Tvoli Privacy Policy
Effective date: 17 October 2026
Tvoli is a TV remote app for iPhone and iPad. It sends commands from your device straight to TVs on your own Wi-Fi network. The Tvoli app does not collect your personal data, and we never sell or share it. We receive personal data only if you contact us (section 7). Tvoli has no accounts, no analytics, no advertising and no tracking, and we run no server that receives information about you or about how you use the app.
This policy covers the Tvoli app, its widgets, Control Center controls, Live Activity and Siri/Shortcuts actions (together, "Tvoli"). It also serves as the information notice required by Article 13 of the EU and UK General Data Protection Regulation (GDPR), Article 10 of Türkiye's Personal Data Protection Law No. 6698 (KVKK), and US state privacy laws, including the California Consumer Privacy Act as amended (CCPA).
Contents
- Who we are
- Data the app collects
- What Tvoli stores on your device
- What Tvoli sends to your TV
- Purchases
- Apple features: widgets, Live Activity, Siri and Shortcuts
- Contacting us
- Legal bases (GDPR and KVKK)
- Sharing and transfers abroad
- Retention
- Security
- Your rights
- Notice for US residents
- Children
- Changes to this policy
- Contact
1. Who we are
The data controller (in Turkish law, "veri sorumlusu") is the developer of Tvoli, an individual developer based in Türkiye, shown as the seller on the App Store ("we", "us").
You can reach us at support@melyro.app.
Tvoli is an independent app. We are not affiliated with, endorsed by or sponsored by Samsung, LG, Google, Roku, Vizio, Philips, Sony or Apple. Android TV, Google TV, Roku, SmartCast, webOS, Tizen, BRAVIA, Siri, Dynamic Island, Wi-Fi and other product names are trademarks of their owners. Tvoli uses them only to describe compatibility.
2. Data the app collects
None. Tvoli sends nothing about you to us or to any third party, other than the commands and pairing data it sends to the TVs you choose on your local network (section 4). The data Tvoli needs to work stays on your iPhone or iPad and on your local network, under your control. We have no access to it.
Our App Store privacy label says "Data Not Collected" and "No tracking". Tvoli includes no third-party code: no analytics, crash-reporting, advertising or attribution SDKs. It does not use the advertising identifier (IDFA) and does not ask for App Tracking Transparency permission.
Tvoli asks for one permission: Local Network access, so it can find and control TVs on your Wi-Fi. It does not use your camera, microphone, location, contacts, photos, Bluetooth or notifications.
3. What Tvoli stores on your device
To remember your TVs, Tvoli keeps this data on your device:
- Your TVs: name, brand and platform, local IP address, model and, where the TV reports it, the TV's network (MAC) address. Tvoli uses the MAC address to try to wake the TV (Wake-on-LAN), which may not work on every TV or network.
- Your selected TV and the scenes you create (name, icon, target TV and steps).
- Pairing credentials that some TVs issue or require: Samsung and Vizio tokens, the LG client key, Philips login credentials, the Sony pre-shared key you enter, a client certificate with its private key that Tvoli generates on your device to pair with Android TV and Google TV, and a flag that records whether an Android TV is paired.
- A random Vizio client ID that Tvoli creates once per installation and sends to Vizio TVs.
Where the data lives:
- Tvoli stores the TV list, scenes and pairing credentials in the iOS Keychain with the "this device only" setting. iOS does not sync these items through iCloud Keychain or move them to another device. They can appear in an encrypted backup of the same device but can only be restored to that device.
- Tvoli stores the Vizio client ID in the app's standard settings storage, outside the Keychain. If you installed an early TestFlight test build, your TV list from that build may also remain there. This storage is part of your normal iCloud or computer backups. Apple or you hold those backups. We have no access to them.
How to delete it. Removing a TV in Tvoli takes it off your list. In this version it does not delete that TV's pairing credentials or any scenes that point to it. iOS also keeps Keychain items after you delete an app, so your TVs and pairings return if you reinstall Tvoli on the same device. To remove all of it, erase the device in Settings > General > Transfer or Reset iPhone (or iPad) > Erase All Content and Settings. You can also revoke Tvoli's access on the TV itself, in the TV's connected-devices or mobile-app settings.
Logs. Tvoli writes short technical messages (TV brand, button name, error text) to the device's system log for troubleshooting. iOS hides the TV's address in these logs by default. The log stays on your device. We do not receive it.
4. What Tvoli sends to your TV
Tvoli talks to your TVs directly over your local network. This traffic does not pass through us or any server we run. To find TVs, Tvoli uses Bonjour and checks devices on your local network segment for the ports that TV control services use. It reads each TV's name, model and, where the TV reports it (for example Samsung, Roku and Vizio), its network (MAC) address. Discovery contacts devices on your local network segment for a few seconds. Use Tvoli only on networks you own or are allowed to use.
To control a TV, Tvoli sends:
- the button commands you press;
- text you type on the keyboard screen, which goes only to the selected TV and is not stored;
- the app name "Tvoli" and the technical identifiers that the TV's pairing process requires.
Some TVs list Tvoli under a generic or compatible-app name. For example, Philips TVs may show it as an Android device. This is the identifier those TVs accept for pairing. It does not mean Tvoli is made or approved by the TV maker.
Wake-on-LAN sends your TV's MAC address as a broadcast on your local network, so other devices on that network can see it. iOS may block this broadcast, so Wake-on-LAN may not work.
Your TV is made and run by its manufacturer. What the TV does with the commands and data it receives, including anything it sends to its maker, follows the manufacturer's own privacy policy, not this one.
5. Purchases
Apple sells Tvoli subscriptions and the lifetime purchase through the App Store and processes all payments. We receive no payment details, name or e-mail address from Apple. Tvoli checks your purchase status on your device through Apple's StoreKit each time it needs to. Apple's privacy policy applies to your purchase: https://www.apple.com/legal/privacy/.
Apple gives developers sales reports and, if you allow it in your device settings, aggregated app analytics and crash reports. These reports do not identify you to us.
6. Apple features: widgets, Live Activity, Siri and Shortcuts
Tvoli's widgets, Control Center controls and Live Activity run on your device. The Live Activity shows the name of your selected TV on the Lock Screen and in the Dynamic Island, so anyone who can see your screen can see it. Tvoli does not use push notifications to update it.
If you use Siri, Apple processes your voice request under Apple's privacy policy. Tvoli receives only the resulting action, such as "volume up", and runs it on your device.
7. Contacting us
Contacting us is optional. We need your contact details only to reply.
If you write to us at support@melyro.app, we receive the details you send, such as your e-mail address or username, your message and anything you attach. We collect this data electronically, when you write to us by e-mail or through our support channel. We use it only to answer you and to fix problems you report. If you use a public channel, such as an issue on a public code-hosting site, other people can read what you post, and that platform's privacy policy applies.
Please do not send pairing codes, keys or other sensitive information.
8. Legal bases (GDPR and KVKK)
We process personal data only in the cases below.
| Purpose | Data | GDPR legal basis | KVKK legal ground |
|---|---|---|---|
| Answering your message and fixing reported problems | Contact details, message, attachments | Legitimate interests (Art. 6(1)(f)): replying to you and keeping the app working. Where you ask about your purchase or use of the app: contract (Art. 6(1)(b)) | Art. 5(2)(f) legitimate interest; Art. 5(2)(c) where needed for our contract with you |
| Establishing or defending legal claims | Messages relevant to the matter | Legitimate interests (Art. 6(1)(f)) | Art. 5(2)(e) establishing, exercising or defending a right |
The data Tvoli keeps on your device (section 3) stays there and never reaches us. Tvoli uses it only to provide the remote-control service you asked for (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
We do not make decisions about you by automated means, and we do not profile you.
9. Sharing and transfers abroad
We do not sell or rent personal data or disclose it for advertising. Only the service provider that hosts our e-mail or support channel stores your messages, and only so we can answer you. We may also disclose a message you sent us if the law requires it, for example under a court order.
When you write to us, you send your message to a developer in Türkiye, outside the EEA and UK. The provider that carries and stores it may keep it on servers in other countries, for example the United States. That provider's own transfer safeguards apply to the data it holds. We have not signed separate standard contractual clauses with it.
Under KVKK, this transfer abroad happens only occasionally, when you choose to write to us. We rely on the exceptions for occasional transfers in Article 9(6) of KVKK: the transfer is needed to handle the request you started with us, or you give your explicit consent by sending your message through that channel. We do not use this route for regular or routine transfers. You can ask us for details at support@melyro.app.
Data that Tvoli keeps on your device is not transferred anywhere by us.
10. Retention
We delete support messages 12 months after the conversation ends, unless we need them for a legal claim. In that case we keep only the relevant messages until the claim is settled. Data on your device stays there until you delete it (section 3).
11. Security
Tvoli keeps pairing credentials in the iOS Keychain, readable only after you first unlock the device after a restart and never synced to other devices. Tvoli uses encrypted connections where the TV supports them. It accepts the TV's self-signed certificate only for addresses on your local network.
Some TVs accept only unencrypted connections on the local network, including Roku, Sony, older Philips, older Samsung (port 8001) and some LG models. On those connections, others on your Wi-Fi network could see the commands, the text you type and, for Sony and Samsung, the key or token used to pair. Use Tvoli only on a network you trust.
12. Your rights
EEA and UK. You have the right to access, correct, delete, restrict and port your personal data, and to object to processing based on legitimate interests. You can also lodge a complaint with the data protection authority where you live or work. EEA authorities: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. UK: the Information Commissioner's Office, https://ico.org.uk. Because we process personal data only occasionally, when you write to us, we have not appointed an EU or UK representative (GDPR Art. 27(2)).
Türkiye (KVKK Article 11). You have the right to learn whether we process your personal data; to request information about it; to learn the purpose of processing and whether we use it for that purpose; to know the third parties in Türkiye or abroad who receive it; to ask us to correct it if it is incomplete or wrong; to ask us to delete or destroy it under the conditions of Article 7; to ask us to tell recipients about a correction or deletion; to object to a result against you that comes only from automated analysis; and to claim compensation if unlawful processing causes you loss.
To apply under KVKK, write to support@melyro.app from an e-mail address you have already used with us, or use another method allowed by the Communiqué on the Procedures and Principles of Application to the Data Controller. Include your name and surname, your Turkish ID number (or, if you are not a Turkish citizen, your nationality and passport or ID number), your address or e-mail address for our reply, and what you are asking for. We answer free of charge within 30 days (KVKK Article 13). If we reject your request, our answer is not enough, or we do not answer in time, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu), https://www.kvkk.gov.tr, within 30 days of our answer, or within 60 days of your request if we do not answer.
How to use your rights. Write to support@melyro.app. We may ask you for details to confirm the request came from you. Because the app sends us no data, a request will usually concern only messages you sent us. For data on your device, use the steps in section 3.
13. Notice for US residents
This section applies to residents of California and other US states with consumer privacy laws.
- Personal information collected in the last 12 months: only identifiers and message content you give us when you contact us (section 7). Source: you. Purpose: answering you and fixing problems.
- Disclosed for a business purpose: identifiers and message content, to our e-mail or support service provider, only to store and deliver messages.
- Sale and sharing: we do not sell personal information and do not "share" it for cross-context behavioral advertising. We do not use it for targeted advertising or profiling.
- Sensitive personal information: we do not collect it.
- Your rights: depending on your state, you can ask to know, access, correct or delete your personal information, and to opt out of sale, sharing, targeted advertising and profiling. Since we do none of these, there is nothing to opt out of. You can use an authorized agent; we may ask the agent for proof of your permission. If we refuse a request, you can appeal by replying to our answer at support@melyro.app. We will not discriminate against you for using these rights.
14. Children
Tvoli is made for a general audience. The app collects no personal data from anyone, including children under 13 (or the age of digital consent in your country). If you believe a child has sent us personal data, for example in a message, contact us and we will delete it.
15. Changes to this policy
If we change this policy, we will post the new version on this page and update the effective date. If a change affects how we handle your data in a significant way, we will also note it in the App Store release notes for the next version of Tvoli.
We may publish this policy in other languages, including Turkish. If a translation differs from this English version, the English version prevails, unless the law of your country requires the version in your language.
16. Contact
The developer of Tvoli, an individual developer based in Türkiye, shown as the seller on the App Store. Contact: support@melyro.app
Based on templates by General Legal (general.legal), CC0.