Privacy Policy

This policy explains what personal data StreamTrove collects, why, and what your rights are. The data controller is Squirrel AS, org. nr. 931 987 291, Bøgata 25B, 0655 Oslo, Norway (“we”). Contact: hello@streamtrove.tv.

1. What we collect

• Account data — your email address and, if you sign in with Google or Apple, the name and identifier they share. Sign-in is provided by Google Firebase Authentication.
• Watch data — your watchlist, statuses (want to watch / watching / finished), ratings, genre preferences, and your country/region. This is the heart of the service: it powers your recommendations and your plan.
• Subscription data — the streaming services you tell us you subscribe to, and the savings ledger built from your own cancel/keep decisions.
• Payment data — if you buy a paid plan, payment is processed by Paddle as merchant of record. We receive order status and plan information, never your card number.
• Bank data (Radar, where available) — if you choose to connect a bank account, a regulated account-information provider shares transaction data with us read-only, so we can identify subscription charges and price changes. We never receive the ability to move money, and we only process transactions relevant to subscriptions. Connecting is optional (consent), and you can disconnect at any time.
• Usage analytics — with your consent, we use PostHog to understand how features are used (pages viewed, features clicked, approximate device info). You can decline or withdraw this at any time on Your Privacy Choices.
• Notifications — if you enable them, the token needed to deliver push notifications to your device.
• Advertiser accounts — if you apply to advertise: your company details, contact info, and campaign data.
• Support — what you send us when you contact hello@streamtrove.tv.

2. Why, and on what legal basis

• Running the service you signed up for (account, watch data, subscription data, notifications, payments) — contract (GDPR art. 6(1)(b)).
• Bank connections and analytics — consent (art. 6(1)(a)), withdrawable at any time.
• Service security, abuse prevention, and improving recommendations — legitimate interests (art. 6(1)(f)).
• Bookkeeping and legal duties — legal obligation (art. 6(1)(c)).

We do not sell your personal data, and we do not use it to target advertising: sponsored placements on StreamTrove are matched to content genres, not to your personal profile, and advertisers only ever see aggregate statistics.

3. Who processes data for us

We use a small set of processors under data-processing agreements:

• Google Firebase (Google Ireland / Google LLC) — authentication, database, file storage, push notifications.
• Render (US) — hosting of our API and website.
• PostHog (US) — analytics, only with your consent.
• Paddle — payments for paid plans, as merchant of record (an independent controller for the checkout).

If we launch payment features (prepaid balance and virtual cards), they will involve a licensed payment partner and identity verification; we will name the partner and update this policy before those features go live, and you will see their terms at activation. Beyond processors, we disclose data only if the law requires it or in a business transfer, with this policy continuing to apply.

4. Where data goes

We are based in Norway (EEA). Some processors are in the United States; transfers rely on the EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses.

5. How long we keep it

• Account and watch data: for as long as you have an account, deleted within 30 days of account deletion.
• Analytics: per PostHog retention, and deleted on request.
• Purchase records: kept as required by Norwegian bookkeeping law (generally five years).

6. Your rights

You can ask us for access to your data, correction, deletion, restriction, a portable copy, and you can object to processing based on legitimate interests, and withdraw any consent — all via hello@streamtrove.tv or Your Privacy Choices. We answer within a month. If you are unhappy with how we handle your data, you can complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) or your local EEA authority.

7. Children

StreamTrove is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has an account, contact us and we will delete it.

8. Security

Data is encrypted in transit, access is restricted to what each system needs, and authentication is delegated to Firebase rather than passwords we store. No system is perfectly secure; if a breach ever creates risk for you, we will notify you and Datatilsynet as the law requires.

9. Changes

We will update this policy as the service evolves — material changes are announced in the app or by email before they take effect. The date at the top tells you when it last changed.