Legal

Privacy Policy

Last updated: 18 October 2026

1. Who is responsible

The controller responsible for this website and the services described here is Tolulope Osho, sole proprietor operating as TOVANOWORLD, Berlin, Germany, email [email protected]. You can also reach us through the contact form. We have not appointed a data protection officer, as the law does not require one for our activities.

2. Visiting this website

This website is a static site hosted on Cloudflare Pages (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). When you open a page, Cloudflare processes technical data needed to deliver it and to protect the service, such as your IP address, the requested address, the time, your browser type and security signals. We do not set cookies, do not use analytics or advertising tools, do not embed third-party fonts, videos or social media plugins, and do not track you across websites. The legal basis is our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR). Cloudflare may process data in the USA; information on Cloudflare's data processing and the transfer safeguards it relies on is in Cloudflare's privacy policy.

3. Inquiries through the contact form

If you send an inquiry we store what you enter (name, email address, and if you give them, company or artist name, the service you are interested in, your deadline, your message and links to your material), the time of sending, a reference number shown to you, and a privacy-preserving hash of the request that helps us block abuse. We do not download material from the links you give until we reply to you and only as far as needed for your project. The data is stored in our Cloudflare account (Cloudflare Workers KV) and is used only to answer you and to handle the matter you raise. The legal basis is your request and steps before a possible contract (Art. 6(1)(b) GDPR) and your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. Inquiries are deleted automatically about 13 months after they are received, or earlier on request, unless the law requires us to keep them longer. The hash (a one-way value derived from your IP address and the date, from which the address cannot be read back) is stored with your inquiry for the same period; the separate daily counter used to limit abuse expires after two days.

4. The studio's own platform connections (overview)

Our studio software runs only on the studio's own computer. It connects only accounts that belong to the studio, each through the platform's official sign-in page (OAuth), where the account owner grants the listed permissions. It never asks for or stores passwords, never signs in on behalf of visitors to this website, and does not use these connections to collect data about other people. Access and refresh tokens and the apps' credentials are kept only on the studio's computer, encrypted for the studio's Windows user account; they are never stored on this website, never shown and never shared. Connecting an account does not publish anything: every upload is authorised by the studio owner for that specific video. On disconnection, or on request, we delete the stored tokens; where the platform offers it, disconnecting also revokes the access at the platform.

4a. TikTok

We use TikTok's Login Kit and Content Posting API to connect the studio's own TikTok account so that videos the studio owner has approved can be uploaded to that account's TikTok inbox as drafts. Permissions: user.info.basic (display name, avatar and open ID), optionally user.info.profile (the account's username, to show which account is connected) and video.upload (uploading drafts). The desktop sign-in uses the OAuth 2.0 authorisation code flow with PKCE and a random state value and returns directly to the studio computer. Drafts are finished and posted by the studio owner in the TikTok app; our software does not post publicly. The connection can be ended in the TikTok app under Settings and privacy, Security and permissions, Apps and services permissions. TikTok processes data under its own terms and privacy policy (EEA).

4b. YouTube (YouTube API Services)

Screenhouse uses the YouTube Data API (YouTube API Services) in two ways: (1) to read public information, for example a public channel's name or whether a public video is offered under a Creative Commons licence; and (2) with Google OAuth, to connect the studio's own YouTube channel (scopes youtube.readonly to read that channel's identity and the status of its uploads, and youtube.upload to upload videos the studio owner has authorised). We do not access anyone else's YouTube account and do not store personal data of YouTube users beyond what public records contain. By using features that rely on YouTube data you are also subject to the YouTube Terms of Service; Google's privacy policy is at policies.google.com/privacy. Access granted to our software can be revoked at any time on Google's security settings page.

4c. Instagram

We use the Instagram API with Instagram Login to connect the studio's own Instagram professional account (permissions instagram_business_basic and instagram_business_content_publish) to publish clips the studio owner has authorised. The sign-in returns through /auth/instagram/callback on this website, which only passes the one-time code and state value to the studio software on the same computer and stores nothing. Instagram fetches a video it publishes from a public address, so an authorised clip is placed at an unlisted, randomly named address under /media/clips/ on this website just before publishing and removed as soon as Instagram has fetched it. The connection can be ended in Instagram under Settings, Apps and websites.

4d. Twitch

We use Twitch's official API with the Device Code Flow to connect the studio's own Twitch account with the read-only permission user:read:follows (the channels that account follows). We read only public metadata of streams, videos and clips (titles, dates, durations, links) to find creators to contact. We do not download Twitch videos; footage is used only when its rights holder provides it for an agreed campaign. The connection can be ended in Twitch under Settings, Connections.

4e. Whop

The studio connects its own Whop business account with an API key to read its own campaign (bounty) listings, financial activity and payouts for the studio's bookkeeping. No data of Whop users other than what Whop shows the studio about its own campaigns is processed.

5. Openly licensed source material

Screenhouse works with videos published under open licences (for example on Wikimedia Commons). For each source we record the public licence information and the author's credit as published there, to give correct attribution and to document our rights.

6. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. To exercise these rights, write to [email protected] or use the contact form (topic "Other"). You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work; the authority competent for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

7. Children

This website and our services are not directed at children under 16.

8. Changes

We will update this policy when our services or legal requirements change. The date at the top shows the latest version.