Privacy Policy

1. Account data

When you sign in we process your email address, display name, workspace and membership details, and authentication identifiers (including the Google or GitHub account identifier, and the link to that account's profile photo, which we show in your account menu, if you use that route) to run your account, meter usage and secure access. API keys are stored hashed; only a prefix is ever displayed.

Basis: performing our contract with you. Kept for the life of the account and up to 30 days after it is closed.

When an account is created we also note, once, how you found us: the page your visit started on, the domain of the site that linked to it (not the full address), and any campaign tags in that link (utm_source, utm_medium, utm_campaign). We do not record your IP address or browser for this. In the EU, EEA and UK this happens only with your consent, given through the cookie choice we show; anywhere, you can turn it off in section 7. Basis: our legitimate interest in understanding which pages and channels bring new users (in the EU, EEA and UK: your consent). It is kept with the account and deleted with it.

2. Billing data

Payments are handled by our payment providers; card details never reach us. We keep payment and credit records (workspace, plan, amounts, provider event identifiers, credit movements) to run billing and meet accounting and tax duties, for up to 7 years where the law requires it.

Basis: contract and legal obligation.

3. Messages you send us

Feedback, support and data-removal requests (including an optional reply email) and conversations with the support bot or chat widget are kept as support records for up to 24 months, then deleted. Telegram: if you connect alerts or message the support bot, we store your Telegram chat identifier and message references until you unlink with /stop or ask us to delete them.

Basis: our legitimate interest in answering you, or your consent where you connect a channel.

4. Observed public data

Toktik processes persisted observations of public TikTok LIVE activity within its stated Coverage Set: public creator and gifter handles, display names and avatars, rankings and gift totals, public agency catalog fields, and the times they were observed. Public availability does not remove privacy duties: this may be personal data under laws such as the GDPR, the CCPA or Singapore's Personal Data Protection Act.

Why: to provide public rankings and analytics. Basis: our legitimate interest in providing public-interest analytics about public activity, balanced against the rights of the people involved, which is why removal is easy and honoured (section 6). Every result carries a coverage label, so a missing value reflects the bounds of the Coverage Set rather than a confirmed absence.

5. How long we keep it

Retained LIVE history is bounded by a hard cap, including on enterprise plans: ranking history is kept for at most 12 months, and cached profile data is refreshed or expires on a rolling basis. Nothing is kept indefinitely. Service logs are kept for a short rolling period and backups are rotated; a deletion reaches backups on their next rotation.

6. Removal and suppression

If you appear on Toktik as a creator or as a gifter you can ask us to remove or hide your handle using the data removal page, or by emailing privacy@toktikhq.com. We acknowledge a request within 3 business days and action it within 30 days. A recorded request removes you from retained history and from public pages, and prevents re-collection; static pages are re-rendered within hours. We may ask you to show that the account is yours.

7. Cookies, storage and analytics

We use only first-party cookies: the strictly necessary ones (the session cookie set when you sign in, and a short-lived state cookie during sign-in), plus a cookie that lasts at most 30 minutes and carries the starting page, referring domain and campaign tags described in section 1 to sign-in. Visitors in the EU, EEA and UK are asked first, and nothing about their visit is stored unless they accept; we only remember the answer itself, so we do not ask again (we read your country from our network provider, Cloudflare, without storing it). Everyone can turn it on or off below. We also use your browser's local storage for preferences such as theme and view settings, and its session storage (cleared when you close the tab) to remember that starting page during a visit. We do not use advertising cookies or third-party trackers. Aggregate product analytics are first-party counters of a small set of named events; they contain no personal identifiers.

Forms use Cloudflare Turnstile to block automated abuse; it may read basic browser signals to do so.

8. Who processes data for us

We use service providers who process data on our behalf: Cloudflare (network, DDoS protection, Turnstile), OVHcloud (server hosting, in France), Backblaze (off-site storage of database backups, in the United States), Brevo (transactional email), Telegram (alert and support messages, only if you use them), Google and GitHub (sign-in, only if you choose them), and our payment providers (a merchant-of-record card provider and a crypto payment provider), which handle payment data under their own terms. We do not sell account data and do not share it for advertising.

9. International transfers

Toktik HQ is in Singapore and our production servers are hosted by a European provider (France). Copies of our database backups are held with a provider in the United States, and our other providers operate worldwide, so data may be processed in several countries. Where the law requires safeguards for such transfers we rely on appropriate mechanisms such as standard contractual clauses offered by our providers.

10. Your rights

Depending on where you live you may have the right to access, correct, delete, restrict or export your data, to object to processing based on our legitimate interest, to withdraw consent, and to complain to your data-protection authority. Write to privacy@toktikhq.com; we reply within 30 days. You can also delete your account data yourself by asking us to close the account.

11. Security

We use encryption in transit, hashed API keys, access controls and tenant isolation, and limit who can see support records. No system is perfectly secure; report a suspected vulnerability to security@toktikhq.com.

12. Children

Toktik is not for children under 18 and we do not knowingly collect their account data. Public TikTok activity by minors is not intentionally targeted, and removal requests are honoured as above.

13. Changes

We may update this policy. Material changes are announced in the product or by email before they take effect, and the date above changes.

14. Contact

Toktik HQ, Singapore. Privacy requests: privacy@toktikhq.com. General: hello@toktikhq.com.