tiklet

// LEGAL

PRIVACY POLICY

Effective October 26, 2026

1. Who processes the data

TikLet ("we") is a companion app for TikTok Live Studio streamers (widgets, music bot, chat TTS, Kaspi donation alerts). This page describes what data we collect through the tiklet.app site, the account dashboard and the TikLet mobile app for iPhone and Android (listed in the stores as TikLet Camera), why, and how you can control it. Questions — support@tiklet.app.

The owner and operator of the personal data database (as defined by the Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 "On Personal Data and Their Protection") is the sole proprietor Tiklet Media Solutions (IE Tiklet Media Solutions), IIN 950822300076, Republic of Kazakhstan. Processing is based on the consent you give at sign-up (Articles 7 and 8 of that Law).

TikLet is an independent product, not connected with ByteDance Ltd. or its services (TikTok). We never ask for or store your TikTok credentials; the only TikTok-related data we hold is the public username you enter yourself.

2. What we collect

  • Email — on sign-up, for logging in and sending verification codes.
  • Password — never stored in plain text, only as an irreversible hash (PBKDF2-SHA256, 100,000 iterations, per-user salt). Even we cannot recover the original password from the database.
  • TikTok username — required at sign-up: it's your referral code and protects against duplicate accounts; it's tied to your account (one username per account).
  • Device ID — for a computer, a hardware fingerprint; for a phone, a hash of a random identifier the app creates on install. It doesn't identify a person, only a device; it's used to cap the number of active devices per account ("seats" in your subscription). Stored with it: device type and model, operating system and app version.
  • Sign in with Apple — if you use it, Apple gives us a technical identifier of your Apple ID and an email (your real address or Apple's private relay address — your choice).
  • IP address and country — captured at the moment of license activation (from Cloudflare headers), for abuse prevention and dispute resolution.
  • Server technical logs — standard Cloudflare request logs (no password or token contents).

3. What we don't collect on the site

  • Payment details — subscription payments run through a third-party payment gateway; your card details never reach us.
  • Stream data — likes, gifts, viewers and chat are processed locally on the streamer's computer by the app; these events are never sent to our server.
  • Cookie tracking without consent — account sign-in uses a Bearer token in the request header, not cookies. Analytics counters (Yandex Metrica, Google Analytics) load only after you click "Accept" in the cookie banner; if you decline or don't answer, they never load. The site has no advertising trackers.

4. Why we need this data

Solely to make the account work: registration and login, sending email verification codes, issuing and binding a license to a device, preventing duplicate registrations and trial abuse, and support when you contact us.

5. Who we share data with

Some operations run through external services (subprocessors), which see data only to the extent needed for their task:

  • Cloudflare — site and dashboard hosting, attack protection, encrypted backup copies of the database.
  • Hoster.kz — the data centre in Astana (Kazakhstan) that houses our database server.
  • Resend — sending email verification codes.
  • Apple — Sign in with Apple, subscription payments in the App Store, app authenticity check on iPhone (App Attest).
  • Google — subscription payments in Google Play, app authenticity check on Android (Play Integrity).
  • RevenueCat — records of subscriptions bought in the App Store and Google Play: purchase number, plan and subscription end date, linked to your TikLet account number.
  • Yandex Metrica and Google Analytics — anonymised site visit statistics (pages, referrer, device), only after your consent in the cookie banner.

We do not sell or share data with third parties for advertising purposes.

6. Where the data is stored

In line with Article 12 of the Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 "On Personal Data and Their Protection", the users' personal data database (accounts, activations, subscriptions) is stored on a server physically located in the Republic of Kazakhstan (Astana). Backup copies are made daily and stored encrypted in Cloudflare R2 storage; only we have access to them.

Cross-border transfer (Article 16 of the same Law) is limited to what the service needs to run: the site and dashboard are served through the Cloudflare network, verification emails are sent by Resend, payments are handled by the payment gateway, in-app purchases in the mobile app by Apple, Google and RevenueCat — each receives only the data needed for its task (see section 5).

7. How long we keep it

Account data is kept for as long as the account exists. When you delete your account — in the dashboard or in the mobile app ("Account" → "Delete account") — your email, password and TikTok username are permanently removed from the database; device bindings are deactivated. Deleting the account doesn't cancel a subscription bought in the App Store or Google Play — cancel it in the store's settings.

8. Your rights

  • View and unlink bound devices — in the account dashboard.
  • Change your password — in the account dashboard.
  • Delete your account and all personal data — in the account dashboard or in the mobile app, confirmed with your password (or by signing in again with Google or Apple).
  • Withdraw your consent to the collection and processing of personal data (Article 8 of the Law "On Personal Data and Their Protection") — by deleting your account or by email.
  • Request a manual data export or deletion — by email at support@tiklet.app.

9. Security

Passwords are hashed (PBKDF2-SHA256), license tokens are signed with Ed25519, sessions use a signed JWT sent only in the Authorization header. The app's local widget server listens exclusively on the streamer's own loopback address.

10. Camera and microphone

The TikLet mobile app uses your phone's camera and microphone for two things only: sending the picture and sound to your computer for the stream, and showing the picture on screen together with your widgets. Video and sound go straight from the phone to your computer running TikLet — over your Wi‑Fi network or a cable. They are never sent to our servers, and we don't record or store them. Your phone asks you for camera and microphone permission itself; you can turn it off at any time in the phone's settings.

11. Local network and connecting to your computer

So that your computer running TikLet can find the phone, the app announces itself on your Wi‑Fi network while the camera screen is open: the phone's name and a random camera number. The camera number is created on the phone and isn't linked to your account or subscription. The first connection is confirmed with a code shown on the phone; after that the phone and the computer each keep a shared key (on the phone — in the system's secure storage), and later connections need no code. The key is never sent to our server. You can forget a computer in the app and turn off local network access in the phone's settings.

12. App Store and Google Play purchases

In the mobile app you can subscribe through the App Store (iPhone) or Google Play (Android). Apple and Google handle the payment themselves: your card details stay with them and never reach us. The purchase details are passed to us by RevenueCat, a service that keeps track of app store subscriptions. We keep only the purchase number and the date the subscription is paid until — so we can unlock access in your TikLet account on all your devices. You can cancel or change such a subscription in your App Store or Google Play settings; the account dashboard links to them.

13. Device authenticity check

To keep a subscription from being used in a fake or hacked copy of the app, the mobile app confirms through Apple or Google services that it is genuine and running on a real phone. We receive the result of that check; for iPhone we also keep a technical key the app created on that phone and a check counter, so the next check recognises the same app installation. The key and the counter don't tell us who you are. This is not tracking: the check doesn't tell us who you are, where you are or what other apps you use, and it is never used for advertising. Along with the phone's binding we save its type and model name (for example, "iPhone 15") so the account dashboard shows which device is bound.

14. Snap Lenses

Lens effects in the app are powered by Snap (Camera Kit). While a lens is on, camera frames are processed on the phone itself; we don't receive them. Lenses are governed by Snap Inc.'s terms and privacy policy. We don't ask for your location ourselves; some lenses may ask for it through the phone's system prompt — it's your call, and TikLet doesn't store or share your location.

15. Diagnostics

A diagnostics file (app version, settings and the app's log) is created only when you tap "Send diagnostics" yourself, and goes wherever you choose to send it. It contains no passwords or keys, no chat text and no viewer nicknames. The app doesn't send us logs or crash data on its own.

16. Ads and tracking

The app has no ads and no advertising identifiers, and we don't track you across other apps or websites. The data listed in this policy is used only to run your account and the app.

17. Age

The service is not intended for anyone under 16.

18. Changes to this policy

If this policy changes materially, we'll update the date at the top of the page and, for significant changes, notify you in the app or on the site.