rights

You have the right to request access to, correction or erasure of your data, restriction of processing, to object to processing and to receive your data (data portability). Contact us via the support form on the website or our Discord server or Rsynnergren@gmail.com.

You can lodge a complaint with the Swedish Authority for Privacy Protection (IMY).