Privacy Policy
The short version
- We collect what we need to run your account, save your story progress, keep TokiToki secure and improve it.
- We do not sell your personal data for money.
- On iOS we only track you across other companies' apps and websites if you allow it. On Android you can turn off personalised ad tracking in your device settings, and on the web you can refuse non-essential cookies.
- You can access, correct or delete your data at any time. See Delete your account.
- Who we are
- Data we collect
- How we use it
- Who we share it with
- Analytics, attribution and tracking
- International transfers
- How long we keep data
- Your rights and choices
- Teens and children
- Security
- Region-specific information
- Changes to this policy
- Contact and grievances
1. Who we are
TokiToki is an interactive story app and website operated by Ethereal Labs Private Limited, a company incorporated in India ("Ethereal Labs", "we", "us"). We decide how and why your personal data is processed, and we are the data controller (or "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023).
This policy covers the TokiToki apps for iOS and Android, the TokiToki web app at tokitoki.tv, our information and support website at tokitoki.support, and support conversations with us. TokiToki Studio and FinalCrew have their own privacy notices.
2. Data we collect
Data you give us
| Category | Examples |
|---|---|
| Account details | Your name, email address, phone number and profile picture, as shared by the sign-in method you choose (Google, Apple, Facebook or phone number with a one-time code). If you use "Hide My Email" with Apple, we receive a relay address instead of your real email. |
| Age information | Your date of birth or age range, used to check you are old enough and to show age-appropriate stories. |
| Support messages | What you write to us and any details you include, such as screenshots. |
| Purchases | What you bought (such as coins, unlocked episodes or subscriptions), when, its price, your coin balance and the store receipt or transaction ID. Payments are handled by Apple (iOS), Google Play (Android) or our payment provider (web app). We do not receive your full card number, UPI PIN or bank login. |
Data collected as you use TokiToki
| Category | Examples |
|---|---|
| Story activity | Stories and episodes you watch, choices you make, progress, endings reached, favourites and preferences. |
| Device, browser and app information | Device model, operating system, app version, browser type and version, language, time zone, and identifiers such as an app installation ID or Firebase installation ID. |
| Cookies and browser storage (web app and website) | Cookies, local storage and similar technologies that keep you signed in, remember your progress and settings and, if you agree, measure usage and campaigns. See section 5. |
| Advertising identifiers | Apple's IDFA (only if you allow tracking on iOS) and Google's Advertising ID (unless you have turned it off on Android). |
| Approximate location | Country and city derived from your IP address. We do not collect precise GPS location. |
| Usage, diagnostics and crash data | Screens viewed, features used, session length, performance data, error and crash logs. |
| Notification token | A token that lets us send you push notifications if you allow them. |
| Marketing attribution | Which ad, campaign or link led you to install or open TokiToki. |
We do not access your contacts, photos, camera or microphone.
3. How we use your data
| Purpose | Data used | Legal basis (where GDPR/UK GDPR applies) |
|---|---|---|
| Create and run your account, sign you in, sync progress across devices | Account details, story activity, device information | Performance of our contract with you |
| Deliver stories, remember your choices, show age-appropriate content | Story activity, age information | Performance of contract; legal obligation (age protections) |
| Process purchases, deliver coins and unlocks, and restore what you bought | Purchase data, account details | Performance of contract; legal obligation (tax and accounting) |
| Keep TokiToki secure, prevent fraud and abuse | Device information, IP address, usage data | Legitimate interests in protecting users and the service |
| Fix bugs and crashes, measure performance | Diagnostics and crash data, device information | Legitimate interests in a working app |
| Understand how TokiToki is used and improve stories and features | Usage data, story activity (in aggregated or pseudonymised form where possible) | Consent where required by law; otherwise legitimate interests |
| Measure which ads and campaigns bring new users | Advertising identifiers, attribution data | Consent (including Apple's App Tracking Transparency prompt on iOS) |
| Send push notifications about new episodes and updates | Notification token | Consent, which you can withdraw in device settings |
| Answer support requests and legal requests | Support messages, account details | Performance of contract; legal obligation |
| Comply with law and enforce our Terms | Any relevant data | Legal obligation; legitimate interests |
Story choices can reveal personal interests. We do not use them to infer sensitive characteristics such as health, religion or sexuality, and we do not target ads based on such characteristics.
We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.
4. Who we share your data with
We do not sell your personal data for money. We share it only with:
- Service providers who work for us under contract: cloud hosting and storage, content delivery, sign-in and authentication, analytics and crash reporting, push notifications, customer support tools and payment processing. Our main provider is Google, through Firebase (see section 5). They may use your data only to provide their services to us.
- Sign-in providers (Google, Apple, Meta for Facebook Login, and our SMS provider for phone sign-in). These companies process your data under their own privacy policies.
- App stores (Apple and Google), which handle app downloads and in-app purchases under their own privacy policies.
- Payment provider for purchases made on the web app, which processes your payment details under its own privacy policy and shares with us only the details needed to confirm the purchase.
- Marketing attribution and advertising partners, who help us measure our ad campaigns. They receive advertising identifiers and install or event data only where you have allowed tracking or where the law does not require consent.
- Authorities and others where required: to comply with law, a court order or a lawful request, to protect the safety of any person, or to defend legal claims.
- A buyer or successor if we are involved in a merger, acquisition or sale of assets. This policy continues to protect your data.
5. Analytics, attribution and tracking
TokiToki uses the following third-party services. Each acts as our service provider, except where noted.
| Service | What it does | Data it receives |
|---|---|---|
| Firebase Authentication (Google) | Signs you in with Google, Apple, Facebook or phone number | Account details, phone number, sign-in tokens, IP address |
| Google Analytics for Firebase | Measures how TokiToki is used | Usage data, story activity events, device and app information, app instance ID, approximate location; advertising identifiers only where allowed |
| Firebase Crashlytics (Google) | Reports crashes and errors | Crash logs, device and app information, installation ID |
| Firebase Cloud Messaging (Google) | Sends push notifications | Notification token, installation ID |
| Other Firebase and Google Cloud services | Hosts the app's data, files and backend | The data described in section 2 |
| Mobile measurement (attribution) partner | Tells us which ad or link led to an install, sign-up or purchase | Advertising identifiers (only where allowed), IP address, device information, install and in-app events such as sign-up and purchase |
Google's handling of this data is described at firebase.google.com/support/privacy and policies.google.com/privacy.
Your choices
- iOS: we ask your permission through Apple's App Tracking Transparency prompt before accessing your IDFA or tracking you across other companies' apps and websites. If you say no, our attribution partner only receives data that Apple allows without tracking, such as aggregated SKAdNetwork results. You can change this at any time in Settings → Privacy & Security → Tracking.
- Android: you can delete or reset your Advertising ID in Settings → Privacy → Ads (the exact path varies by device).
- Web app (tokitoki.tv) and website (tokitoki.support): we use strictly necessary cookies and browser storage to keep you signed in, protect your account and remember your progress and settings. Where the law requires it, for example in the EEA and UK, we ask for your consent before setting analytics or advertising cookies, and you can change your choice at any time from the cookie settings link in the page footer. You can also block or delete cookies in your browser settings, but you may then be signed out.
- Push notifications: you can turn them off in your device's notification settings or browser site settings.
Turning off tracking does not stop the data we need to run the app securely, such as crash logs and security logs.
6. International transfers
We are based in India, and our service providers may process data in India, the United States, the European Union, Singapore and other countries. When we transfer personal data from the EEA, the UK or Switzerland to a country without an adequacy decision, we use legally recognised safeguards such as the European Commission's Standard Contractual Clauses and the UK Addendum. Transfers from India follow the Digital Personal Data Protection Act, 2023 and any restrictions the Government of India notifies.
7. How long we keep data
| Data | How long |
|---|---|
| Account details and story activity | While your account is active. Deleted within 30 days after you delete your account. |
| Purchase and transaction records | As long as tax and accounting laws require, generally up to 8 years. |
| Analytics and usage data | Up to 26 months, then deleted or aggregated so it no longer identifies you. |
| Crash, diagnostic and security logs | Up to 180 days, longer only if needed to investigate a security incident. |
| Support messages | Up to 2 years after the conversation ends. |
| Cookies and browser storage | Sign-in and preference storage until you sign out or clear it. Analytics cookies expire within 2 years. |
| Backups | Deleted data is removed from backups within a further 90 days. |
We may keep data longer where the law requires it or to resolve a dispute, and only for as long as that need lasts.
8. Your rights and choices
Depending on where you live, you can:
- access the personal data we hold about you and get a copy;
- correct data that is inaccurate or incomplete;
- delete your account and personal data (see Delete your account);
- withdraw consent at any time, without affecting processing done before;
- object to or restrict certain processing, including processing based on legitimate interests;
- receive your data in a portable format;
- nominate another person to exercise your rights if you die or become incapacitated (India);
- complain to a data protection authority.
To make a request, email admin@ethereallabs.in with the subject "Privacy Request" from the email linked to your account, or tell us the sign-in method and phone number you use. We may ask you to verify your identity. We reply within 30 days, or sooner if the law requires.
9. Teens and children
TokiToki is for people aged 13 and over, and 16 and over in the European Economic Area, the United Kingdom and Switzerland. It is not directed at children under 13, and we do not knowingly collect their data. If we learn that someone below the minimum age has an account, we delete it.
Where the law of your country requires a parent or guardian's consent to process a young person's data (for example, users under 18 in India), the parent or guardian must give that consent. We do not knowingly carry out behavioural monitoring or targeted advertising directed at users we know to be under 18.
Parents or guardians who believe their child has used TokiToki without permission can contact us at admin@ethereallabs.in with the subject "Child Safety".
10. Security
We protect personal data with encryption in transit, access controls limited to staff who need it, and monitoring of our systems. No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.
11. Region-specific information
India
We process your data under the Digital Personal Data Protection Act, 2023. You may raise a grievance with us using the contact details below. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
European Economic Area, United Kingdom and Switzerland
The legal bases for each purpose are set out in section 3. You have the right to complain to your local data protection authority, or in the UK to the Information Commissioner's Office.
United States (including California)
We do not sell personal information for money. Sharing advertising identifiers with attribution and advertising partners may count as "sharing" for cross-context behavioural advertising under California law. You can opt out by turning off tracking in your device settings or by emailing us. We honour Global Privacy Control signals on our website. We do not knowingly sell or share the personal information of consumers under 16. You will not be treated differently for exercising your rights.
12. Changes to this policy
We may update this policy as TokiToki changes, for example when we add new features or services. We will change the "Last updated" date above, and for significant changes we will tell you in the app or by email before they take effect.
13. Contact and grievances
Ethereal Labs Private Limited
2nd Floor, No. 189, Municipal No. 207/189, 14th A Cross Road, 6th Sector, HSR Layout, Bengaluru, Karnataka 560102, India
Email: admin@ethereallabs.in (subject "Privacy Request")
Phone: +91 86975 85018
Grievances about how we handle personal data can be sent to the same address with the subject "Privacy Grievance". We acknowledge grievances within 7 days and aim to resolve them within 30 days.