Privacy statement
TUSAVO

Last updated: October 26, 2026.

Who are we?

TUSAVO is offered under the trade name Mistirix, a sole proprietorship with Chamber of Commerce number 42175155, Netherlands. If you have any questions about your data, please contact us at support@mistirix.com, with the subject 'Privacy TUSAVO'.

This statement is about the TUSAVO app and the services we use for it. The websites and video services you use via TUSAVO may also have their own privacy conditions.

Privacy starts on your own devices

TUSAVO is designed to run everyday family features locally. Child profiles, video assignments, settings, viewing history and family recovery copies remain in app storage on the relevant devices in your family. By local we mean both parents’ devices and linked children’s devices, wherever they need those data. Mistirix does not keep a central online backup.

We do use online processing for parent sign-in, secure pairing and recovery permissions, Premium and submitted feedback. Your chosen video service also receives requests directly from your device. The sections below explain where each type of data is processed and stored.

What data do we use?

Parent account and Google login. As a parent, you sign in with Google. TUSAVO receives your Google account identifier, email address, confirmation that the address is verified and, if available, your profile name. We use these data to identify you, check your family role and manage access, pairing and recovery. We do not receive your Google password.

We store account and family connections on our server, including the Google account identification and the email address of the family manager. For feedback, we also store an available profile name and a derived recognition code from the email address. That code is not anonymous. With a parent link, the necessary parent identifications are exchanged between the parents involved. Your device may remember secure login information and your parent identification. The online registrations are not a backup of your local library or viewing history.

Child data within your family

As a parent, you set up TUSAVO and choose which videos your child can open in the app. You may use a nickname; your child’s full name is not required. Child profiles, video assignments, settings and viewing history are processed locally on the relevant parent and child devices. Mistirix does not keep a central online backup.

The child device keeps track of viewing time within TUSAVO. It can share today's viewing time, battery percentage, and TUSAVO update availability directly with a paired parent. This is not a measurement of what your child does outside of TUSAVO. For security of pairing and recovery, our online service processes technical account, family and device data separately.

Pair and restore — local family data, online security check. The connected devices exchange family data directly via Bluetooth, with mutual security control. Restore copies of the family data are encrypted and stored locally in the app storage on affected family devices; Mistirix does not keep an online copy of that recovery content. For initial or renewed pairing and recovery authority verification, our online service does use account and family bindings, technical device identifications, public security certificates, and temporary pairing or recovery data. Deletion on one device does not automatically delete the local copies on other devices.

Videos and own resources — local library, direct contact with the provider. Library data such as title, source, video reference, thumbnail and assignment are processed and stored locally in the app on the family devices. Mistirix does not keep an online library of these. When searching, retrieving thumbnails or playing, your device connects directly to the chosen provider. It receives request data, including your IP address and information about the requested video. The server address and credentials for a connected NAS, Jellyfin, or Plex server are kept locally in the app and used to connect to that resource; they are not uploaded to Mistirix as source records. TUSAVO accesses these own sources within your local network. To sign in with Plex, your device also contacts the online Plex service.

Premium — online purchase and access registration. Google Play processes purchases. RevenueCat and our backend process customer identification, purchase and subscription status, product, transaction references, period limits and changes such as renewal, cancellation or refund. This way your family will have the appropriate access. The RevenueCat customer identification is a code assigned by our server, not a direct email address. This code remains personal data if it can be linked to your account.

Feedback and support — online when you send something. When the feedback feature is available and you submit a report, we receive and store your text, category, any steps, attachments and included technical diagnostics on our server, together with account and report details. Data previously stored only locally on your device may therefore become part of your online submission. Free text, attachments and diagnostics may contain personal data. Do not include passwords or unnecessary information about your children. If ‘share with partner’ is enabled, the other linked parent can read the report text, status and conversation. Attachments and technical diagnostics are not shared through this partner feature.

Feedback abuse. To address feedback abuse, we may mark a submission as inappropriate and block new feedback temporarily or until the block is lifted manually. We separately store your account link, a reference to the reason, the start date, any end date and whether you have requested a review. We do not copy the entire submission for this purpose. This record remains while the block is active and is cleaned up after it expires or is lifted. Deleting your feedback does not lift the block. Account deletion also removes the associated block record. The flag on a submission follows that submission’s retention period.

Notifications and technical operation — local diagnostics and separate online services. When feedback notifications are enabled, we use Firebase Cloud Messaging and a device-specific notification token. You can disable these notifications. For the functioning and security of the services, technical data is also processed, such as error codes and network requests. Local diagnosis is processed and stored on the device; a completely local diagnostic log is not automatically sent to Mistirix. The diagnosis sent with feedback will be placed on our server. The notification token is processed online for feedback notifications by our backend and Firebase.

With whom is data exchanged?

Local family data is exchanged directly between paired parent and child devices, appropriate for their family role. This synchronization does not run via our server. The individual online account, link, Premium and feedback data are processed by our services; that run at Cloudflare. Google provides the login, Google Play, and any Firebase notifications; RevenueCat supports subscription management. When using YouTube, Google/YouTube services are accessed. For private resources, the chosen server receives the requests; Plex services can also be used for Plex.

Videos from YouTube

When searching for YouTube videos, loading images and playing, your device connects directly to Google/YouTube. Google receives request data, such as your IP address and information about the requested video. This also happens if Mistirix does not receive your local viewing history.

TUSAVO uses the privacy-enhanced variant for the embedded YouTube player. This does not mean that YouTube does not process data or that advertisements, suggestions or links to YouTube cannot appear. When you go to YouTube or another app or website through the player, the terms and privacy information of that service apply.

Also read the privacy information from Google and the YouTube terms and conditions.

More information from other providers: Cloudflare, RevenueCat and Plex.

Why are we allowed to use this data?

We distinguish the following legal grounds:

Performance of a contract: for parent information needed for their account, family management, requested support, and Premium.

Legitimate interest: for necessary security, preventing misuse and handling voluntary improvement feedback. We weigh our interests against your privacy, limit the data and retention period and you can object.

A legal obligation: exclusively for data that we must process according to a specific applicable law, for example to process a privacy request or to carry out mandatory administration. This is not a general reason to keep all data.

Where we use consent, you must be able to easily withdraw it without making the previous lawful use unlawful.

Child rights and consent

Children have their own privacy rights. What consent is required and who can give it depends on the processing and the rules that apply. A parental registration or linking a device does not automatically give permission for all data processing by TUSAVO or external video services. If we use consent, you can withdraw it. When dealing with children's data, we take into account the requirements for parental involvement and the rights of the child themselves.

How long do we keep data?

Online account and family connections. In this version, we do not automatically delete an account because it has not been used for a long time. You can request removal yourself. Account and family records remain available for access and recovery until deleted through the deletion route. This does not mean that all other data will be retained indefinitely: the individual periods below apply.

Local family data, viewing history and recovery copies. These data remain in app storage on family devices and are not stored on our server as a backup of your library, viewing history or recovery data. Closing or updating the app does not erase them. Completely uninstalling the app, including its data, removes the local copy on that device. Once all family installations and their app data have been removed, these local recovery copies are also gone. TUSAVO cannot restore them from our server. Removing one app does not remove copies on other family devices that still have it installed. Feedback or diagnostics you choose to submit are covered by the separate feedback rules.

Feedback and diagnosis. Feedback on our server has a standard retention period of three calendar months from receipt. For selected follow-up, that period may be extended up to a maximum of twelve months from original receipt; the notification then states the reason and end date. Limited records of a deleted notice may continue for up to twelve months from original receipt. This says nothing about an existing local copy or the individual backup periods of suppliers.

Premium registration. We process the necessary customer association, transaction references and subscription status to deliver Premium. In case of account or family deletion, the minimum payment registration may be retained until the end of the remaining Premium period. The backend then deletes its own registration and requests deletion of the customer profile from RevenueCat. A failed processing is retried. Deletion of the RevenueCat profile is not the same as deletion of the purchase records that Google Play keeps for its own services or legal obligations.

Deletion requests and confirmation. For a deletion request via the website, we process your verified Google identity, email address, the chosen deletion and the relevant family registration. We use this to check your authority, execute the request and send the confirmation. For this confirmation, Cloudflare processes your email address and the confirmation text.

Once completed, we will remove the identity and family link from the website request. Once the email service has accepted the confirmation, we will delete the completed request and the email address from our active request registration. As long as the shipment has not yet been confirmed, this information will remain available for processing for a maximum of thirty days after completion. Acceptance by the mail service is not the same as receipt in your mailbox. A separate app completion receipt will not contain an account or family link and will be retained for a maximum of 30 days, or less when the app confirms receipt. A request is not yet a confirmed deletion.

Temporary link data. A temporary pairing record expires after three minutes. Expiry is not the same as immediate erasure: physical deletion takes place through cleanup of expired records.

Technical server logs. Technical logs from our TUSAVO backend are kept at Cloudflare for a maximum of seven days. Extensive request logging and traces are disabled. This term applies to the technical backend logs, not to all individual security, management or purchasing data of each provider.

Database restore points. Cloudflare stores restore points from our server database over a thirty day window. Deleted server data may therefore temporarily still appear in older restore points. Deletion from the active database does not immediately erase all restore points. This concerns server registrations, not an online backup of the local library, viewing history, or family recovery copies.

Feedback files. Feedback and attachments in our Cloudflare storage are deleted by the TUSAVO delete functions and retention tasks. There is no storage lock set to prevent this deletion. The separate seven-day storage rule applies only to unfinished uploads, not to the retention period of received feedback. The previously mentioned feedback periods continue to apply.

RevenueCat and Google. When deleting the payment registration, we ask RevenueCat to delete the customer profile. RevenueCat offers a delete function for this, but the processing agreements consulted do not mention a concrete maximum term for all underlying backup and archive copies. Therefore, we do not promise immediate removal of every provider copy. Google Play may keep separate purchase records for its own services and legal obligations. RevenueCat delete function, processing agreements

Firebase Notifications. Firebase uses an installation ID to deliver notifications. Deleting a notification token is not the same as requesting deletion of that installation ID. Disabling notifications or deleting a token therefore does not mean that all related data have been erased from Firebase. Deletion at Firebase is not confirmed until Firebase has accepted the request; submitting or retrying a request is not proof of complete deletion.

View, adjust or delete your data

You can manage locally saved settings and child profiles in the app. Mistirix does not have a central copy of your local library, viewing history or family recovery copies and therefore cannot view or retrieve them from our server. For access, improvement, deletion or other privacy questions, you can email support@mistirix.com. Mention that it concerns TUSAVO. If your request concerns an account, please email from the email address you use for that parent account. We cannot determine that you are the account holder from another email address. Until your identity and authority are confirmed, we will not provide account information or perform account changes or deletions. We can also request additional verification for a request from the known email address. If you no longer have access to that email address or account, first try to restore it from the original provider, such as Google. Do not send proof of identity yourself.

Deleting a notification from My Submissions only deletes the local entry, not the submitted server information. For server deletion, use the separate delete function.

Under applicable privacy legislation you may also have rights to restriction, objection and portability. Where processing is based on consent, you can withdraw it. You can file a complaint with the Dutch Data Protection Authority or your competent supervisory authority.

In App settings, parents can select Delete my account . Only the family manager can use Delete entire family to request deletion for the whole family in one confirmed action. Children cannot perform these actions. Removing a child device does not initiate family deletion. An offline device can only be cleaned up once it reconnects; completely uninstalling the app, including its data, removes the copy on that device.

Simply uninstalling the app or disconnecting a device does not automatically erase your server account, subscription, or copies on other family devices. Therefore, use the delete function first and wait for server processing confirmation. Any Premium registration still retained will be listed separately. Also check a current subscription in Google Play.

A deletion that you confirm in the app is handled directly through the app. You follow the processing there; this route does not send a confirmation email like the website request. If you have already deleted the app, you can reinstall it and use the delete function with the same Google account. You can also use the account deletion page to submit a website request. You confirm your identity with Google. An administrator starts processing and sends a confirmation email once it is complete. For help, email support@mistirix.com; email does not replace Google sign-in for this website request.

Security and children

TUSAVO uses access control, secure online connections and local link security. Certain login, source and recovery data is stored encrypted. This does not mean that every local file is individually encrypted or that every connection to a local media server of your choice is encrypted.

Parents manage the family and choose which videos their children can watch through TUSAVO. Child profiles, settings and viewing history remain local to the family devices. When playing, the device does connect to the selected video service, which can process data itself. Parents therefore also assess whether the service and the selected videos are suitable for their child.

For children

Your parent chooses videos and sets your viewing time, for example. TUSAVO remembers these settings on your devices. Your parent can see how much time you spent watching TUSAVO today. Do you use YouTube to watch a video? Then your device connects to YouTube. YouTube receives information to retrieve and play the video. Ask your parent for help if you want to know something about this.

Changes to this statement

The date at the top indicates when this statement was last updated. On October 26, 2026, the explanation about temporary link data and Firebase removal was clarified. The inclusion of data from your Google login also includes online account and family registration; the use of your email address is not limited to the sign-in.