tiklet

// LEGAL

PRIVACY POLICY

Effective July 6, 2026

1. Who processes the data

TikLet ("we") is a companion app for TikTok Live Studio streamers (widgets, music bot, chat TTS, Kaspi donation alerts). This page describes what data we collect through the tiklet.app site and account dashboard, why, and how you can control it. Questions — support@tiklet.app.

2. What we collect

  • Email — on sign-up, for logging in and sending verification codes.
  • Password — never stored in plain text, only as an irreversible hash (PBKDF2-SHA256, 100,000 iterations, per-user salt). Even we cannot recover the original password from the database.
  • TikTok username — required during the closed beta to check you're on the invited testers list; it's tied to your account (one username per account).
  • Device ID — a hardware fingerprint of the computer where the license is activated. It doesn't identify a person, only a device; it's used to cap the number of active devices per account.
  • IP address and country — captured at the moment of license activation (from Cloudflare headers), for abuse prevention and dispute resolution.
  • Server technical logs — standard Cloudflare request logs (no password or token contents).

3. What we don't collect on the site

  • Payment details — subscription payments run through a third-party payment gateway; your card details never reach us.
  • Stream data — likes, gifts, viewers and chat are processed locally on the streamer's computer by the app; these events are never sent to our server.
  • Cookie tracking — account sign-in uses a Bearer token in the request header, not cookies, and the site has no advertising/analytics trackers.

4. Why we need this data

Solely to make the account work: registration and login, sending email verification codes, issuing and binding a license to a device, preventing duplicate registrations and beta-access abuse, and support when you contact us.

5. Who we share data with

Some operations run through external services (subprocessors), which see data only to the extent needed for their task:

  • Cloudflare — site hosting, the accounts and activations database.
  • Resend — sending email verification codes.

We do not sell or share data with third parties for advertising purposes.

6. How long we keep it

Account data is kept for as long as the account exists. When you delete your account from the dashboard, your email, password and TikTok username are permanently removed from the database; device bindings are deactivated.

7. Your rights

  • View and unlink bound devices — in the account dashboard.
  • Change your password — in the account dashboard.
  • Delete your account and all personal data — in the account dashboard, confirmed with your password.
  • Request a manual data export or deletion — by email at support@tiklet.app.

8. Security

Passwords are hashed (PBKDF2-SHA256), license tokens are signed with Ed25519, sessions use a signed JWT sent only in the Authorization header. The app's local widget server listens exclusively on the streamer's own loopback address.

9. Age

The service is not intended for anyone under 16.

10. Changes to this policy

If this policy changes materially, we'll update the date at the top of the page and, for significant changes, notify you in the app or on the site.