Privacy policy

The cast iPad (TUni TV)

Some of these only apply if your production uses that part of Tuni.

• Apps and screen time. Which app or part of Tuni is open, when, and for how long. Tuni doesn’t record what you watch, listen to or read inside Netflix, Prime Video, the music apps or any other service. Diagnostic logging, below, is the one exception.
• Signing in to those services. You sign in on each service’s own pages, and its own privacy policy covers what you do there. The iPad keeps you signed in from one day to the next. Tuni doesn’t record your sign-in details.
• Your profile. Your name, room number and any dietary needs or allergies, entered by the production.
• Check-ins. Your mood, food and sleep scores, anything you write in the box, and whether you’ve asked to see someone. They go to the production’s welfare team and its most senior Tuni accounts. Producers see whether you’ve checked in today and whether you’ve asked to see someone, not your scores or what you wrote. If welfare talk to you about a check-in, they can note that they did, with a few words that producers can’t read. If the production puts a check-in board on a screen in its office, the board can show scores but never what you wrote, and the production chooses whether it shows names, room numbers only or just totals. Reports to executives use totals with no names.
• Door cards. A green card (“come to me”) or a red card (“do not disturb”), and any note you add to it. Crew see them, security included, on the dashboard, on their phones and on screens in the office. Catering staff don’t.
• Notebook. A private notebook for each cast member. Producers can’t read it. The welfare team and the production’s most senior accounts can, and welfare may act if something written raises a concern.
• Voice memos. Recordings stay on the iPad. The show’s server keeps a list of them: when each was made, how long it is and any name you give it. If the welfare team or the production’s most senior accounts ask to listen to one, a single copy is sent to the server for that listen and deleted from it after 90 seconds. Whoever listens can save a copy to their computer. Every listen and every save is logged.
• Messages. Messages the crew send to your iPad, and your replies. Your replies go to the welfare team and the production’s most senior Tuni accounts.
• Welfare calls. If your production offers them, your iPad can join a private video call with the production’s psychologist or welfare team at a booked time. Calls are never recorded, and the call link stops working when the slot ends.
• The day. Your food and shop orders, schedule and call times, wardrobe looks, and the documents the production sends you, with whether you’ve opened them.
• Timesheets. On productions that use them, usually in the US: your daily hours, and the signature you draw on the iPad when you sign.
• Photos. Your headshot and wardrobe photos, uploaded by the production.
• Your passcode. A passcode you choose protects your notebook and letters. The welfare team can reset it if you forget it.
• The iPad itself. Its serial number and other identifiers, its app version and whether it’s online. If an iPad has a problem, the production can turn on diagnostic logging for it, which sends technical events to the show’s server, such as a page being blocked or failing to load, with its web address. It’s off unless someone turns it on.
• Lost iPads. The production can lock a missing iPad, wipe it, or put it into lost mode, which shows where the iPad is.

Letters from Home

If your production uses Letters from Home, the family and friends a cast member names can write to them through a private web page. The production sends each person their own link.

• Tuni keeps each writer’s name and email address, when they last opened the page, the letters in both directions, and every moderation decision.
• An automated first pass reads each letter. Then, by default, a person on the production team reads it before it’s delivered, in both directions, and can approve it, edit it or hold it back. A letter the first pass rates as very high risk is held back without being delivered. Every decision is logged. Where the first pass runs is set out under Who else handles it.
• The page uses one cookie, to keep each writer signed in for up to 14 days.
• The only emails families get from Tuni are reminders when a letter has been waiting unread. The production can turn them off.

The crew dashboard

• Your account. Your username, display name, email address and role, set up by your production. Your password is stored only as a one-way hash, never as itself.
• Signing in. Each sign-in and each failed attempt, with its time, the internet (IP) address it came from and the browser or app it used, to stop password guessing. Too many failures lock the account or the address for a while.
• What you do. Actions are logged with your name, the time and the IP address, so the production has a record of who did what: who acknowledged a check-in, dealt with a door card or approved a letter. Opening a contestant’s check-ins or replies is logged too, without any of their content.
• One cookie. It keeps you signed in for up to 24 hours and isn’t used for anything else.
• Email. Account invitations, password resets and a notice when your password changes are sent to your email address.

Tuni Crew, the crew app

Tuni Crew does what the dashboard does for your role, on your phone, so everything under The crew dashboard applies to it too. On top of that:

• Signing in. The same crew account as the dashboard: your username or email, and your password. The app only signs in to show addresses ending in tuni.info. Your sign-in is kept in your phone’s Keychain, on that phone only: it isn’t synced to iCloud and can’t be restored to another phone. As on the dashboard, the IP address of each sign-in and each logged action is recorded. It isn’t used to work out where you are.
• Face ID and the camera. Face ID, Touch ID or your passcode unlock the app. Your phone handles that and only tells the app whether it worked. If your phone has no passcode, there’s nothing for the app to lock with: it says so before it opens, and if you carry on, anyone who picks up your phone can see what your role sees in the app. Setting a passcode brings the lock back. The camera reads the QR code on your call sheet, and nothing it sees leaves the phone.
• What the phone keeps. Check-ins, replies, letters, notes and call details are shown and then forgotten. They are never saved on the phone, and screens showing what a contestant wrote are kept out of screenshots and screen recordings. The cast list and headshots may be kept on the phone so the app opens quickly. They are deleted when you sign out, and the next time the app connects after your access is removed or the season is reset.
• Your phones. For My phones, your show’s server keeps each signed-in phone’s name as iOS reports it, its type and app version, and when it signed in and was last used.
• Notifications. If you allow them, the server also keeps your phone’s push token. Apple delivers the notifications. What passes through Apple says only the kind of notification, such as “Door card”, and reference numbers. It carries no names, room numbers or messages. When a notification arrives, your phone asks your show’s server what it’s about and writes that on your lock screen, such as “Room 214 · come to me”. Cast names and anything a contestant wrote only appear inside the app. Counts on the lock screen and in widgets are numbers and times only, such as “2 come to me”.
• No analytics, advertising or tracking. The app contains no third-party code that collects data, and its Diagnostics screen stays on the phone. Apple may send us crash reports if you’ve chosen to share them with app developers in your phone’s settings.
• Signing out. You can see and sign out every phone on your account from My phones, in the app or on the dashboard. Your production can do the same. A phone that isn’t used for 30 days is signed out. Changing your role, resetting your password or removing your access signs your phones out straight away and deletes their push tokens.
• Deleting your account. You can delete your own account on a show from the app, in Settings: Delete my account. Your account, every phone signed in as you, your alert settings and your name on any on-call rota go straight away, and it can’t be undone. The show’s record of who did what keeps its entries about you, as it does for everyone who worked on the show, for as long as set out under How long it’s kept. You can also ask your production, or email [email protected].

Who else handles it

Tuni runs on a few outside services. Where they are depends on where the production is.

The first pass is sent the letter’s text. It can also be given the cast’s names and any words the production has asked it to look out for, so it can spot them in a letter. It isn’t told who wrote the letter. The first pass can be turned off for a production. Simple rules on the show’s own server then do it instead, and a person still reads every letter by default.

• Email. Crew invitations and password emails, welfare call links for the clinician taking a call, and families’ unread-letter reminders go out through Krystal Hosting, an email provider in the UK.
• Apple. Apple, in the US, delivers Tuni Crew’s notifications to crew phones. What reaches Apple is described under Tuni Crew: no names, room numbers or messages.
• Device management. The production’s iPads are managed through a device management service. It holds each iPad’s serial number, name and settings, and the name and room number of the cast member using it, and it carries out the lock, wipe and lost mode commands.
• Video calls. The sound and picture of a welfare call pass through a video-calling service. Calls are never recorded.

To find out which companies provide the device management and video calls, and where they’re based, email us at [email protected].

What Tuni doesn’t do

Tuni doesn’t sell personal information or use it for advertising, and doesn’t track anyone across other companies’ apps or websites. Neither app contains third-party analytics or advertising code.

How long it’s kept

Each production agrees a retention schedule with us, tied to the end of filming rather than a fixed date. Most cast information, such as notebook entries, letters, check-in detail and door cards, is deleted on that schedule. Totals with no names may be kept longer for the production’s reports. A deletion can be undone for 7 days in case of a mistake, then it’s final, and backups roll over within 7 days.

On the same schedule, Tuni Crew phones are signed out when filming ends and crew accounts are deleted 90 days later. The record of who did what is kept for 12 months. Phones are also signed out after 30 days without use, and when the production resets Tuni for a new season. The full detail is in the retention policy each production agrees with us.

Your rights

You can ask what Tuni holds about you, ask for a copy, and ask for it to be corrected or deleted, subject to what the production has to keep by law. Ask the production first, as it decides. Cast can ask the welfare team on set. Anyone can also email us at [email protected], and we’ll pass it to the right production and help it answer.

In the UK you can also complain to the Information Commissioner’s Office, at ico.org.uk.

This website

tuni.info has no analytics, advertising or tracking code. Its pages load their typefaces from Google Fonts, so your browser asks Google’s servers for them. If you email us, we use your address to reply.

Contact

When what Tuni records changes, we update this page and the date at the top. For help with the apps, see Support.