Privacy

Who runs Tilo

Tilo is operated by Soulstack. Soulstack is the data controller for personal data processed through Tilo. Address for data-protection queries and legal correspondence: Soulstack, Office One, 1 Coldbath Square, Farringdon, London, EC1R 5HL, England.

What Tilo stores

Your named walls, links, tile audio preferences and settings are kept in your own browser, in local storage. A link reaches a Tilo server only when you open it in a remote browser (see Remote browsers). If you use the hosted version, your account email address is held by Amazon Cognito, the sign-in service, so that you can sign in.

Your source library

Favourites stay in this browser. Recent links are off until you enable them in the library. Disable history to remove non-favourite recent links, or clear the library to remove both. Queries, fragments and detected credentials are excluded from the library. Paths can still contain private data; check links before saving favourites. Deleted walls retain a local undo record. Clear this site's browser data to remove all walls, undo records, settings and library data. Caption files you choose stay on this device for the current viewing session and are not included in wall links or backups. The practice demo stores nothing. Original migration records remain available for recovery until you remove obsolete records in Backup and recovery, or clear browser site data. Known pending remote-stop identifiers and deadlines stay in session storage until the server confirms release; they contain no tickets or passwords.

Playback positions

For on-demand direct videos and HLS, this browser can remember where you stopped and offer Resume or Start again. This is on by default and can be switched off or cleared in Settings, under Playback. Up to 100 positions are kept for 30 days, using an opaque source identifier, position, duration and update time. Source URLs and titles are not stored in these records. Links with queries, fragments or credentials and live streams are excluded. Positions are not sent to Tilo, shared with walls or included in backups. Clearing also stops the currently open videos from saving positions until reopened.

What Tilo does not do

Tilo does not record streams, has no analytics or tracking scripts of its own and does not show advertising. It does not build a profile of what you watch, and it does not sell or share anything about you.

Remote browsers

Remote browsers stop at the session deadline, normally after one hour. In hosted mode, session records include the page link, account identifier and timing needed to run the browser. Released records are scheduled to expire after seven days; expiry is not immediate deletion. Operational logs and cloud task records may also retain session details. Remote links with detected passwords or keys are refused. Secrets hidden in a link path cannot always be detected.

Direct streams and embeds

Direct video, HLS streams and the YouTube, Twitch and Vimeo players load from the provider, not from Tilo. When you add a YouTube, Twitch or Vimeo tile, Tilo also loads that provider's player script into the Tilo page, so that Tilo can control volume and mute. The script runs in the page and can send requests to the provider. Their own privacy policies apply to what they collect.

Local mode

In local mode, session records stay in memory until Tilo stops. Your browser keeps your wall and settings. Requests go to the sites you add; no cloud service runs your remote browsers. Those sites can receive your IP address and apply their own privacy policies.

Contact

Questions about privacy, or requests to access, correct or delete your personal data, can be sent through the Soulstack site, or by post to Soulstack, Office One, 1 Coldbath Square, Farringdon, London, EC1R 5HL, England. You can also complain to the Information Commissioner's Office (ico.org.uk).