Privacy Policy

• Controller: MATTSINLIFE, SLU (single-member limited company), NRT L-714801-J, Av. Meritxell, 9, piso 3, despacho 5, AD500 Andorra la Vella, Principality of Andorra. Owner of TikRift.
• Privacy contact: privacidad@tikrift.com or a letter to the address above. soporte@tikrift.com is for technical support only.
• Enquiries and requests from any country, including the European Union: write to privacidad@tikrift.com; they are handled directly by MATTSINLIFE, SLU.
• Data protection officer: not appointed, as it is not mandatory for our activity.

TikRift is an independent tool: it is not affiliated with, sponsored or endorsed by TikTok or ByteDance. TikTok is a trademark of its owners.

• Creators: people who use the TikRift app. Adults (18+) only.
• Viewers: people who watch or take part in the LIVE of a creator who uses TikRift. They don't need to sign up.
• Website visitors and people who join the "Notify me" waitlist.

Andorran Qualified Law 29/2021 on personal data protection (LQPD) and, when the service is offered to people located in the European Union, Regulation (EU) 2016/679 (GDPR).

TikRift runs mainly on the creator's computer: LIVE events are received directly from TikTok and stored in a local database. Only some features use our servers: the account, public overlay links, downloads, support and the website.

You can create or open your account with email and password, with Google or with TikTok.

5.1 Continue with TikTok

If you choose "Continue with TikTok", your system browser opens TikTok's official screen (Login Kit, TikTok's official login API). We request only two permissions:

• user.info.basic → your TikTok identifier (open_id), to create and recognise your TikRift account.
• user.info.profile → your username (@), to show which account is linked and to check that the LIVE you connect is your own.

We do not read or store your display name or profile photo, we do not receive your email, password or messages, and we never post on your behalf.

What we store: on our servers, the open_id only as an encrypted hash (HMAC), to recognise you when you return, and your @, to link your LIVE to your account; on your PC, the open_id and the @. We do not keep any TikTok token: as soon as we obtain your identifier and @, we revoke access on TikTok; if revocation fails, the token is discarded anyway and expires on TikTok. So TikRift cannot read your TikTok data again unless you sign in again.

Your TikTok account is your identity in TikRift: we do not automatically link it to accounts created with email or Google. Basis: performance of the contract. Retention: while you keep the account; when you delete it we erase the data received from TikTok.

How to revoke access: in the TikTok app, Profile › Settings and privacy › Security › Apps and services › remove TikRift; or delete your account from My account.

5.2 Continue with Google

Your system browser opens Google's screen. We receive your Google identifier, email and name (scopes openid, email and profile) only to create or open your account. We do not access other data in your Google account, sell it or use it for advertising. TikRift's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5.3 LIVE connection

Login uses TikTok's official API (Login Kit). Receiving LIVE events, however, is not an official TikTok integration and is not endorsed by TikTok: TikRift connects directly from your PC to the public broadcast of your own LIVE. To do so, TikTok receives your @ and your PC's IP, and sends the viewers' public data (name, @, photo, comments, gifts and likes). TikTok may change or block this method at any time.

As a backup, TikRift can receive LIVE events through Euler Stream (eulerstream.com). It is off by default. Only TikRift can switch it on, through its signed remote configuration, and it only works while you are signed in to your TikRift account and after the app restarts. When it is on, Euler Stream receives the @ of the connected account (the temporary access is tied to that @) and your PC's IP address.

Overlays. Overlays load gift images and avatars from TikTok's content delivery network, and some may load a font from Google Fonts; in both cases those services receive the IP and browser (user agent) of the computer or OBS loading the overlay.

Sound search. If you use the sound catalogue search, MyInstants receives your search text and your IP. No viewer data is sent to it.

Connectivity check. To find out whether you are online, the app briefly queries a Cloudflare service (cdn-cgi/trace), which receives the PC's IP address. No data about your account or your viewers is sent.

5.4 Age

Sign-up includes the checkbox "I confirm I am 18 or older". TikRift is not directed at minors.

What data. Display name, @, TikTok identifier, photo (link), comments, likes, follows, shares, joins, gifts (name, quantity and value) and, when available, level, badges and fan club. No passwords, private messages, location or contact details are requested.

What for. So the creator can show alerts, leaderboards, goals, recent events, games and automations on their own LIVE. No advertising, no profiling outside the creator's channel, no commercial disclosure, no automated decisions with legal effects.

Roles and basis. The creator decides to show their audience's public interactions on their stream; this data is processed mainly on their computer and the creator is responsible for that use. TikRift acts as processor when data passes through our servers (overlay links). Basis: the creator's legitimate interest in interacting with their audience (Art. 6(1)(f) GDPR), limited to what is necessary.

Minors. Creators must be 18+, but viewers may include minors and TikRift cannot know. We limit what is stored and handle requests concerning minors with priority.

Where and how long. Events and totals (gifts, comments, points, level, name and avatar) are stored on the creator's PC until the creator deletes them, forgets the viewer, or deletes the app data or uninstalls the app. Data passing through overlay links is not stored on our servers; only technical logs remain, for up to 30 days.

Your rights as a viewer. Access, rectification, erasure and objection. The app includes a "Forget viewer" feature, used by the creator (never during a LIVE), which erases your data from their PC and from our servers; you can also write to privacidad@tikrift.com stating your @. To identify you we will ask for your @ and a proportionate check, never your password.

What it does. It is an informational site. Its only form is the "Notify me" waitlist. It does not load ads or third-party fonts and does not track you unless you accept the optional statistics.

Cookieless visit statistics. We measure visits in aggregate with Cloudflare Web Analytics (page views, referring site, country, device type and performance). Nothing is stored on or read from your device and visitors are not identified. Basis: legitimate interest in measuring and improving the site (Art. 6(1)(f) GDPR); you can object by writing to privacidad@tikrift.com.

Optional statistics with PostHog (only if you accept). If you click "Accept" in the cookie notice, the site loads PostHog (PostHog, Inc.), with the data hosted in PostHog Cloud EU (Frankfurt, Germany), to learn which pages are visited, which site you came from (including whether you came from an AI assistant such as ChatGPT, Perplexity, Gemini, Copilot, Claude or Grok), the page language and clicks on download links. It uses a random identifier stored in a cookie. There is no advertising, session recording or automatic click capture, and we do not store your IP address. If you reject, do not answer or your browser sends the "Do Not Track" or "Global Privacy Control" signal, nothing is loaded. Basis: your consent (Art. 6(1)(a) GDPR and LQPD). You can withdraw it at any time from "Cookie preferences" in the footer of every page, without affecting the lawfulness of earlier processing.

Anti-bot protection. Forms use Cloudflare Turnstile to check that you are not a bot; it is not used for advertising or tracking.

Hosting technical logs. To deliver pages and protect the site, Cloudflare technically processes the IP, date and time, requested URL, browser (user agent) and similar data of each request. We do not use them to identify you or to build profiles. Basis: legitimate interest in providing and protecting the site (Art. 6(1)(f) GDPR).

Website:

• tr_lang (first-party, technical): remembers the language you choose in the selector. Only stored if you choose a language. Lasts 1 year.
• __cf_bm and cf_clearance (Cloudflare, security): only if the protection system triggers a security check; details in the cookie policy.
• tr_consent (first-party, technical): remembers whether you accepted or rejected the optional statistics, so we do not ask again. Lasts 6 months.
• ph_phc_…_posthog (PostHog, analytics): only if you accept the optional statistics; stores a random identifier and the measurement session. Lasts 1 year. It also uses the browser's session storage (ph_phc_… keys), which is cleared when you close the tab.

All are strictly necessary, so they require no consent, except the PostHog one, which is only stored if you accept it in the cookie notice. You can change your choice at any time from "Cookie preferences" in the footer of every page; if you withdraw consent, we stop loading PostHog and delete its cookies from your browser.

App: only strictly necessary first-party cookies: local panel session (7 days; the TikRift account session lasts 30 days and is renewed with use), sign-in flow in progress (10 minutes) and sign-out reminder (7 days). Local storage also keeps preferences such as language, theme and sound. They are not used for advertising or tracking.

The app does not send usage statistics. Error reports and the first-launch ping (result, app version, operating system and language) are optional and off by default; they are only sent to our servers if you turn them on. Basis: your consent; you can withdraw it in the app settings. Error reports are kept for up to 30 days.

What data. When you submit the form, your email is sent to Brevo to send you the confirmation email and, if you confirm, to keep you on the list. On our servers we do not store your email in clear: we store an irreversible hash of your email and another of your IP, the browser (user agent), the language, whether you ticked the optional news box, the date, the version of the text you accepted and the result of the anti-bot check. This serves as proof of your consent and to limit abuse.

Where you came from. Along with your sign-up we also store how you reached the site: the domain of the page that linked to us (not the full address), the TikRift page where you signed up, the campaign parameters in the URL (utm_source, utm_medium, utm_campaign) and the approximate country our provider Cloudflare derives from your connection. We do not store your IP in clear text. We use this only to learn which channels work (legitimate interest), and it is deleted together with your record.

What for. To email you when TikRift is available for Windows and, only if you ticked the box, to send you TikRift news, guides and offers. Adults (18+) only.

Legal basis. Your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time, without affecting earlier emails.

Double opt-in. We send you an email to confirm the address is yours. Until you click the link we do not add you to any list. If you don't confirm, a daily automatic clean-up deletes the record after 30 days.

How long. If you confirm, we keep your email until you unsubscribe. Every email includes an unsubscribe link; you can also ask at privacidad@tikrift.com. After you unsubscribe we stop emailing you and keep the pseudonymised proof of consent for as long as it may be needed to handle claims.

News (marketing). Only if you ticked the box. You can unsubscribe with the link in each email or by writing to privacidad@tikrift.com with the subject "Unsubscribe from news"; we apply it without delay and within one month at most.

Verification emails, account notices and support replies are sent through Brevo. Messages you send to support are kept on our servers for up to 90 days; if you write anonymously, we do not store your email. We use your message only to reply and handle your request. Basis: legitimate interest in handling your enquiry (Art. 6(1)(f) GDPR) and, for rights requests, legal obligation (Art. 6(1)(c)).

We do not sell personal data. These are the third parties involved:

Services configured by the creator (webhooks, sound banks, etc.) are the creator's responsibility. Andorra benefits from a European Commission adequacy decision (Decision 2010/625/EU). For transfers outside the EEA or Andorra we use the DPF or standard contractual clauses when we are the ones sending the data; you can ask for more information at privacidad@tikrift.com. We will disclose data when required by law or by an authority.

Periods are maximums ("up to"):

• Account: until you delete it. Unverified accounts: 7 days.
• Sessions: TikRift account 30 days, renewed with use; local panel 7 days; ended sessions, 30 days.
• One-time codes: 10 minutes. Anti-abuse counters: 1 hour.
• TikTok data (encrypted open_id and @): life of the account. TikTok tokens: not kept.
• Security log: 730 days. Proof of acceptance of the terms: 3 years.
• Server technical logs and error reports: 30 days.
• Server recovery backups: 30 days at most. The app makes local backups on your PC before each database update, which you can delete.
• Support messages: 90 days.
• "Notify me": unconfirmed, deleted automatically after 30 days; confirmed, until you unsubscribe; pseudonymised proof of consent, for as long as it may be needed to handle claims.
• Optional statistics (PostHog): cookie, 1 year; events, up to 12 months. Your cookie choice (tr_consent): 6 months.
• Viewer data: on the creator's PC, until they delete it.

Passwords with strong key derivation, no TikTok tokens kept, expiring sessions, attempt limits, public links with random identifiers, a local panel reachable only from the PC itself, and logs without secrets. In the event of a breach we will notify it as required by applicable law.

Access, rectification, erasure, objection, restriction, portability and withdrawal of consent at any time (without affecting prior processing). From My account you can see your sign-in methods, end sessions and delete the account; deleting it erases the associated data on our servers and invalidates your overlay links. For anything else, write to privacidad@tikrift.com, ideally from your account email. We will reply within one month, extendable by two more months in complex cases (we will let you know). You can complain to the Andorran Data Protection Agency (APDA, www.apda.ad) or, if you live in the EU, to your country's supervisory authority (for example, the AEPD in Spain).

If we change this policy materially, we will notify you in advance in the app or by email and, where needed, ask for your acceptance again. Each change updates the date and version above.