Privacy Policy

TikPlay ("we," "our," or "us") operates the TikPlay gaming platform that integrates with TikTok livestreams. This Privacy Policy explains how we collect, use, and protect your information when you use our interactive gaming services.

1. Information We Collect

Account Information

When you create a TikPlay account, we collect your username, email address, and profile information.

TikTok Integration Data

When you connect your TikTok account, we collect:

• TikTok username and profile information
• Livestream interaction data (gifts, likes, comments)
• Viewer engagement metrics
• Stream analytics for game performance
• If you verify your TikTok account in the launcher: your TikTok username and TikTok user ID as verified, kept until you delete your account or another TikPlay account verifies the same username. For the check we read your public TikTok profile page each time you press Check and look for the short code you put in your bio.
• If you link your TikTok account with "Link TikTok" in the launcher: you sign in to TikTok in a separate launcher window. The TikTok session is stored encrypted on your PC only and is never sent to our servers. The launcher reads only your TikTok username from it (and your public TikTok profile) to fill in your TikTok ID after you confirm it. This does not prove that the account is yours: that is still checked with the code in your bio (see above). If the launcher's Chat Bot has no TikTok account yet, it uses the same sign-in on your PC (see Section 3.7). "Unlink" removes the session from your PC.

Twitch and YouTube Integration Data

If you link a Twitch account or a YouTube channel, we process the data described in Section 3.6.

Gaming Data

We collect game interaction data including:

• Game performance and scores
• Player progression and achievements
• Game configuration and mappings
• Session duration and frequency

Technical Information

We automatically collect device information, IP addresses, browser type, and usage analytics to improve our services.

2. How We Use Your Information

We use your information to:

• Provide and operate the TikPlay gaming platform
• Connect your games with TikTok livestream interactions
• Connect your games and overlays with the events of your linked Twitch account or YouTube channel
• Process TikTok gifts and convert them to in-game actions
• Provide analytics and performance insights
• Improve our games and platform features
• Send important service updates and notifications
• Ensure platform security and prevent abuse

2.1 Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds:

Contract Performance (Art. 6(1)(b) GDPR)

• Account creation and management
• Game functionality and TikTok integration
• Subscription processing and billing

Legitimate Interest (Art. 6(1)(f) GDPR)

• Platform security and fraud prevention
• Analytics for service improvement
• Technical infrastructure maintenance

Consent (Art. 6(1)(a) GDPR)

• Marketing communications (where opted-in)
• Non-essential cookies and tracking
• Optional features like advanced analytics

You can withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

3. Information Sharing

We do not sell your personal information. We may share information in these situations:

• TikTok Integration: Necessary data sharing with TikTok's API for livestream functionality
• Service Providers: Third-party services that help us operate the platform
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with mergers or acquisitions

3.1 Public Leaderboard

We operate a public leaderboard that ranks streamers by the total value of virtual gifts they received from viewers through TikPlay games. The leaderboard is visible to everyone, including visitors who are not logged in.

For each ranked streamer we display only the username and the TikTok ID you have entered in your profile (which links to your public TikTok page), together with the aggregated gift value. We never publish your email address, account ID or any other personal data on the leaderboard.

Participation is on by default: as soon as your account ranks among the top streamers, your username and TikTok ID are shown automatically, without a separate prior consent. You can opt out at any time (see below).

The legal basis is our legitimate interest in recognizing and motivating active streamers (Art. 6(1)(f) GDPR). You can object at any time: in your profile under "Account" you can turn off the "Show me on the public Leaderboard" toggle, which removes your username and TikTok ID from the leaderboard.

Every week we show the Top 10 of the previous week in videos and posts on our social media channels (such as TikTok, X and Discord): rank, gift value, an estimated dollar value and the game played most. Streamers appear there anonymously. Your username and profile picture are only shown if you turned on "Feature me in TikPlay posts" in your profile; the legal basis for this is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the same switch, with effect for future videos and posts; on request to support@tikplaygames.com we also delete earlier ones. Streamers who turned off the public leaderboard are not included at all. Top 10 streamers without the opt-in may get one email about it, at most every three weeks, with an unsubscribe link.

Twitch and YouTube have their own public leaderboards, which never count toward the TikTok leaderboard. If you have linked Twitch or YouTube, they rank you by the estimated value of the support you received in your Twitch or YouTube streams with TikPlay (for example Bits, subs, Super Chats, memberships and Jewels). For each ranked streamer they show your TikPlay username and profile picture, on Twitch also your Twitch username and display name, on YouTube your YouTube channel name, each with a link to your channel, as well as the estimated value, the number of streams and the number of each kind of support. You are listed only while the platform is linked to your account. The same switch "Show me on the public Leaderboard" also removes you from these leaderboards.

3.2 Data of Livestream Viewers (Viewers Page)

Streamers can switch on the Viewers page in the TikPlay Launcher. It is off by default. Only while it is on and TikPlay is connected to the TikTok LIVE entered in the streamer's TikPlay account do we count the gifts that viewers send in that LIVE. If the streamer has also linked Twitch or YouTube, we count paid support in those streams in the same way (Bits, subs, gifted subs, Super Chats and Super Stickers, memberships, gifted memberships and YouTube Gifts, with an approximate value in US dollars, the time of the first and the last support and the support per day). For Twitch viewers we store the Twitch user ID, login name and display name. For YouTube viewers we never store the channel ID: our server turns it into a code with a secret key, so the channel ID cannot be read from it, and keeps the display name only until 30 days after the last support. No profile pictures and no chat messages are stored for the Viewers page. Viewers who want their Twitch or YouTube data deleted can email support@tikplaygames.com with their Twitch name or the link to their YouTube channel.

For every viewer who sends a gift we store the TikTok user ID, the TikTok username and display name as they appear in the LIVE, the number and diamond value of the gifts, the time of the first and the last gift and the gifts per day. For the Viewers page we do not store profile pictures, comments or any other profile data of viewers.

The data comes from the public events of the LIVE, which our service provider EulerStream delivers to our servers. Viewers do not need a TikPlay account.

Purpose: the streamer gets an overview of who supports the stream with gifts (top supporters, new viewers, regulars who have not been back for a while). The legal basis is the legitimate interest of the streamer and of TikPlay in this overview (Art. 6(1)(f) GDPR). Only the streamer sees the data, in their own account. It is not published, not shown in overlays or games and not used for advertising.

The data stays until the streamer deletes it or deletes their TikPlay account; there is no automatic deletion after a set time. Only the per-day values behind the charts are removed after 90 days, the totals per viewer stay. A viewer can ask us to delete their data at any time. The streamer can pause counting, delete single viewers or all data at any time, and export the list with Super.

The data is stored in Google Firebase (Firestore) and processed on our servers at Hetzner Online GmbH in Falkenstein, Germany.

Top supporters: independently of the Viewers page, while a TikPlay game is connected to the LIVE we keep a list of the viewers who sent gifts for the streamer's statistics on the website: TikTok username, display name, a link to the TikTok profile picture, the number and diamond value of the gifts and the time of the first and the last gift. This list is deleted together with the streamer's account. Viewers who ask us to delete their data (see below) are removed from it as well and are no longer added.

If you are a viewer and want to know which data about you is stored, or want it deleted and no longer counted, email support@tikplaygames.com with your TikTok username. Once we have checked that the TikTok account is yours (we send you a short code to put in your TikTok bio for a moment), we delete your data for all streamers and add you to a list so that you are no longer counted. You also have the rights listed in section 5, including the right to object (Art. 21 GDPR) and the right to lodge a complaint with a data protection authority.

Streamers who use the Viewers page must tell their viewers about it, for example in their TikTok bio, and may use the data only for this overview. TikPlay is responsible for storing and processing the data. A streamer who exports, copies or publishes it is responsible for that use.

3.3 Public List of Live Streamers (Games Hub)

On the games hub of the website and on the Home page of the launcher we show a list of streamers who are live with TikPlay right now. The list is public and visible to visitors who are not logged in.

For each live streamer the list shows the TikTok handle, the display name, the profile picture (the picture uploaded to TikPlay, otherwise the public TikTok profile picture), the current number of viewers, the start time of the stream, the plan badge (Super, Pass or free) and, when known, the game that is open. We never publish an e-mail address or an account ID.

If you have linked Twitch or YouTube and TikPlay is connected to your stream there, your entry also shows on which platforms you are live (TikTok, Twitch, YouTube), with your public Twitch login name or your YouTube channel ID, the public link to the stream and the viewer count there. Without a picture uploaded to TikPlay, the public Twitch or YouTube profile picture is shown. The same right to object applies.

A streamer is listed only while TikPlay is connected to their live stream and live events are arriving. The list is refreshed about every minute, and the entry disappears shortly after the connection ends.

The legal basis is our legitimate interest in showing which streams are live on the platform and in helping viewers find them (Art. 6(1)(f) GDPR). The data shown is already publicly visible on TikTok.

You can object at any time (Art. 21 GDPR). The same switch as for the public leaderboard applies: in your profile under "Account", turn off "Show me on the public Leaderboard". You are then no longer listed. You can also object by e-mail to support@tikplaygames.com.

3.4 Live Announcements on Discord

When a TikPlay Super subscriber goes live on TikTok with TikPlay, we post a short announcement in our Discord server. It contains the TikTok handle, the display name, the profile picture saved in TikPlay, a link to the LIVE and, if you have linked your Discord account with us, a mention of it. We post at most one announcement per streamer within a few hours.

For this we send the data to Discord (Discord Inc., USA), which shows it to the members of our server. The legal basis is our legitimate interest in showing the community who is streaming with TikPlay (Art. 6(1)(f) GDPR). Announcements are on by default for Super subscribers. You can object at any time by e-mail to support@tikplaygames.com. We then switch the announcements off for your account and, on request, delete announcements that were already posted.

3.5 Chat in the TikPlay Launcher

The launcher has a public chat with one room for everyone and one room per language. Only signed-in accounts can write. Every message is shown to everyone who opens the chat, together with your name, your profile picture, your plan (Super, Pass or free), the time and, if verified, your TikTok username.

Messages are kept on our multiplayer server at Hetzner in Germany, in an in-memory database (Redis). Each room keeps only the latest 200 messages; older messages drop out automatically. A filter blocks links and listed words. Moderators can delete messages and mute accounts. If you report a message, we store the report (message text, the reported and the reporting account, the reason and the time) in Google Firebase so that we can review it.

The legal basis is the performance of the contract for the chat you use (Art. 6(1)(b) GDPR) and our legitimate interest in a safe chat (Art. 6(1)(f) GDPR). When you delete your account, your chat messages are removed.

3.6 Twitch and YouTube (Linked Accounts)

You can link your own Twitch account and your own YouTube channel to your TikPlay account, for example in the TikPlay Launcher with "Link Twitch" or "Link YouTube". Your games and overlays then also react to your Twitch and YouTube streams, as they do to TikTok. Linking is optional. It uses the official sign-in of Twitch or Google (OAuth), where you see and confirm the access TikPlay asks for. We never see your Twitch or Google password.

TikPlay uses the YouTube API Services to link your YouTube channel and to receive the events of your YouTube live streams. Google's Privacy Policy applies to the YouTube API Services: https://policies.google.com/privacy

TikPlay's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. https://developers.google.com/terms/api-services-user-data-policy

What we store when you link

For Twitch: your Twitch user ID, login name, display name and profile picture. For YouTube: your channel ID, channel name and channel picture. For both: the permissions you granted, the time of linking and the access tokens that Twitch or Google issue to us. The tokens are encrypted (AES-256-GCM) and stored in a database that only our servers can access (Google Firebase), never in your browser. A Twitch account or a YouTube channel can be linked to only one TikPlay account at a time. To protect the sign-in, we also keep a one-time code that expires after 10 minutes and is then deleted automatically, and the times of your recent link attempts (at most 10 per platform and hour).

On YouTube, TikPlay asks only for read access to your YouTube account (youtube.readonly) and never posts, writes or changes anything there. On Twitch: reading the chat of your channel (user:read:chat, user:bot, channel:bot), Bits (bits:read), followers (moderator:read:followers), channel point redemptions (channel:read:redemptions) and Hype Trains (channel:read:hype_train). We also read the list of your channel point rewards so that you can assign them in the editor. In addition, we ask Twitch for permission to send chat messages (user:write:chat). It is used only by the Twitch Chat Bot and only while you have switched the bot on (Section 3.7). Otherwise TikPlay never posts, writes or changes anything on Twitch.

With the YouTube access we read only: your channel's ID, name and picture, your live broadcasts (to find the one that is running, with its ID, title and live chat), the live chat messages and events of that broadcast and its viewer count. We do not read your videos, playlists, subscriptions, comments, watch history or any other YouTube data.

When you link through our website, we set a strictly necessary cookie (tp_oauth_twitch or tp_oauth_youtube) for 10 minutes that ties the sign-in to your browser. When you link in the launcher, the sign-in page of Twitch or Google opens in your browser, and the result goes straight back to the launcher on your PC. No Twitch or YouTube token is stored on your PC or in your browser.

While you are live

Only after you click "Connect with TikPlay" in the launcher, and only while your channel is live, our server (at Hetzner in Germany) receives the events of your own channel:

• Twitch: chat messages (name, profile picture, text and badges such as moderator, subscriber or VIP), follows, subs, resubs and gifted subs, Bits, raids, channel point redemptions, Hype Trains, your viewer count and whether you are live.
• YouTube: live chat messages (name, profile picture, text and badges such as moderator, member, owner or verified), Super Chats and Super Stickers, new memberships, membership milestones, gifted memberships, YouTube Gifts with their Jewels, your viewer count and whether your broadcast is running.

We use these events to trigger the games and overlays you have set up, which show your viewers' names, pictures and messages in your stream, to count the free streaming minutes that TikTok, Twitch and YouTube share, and to build your stream recap. So that nothing is lost if the connection drops for a moment, the events are kept for about one hour in a replay buffer in an in-memory database (Redis) on our server. Overlays that count during a stream (for example goals or timers) keep their current state on our overlay server, as they do for TikTok. We do not use the events for anything else.

Stream recap

For every Twitch or YouTube stream that lasts at least one minute, our server saves a summary in your TikPlay account: start and end time, duration, peak viewer count, the number of chat messages and of different chatters, the number and value of support (for example Bits, subs, Super Chats, memberships and YouTube Gifts) and your top 3 chatters and top 3 supporters with their name and profile picture. Only you can see the recap, in your account. While the stream is running, the counts are also kept in the in-memory database on our server for at most 24 hours, so that a server restart does not lose them. For YouTube streams, the names and pictures of the top 3 chatters and supporters are deleted automatically after 30 days, as Google's rules for YouTube data require; the numbers stay. Everything else in the recaps, including the names in Twitch recaps, stays in your account until you delete your TikPlay account, also after you unlink Twitch or YouTube.

YouTube Gift list

YouTube publishes no list of its Gifts. We therefore keep one central list of the YouTube Gifts that appear in connected live chats: the name of the Gift, its picture, its value in Jewels and when it was last seen. Streamers use it to assign YouTube Gifts in the editor. The list contains no data about viewers or streamers. An entry is updated each time the Gift appears again.

Sharing and service providers

We do not sell Twitch or YouTube data and do not share it with third parties for advertising. Your viewers' names, pictures and messages appear in your own overlays and games, which you show in your stream, as with TikTok. To provide the service, Hetzner Online GmbH (servers in Germany), Google Firebase (database) and Vercel (the website where the sign-in is completed) process the data on our behalf, see Section 7. To read your channel, our servers send the necessary requests with your token to Twitch or YouTube.

Legal basis and viewers

For you as a streamer, the legal basis is the performance of the contract for the features you use (Art. 6(1)(b) GDPR). For your viewers, it is the legitimate interest of the streamer and of TikPlay in an interactive stream with games, overlays and recaps (Art. 6(1)(f) GDPR).

If you are a viewer in the Twitch or YouTube stream of a streamer who uses TikPlay, your public name, profile picture, chat messages and support in that stream are processed as described above. If you are among the top 3 chatters or supporters, your name and picture are stored in that streamer's recap (for YouTube streams for 30 days). You do not need a TikPlay account. To find out which data about you is stored, or to have it deleted, email support@tikplaygames.com with your Twitch or YouTube name. You also have the rights listed in Section 5, including the right to object (Art. 21 GDPR).

Unlinking, revoking access and deletion

You can unlink Twitch or YouTube at any time in the launcher with "Unlink". We then ask Twitch or Google to revoke TikPlay's access and delete the stored tokens and link data. The channel can then be linked to another TikPlay account.

You can also revoke TikPlay's access directly at Google or Twitch. TikPlay can then no longer read anything from your channel. Our server notices this the next time it uses the access, or at the latest in its daily check, and then deletes the stored link data and tokens. You can revoke access here:

• Google (YouTube): https://myaccount.google.com/permissions
• Twitch: https://www.twitch.tv/settings/connections

When you delete your TikPlay account, we ask Google or Twitch to remove TikPlay's access, as with "Unlink", and delete your Twitch and YouTube links with their tokens, the entries that assign your channels to your account, unfinished sign-ins, the records of your link attempts and your stream recaps. Events in the replay buffer expire after about one hour. You can delete your account in your profile at any time, or ask us at support@tikplaygames.com to delete your data.

3.7 TikPlay Chat Bot (Launcher)

With TikPlay Super, the Chat Bot in the launcher can write into your TikTok LIVE chat: thanks for gifts, follows and shares, answers to commands such as !gifts, !game, !help and your own commands, timed messages and a message when the chat has been quiet for a while. For this you sign in to TikTok in a separate launcher window with your own or a second TikTok account; if you have used "Link TikTok" and the bot has no account yet, it uses that sign-in. The launcher then opens your LIVE page in the background on your PC and types the messages into the chat from there. The messages appear publicly in your LIVE chat under that TikTok account and can contain your viewers' names.

The bot's TikTok session is stored only on your PC, encrypted by Windows, and its settings (texts, commands, timers, message limits) are stored in a file on your PC. Neither is sent to our servers. To know what to answer, the bot uses the gifts, follows, shares and comments of your LIVE that the launcher already receives through TikPlay; the list of sent messages is only shown in the launcher and is not saved. So that we can switch the bot off for everyone if there is a problem, the launcher reads a public on/off setting from our servers. Signing the bot out in the launcher deletes its session from your PC. The legal basis is the performance of the contract for the feature you use (Art. 6(1)(b) GDPR).

Twitch Chat Bot: with TikPlay Super you can also switch on a Chat Bot for your Twitch chat. It does not run on your PC but on our servers: while TikPlay is connected to your Twitch stream, our server sends the messages (thanks for Bits, subscriptions, follows and raids, answers to !help and your own commands, timed messages and a message when the chat has been quiet) through Twitch's official interface with your linked Twitch account (permission user:write:chat). The messages appear publicly in your Twitch chat under your account and can contain your viewers' names. To decide what to write, the server uses the events of your Twitch channel that it already receives (Section 3.6). Your bot settings (texts, commands, timers, message limits) are stored in our database (Google Firebase) and deleted together with your TikPlay account. The list of the last sent messages is kept only in the server's memory so that the launcher can show it, and is not saved. If you switch the bot off or unlink Twitch, it stops writing. The legal basis is the performance of the contract for the feature you use (Art. 6(1)(b) GDPR).

4. Data Security

We implement industry-standard security measures including:

• Encryption of data in transit and at rest
• Regular security audits and updates
• Access controls and authentication systems
• Secure cloud infrastructure (Google Cloud/Firebase, Vercel, Cloudflare)

5. Your Rights (GDPR)

If you're in the EU/EEA, you have comprehensive rights:

• Right of Access (Art. 15): Request copies of your personal data
• Right to Rectification (Art. 16): Correct inaccurate data
• Right to Erasure (Art. 17): Delete your data ("right to be forgotten")
• Right to Restrict Processing (Art. 18): Limit how we use your data
• Right to Data Portability (Art. 20): Receive your data in machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interest
• Right to Withdraw Consent (Art. 7(3)): For consent-based processing

To exercise these rights:

• Email: support@tikplaygames.com with subject "Data Protection Request"
• Response time: Within 30 days (may be extended to 60 days for complex requests)
• Free of charge (except for manifestly unfounded or excessive requests)

You also have the right to lodge a complaint with your local data protection authority.

6. Cookies and Tracking

We use different categories of cookies:

Strictly Necessary Cookies

• User authentication and security
• Basic platform functionality
• Session management

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)

Performance/Analytics Cookies

• Vercel Web Analytics: page views, referring page, device type, browser, operating system and country, without cookies. It loads only after you switch on Analytics in the cookie banner.
• Game performance monitoring

Legal basis: Consent (Art. 6(1)(a) GDPR), requires opt-in

Marketing Cookies

For users on the free tier, we display advertising provided by Google AdSense, including video ads via the Google IMA SDK. AdSense uses cookies and similar technologies to serve and measure ads, and may serve personalized advertising where you have consented. Super subscribers do not see ads.

• Google AdSense: display, banner and sidebar ads
• Google IMA SDK: in-stream video ads. It loads only for free users and only after you have agreed to advertising (Marketing in our cookie banner or ad consent in Google's consent dialog).
• Google Funding Choices: consent management for ad personalization (TCF v2)
• TikTok Pixel: measurement of page views and conversions from our TikTok marketing campaigns (cookies such as _ttp)

Legal basis: Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), requires explicit opt-in

6.1 Anonymous Counters and Browser Storage

To see how often the home page, the pricing page and the rewards page are viewed and how often a checkout is opened, the website counts these events anonymously. Each event is only a name and a number added to a daily total, for example "rewards page viewed: 1". These counters set no cookie and store no identifier, no IP address and no device data, so they cannot be linked to a person.

To limit abuse, the server briefly keeps the requesting IP address in its working memory to count requests per minute. It is not saved and not part of the counters.

For functions you use, the website stores the following entries in your browser (localStorage or sessionStorage). They stay on your device and are not used to track you:

• tikplay-locale and tikplay-theme: your language choice and your light or dark appearance.
• tikplay-cookie-prefs and tikplay-cookie-banner-dismissed: your cookie choices.
• tikplay.boxFeedback: whether the sound of the TikPlay ticket is switched on.
• tikplay.rewardClaims.v1 (the key includes your internal account ID): the ID of a reward claim that is not finished yet, so that after a lost connection the same reward is returned and nothing is paid out twice.
• tikplay-pending-tiks and tikplay-pending-checkout (session storage): the product you are paying for, so the purchase can be completed when you return from the payment page.
• tikplay-tiks-celebrated, tikplay-starter-grant, tikplay-profile-greeted, tikplay-app-banner-dismissed-until and tikplay-offer-banner-collapsed: whether you have already seen a thank-you card, a greeting or a banner, so that it is not shown again.
• tikplay-editor-state (draft state of the editor), tikplay-embedded (the page runs inside the TikPlay app) and tikplay_session_id (session storage, a random ID of the browser tab used for security events).

Campaign and partner references: if you arrive through a campaign link (utm_source) or a partner code, we keep the campaign name or code in a cookie (tikplay-utm) and in the browser (tikplay-utm-ls) for up to 30 days, to attribute sign-ups and purchases to it.

These entries are strictly necessary for functions you have requested (§ 25(2) no. 2 TDDDG). Legal basis for the processing: Art. 6(1)(f) GDPR, and Art. 6(1)(b) GDPR where it serves a contract. You can delete the entries in your browser at any time; some functions may then be reset.

7. Third-Party Services / Recipients

To operate the platform we engage the following processors and service providers. The data shared is limited to what is necessary for the respective purpose:

Platform Integration

• TikTok (TikTok Pte. Ltd., Singapore / TikTok Inc., USA): Livestream integration: gift events, comments and viewer interactions of the connected LIVE (delivered by EulerStream, see below)
• EulerStream (Euler Stream, North York, Ontario, Canada): Technical provider that delivers the public events of a TikTok LIVE (gifts, likes, comments, follows) to our servers while TikPlay is connected to the stream
• Twitch (Twitch Interactive, Inc., USA): If you link Twitch: sign-in (OAuth) and the events of your Twitch channel (see Section 3.6)
• YouTube (Google LLC, USA): If you link YouTube: sign-in with Google (OAuth) and the live chat and events of your YouTube live streams through the YouTube API Services (see Section 3.6)

Authentication

• Firebase Authentication (Google Ireland Ltd., Ireland / Google LLC, USA): User account management, session tokens
• Google Sign-In (Google Ireland Ltd., Ireland / Google LLC, USA): Optional OAuth login via your Google account
• TikTok (TikTok Technology Ltd., Ireland / TikTok Pte. Ltd., Singapore): Optional sign-in with "Link TikTok" in the launcher: you sign in directly at TikTok, and the session stays encrypted on your PC (see Section 1)

Backend, Database & Storage

• Firebase (Firestore, Realtime Database, Cloud Functions, Cloud Storage; Google Ireland Ltd. / Google LLC, USA): Backend services, game configurations, user profiles, Super status, asset storage
• Cloudflare R2 / Workers (Cloudflare, Inc., USA): CDN for game assets and media at cdn.tikplaygames.com (Cloudflare R2) and Cloudflare Workers that receive file uploads, for example images you upload
• Vercel (Vercel Inc., USA): Hosting of the web application, edge functions, image optimization, server logs
• Hetzner (Hetzner Online GmbH, Germany): Servers in Germany that run the live connection, the overlays, the statistics, multiplayer, the launcher chat and the automation of our X account

Payments

• Stripe (Stripe Payments Europe Ltd., Ireland / Stripe Inc., USA): Subscription processing, checkout sessions, customer portal, billing data
• PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg / PayPal, Inc., USA): Payment method inside Stripe Checkout; payment approval, fraud prevention and payment data under PayPal's own privacy policy

On the website, Stripe processes the payment when you buy TikPlay Super, a Day Pass or a Tiks pack, by card or with PayPal. We never receive your full card details or your PayPal password. Stripe sends us a confirmation of the purchase (checkout session, product, amount, currency and time), which we store with your account to deliver the purchase and to handle refunds and chargebacks. Details are in Section 7.2.

Every change to your Tiks balance (purchases, rewards, spending, refunds) is recorded in a transaction history linked to your account. Your Tiks balance is deleted together with your account. Purchase records and the Tiks transaction history are kept for the statutory retention period described in Section 8.1.

Analytics & Error Monitoring

• Vercel Web Analytics (Vercel Inc., USA): Page view statistics without cookies (Vercel Web Analytics), only after your consent in the cookie banner

Marketing & Conversion Tracking

• TikTok Pixel (TikTok Pte. Ltd., Singapore / TikTok Inc., USA / TikTok Technology Ltd., Ireland): Pixel-based measurement of page views and conversion events on tikplay.games to evaluate the performance of our marketing campaigns on TikTok and to optimize advertising audiences. Data processed includes IP address, user agent, timestamp, page URL, referrer, event type and a pixel cookie identifier (_ttp). Data may be combined by TikTok with information already held about TikTok users. The pixel is loaded only after you have given consent via our cookie banner.

Legal basis: Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw consent at any time via the cookie banner.

E-mail, Community and AI

• Resend (Resend, Inc., USA): Sending of all e-mails from TikPlay: sign-in and security mails, purchase confirmations, onboarding and service mails and, if you have subscribed, the newsletter. Resend processes your e-mail address, the content of the mail and delivery data.
• Discord (Discord Inc., USA): Live announcements of Super subscribers in our Discord server (see Section 3.4)
• Anthropic (Anthropic PBC, USA): Writes the posts and replies of our X account (@TikPlay_games). When someone replies to one of our posts or mentions us on X, the text of that public post and the username are sent to Anthropic to draft an answer. Legal basis: our legitimate interest in answering on X (Art. 6(1)(f) GDPR).

In newsletter mails we measure whether a mail was opened (a small image) and which links were clicked (links go through our server), to see which content interests our readers. Every newsletter has a one-click unsubscribe link.

Advertising (Free Tier Only)

• Google AdSense (Google Ireland Ltd. / Google LLC, USA): Banner, leaderboard and sidebar advertising for free users
• Google IMA SDK (Google Ireland Ltd. / Google LLC, USA): In-stream video advertising
• Google Funding Choices (Google Ireland Ltd. / Google LLC, USA): Consent management platform for ad personalization (IAB TCF v2)

Super subscribers do not see advertising and are excluded from ad-related cookies.

Game Engines & Runtime

• Unity (Unity Technologies, USA): Rendering engine for Unity-based games
• Three.js / Phaser: Open-source rendering libraries running locally in your browser; no data is sent to their authors

Each service has its own privacy policy governing their data practices. Where required, we have entered into Data Processing Agreements (DPAs) and Standard Contractual Clauses with these providers.

7.1 International Data Transfers

Some of our service providers are located outside the European Economic Area (EEA):

United States

TikTok, Stripe, PayPal, Google/Firebase, Vercel, Cloudflare, Resend, Discord, Anthropic, Unity

If you link Twitch or YouTube, data is also exchanged with Twitch Interactive, Inc. (USA) and Google LLC (USA, YouTube API Services), see Section 3.6.

• Where the recipient is certified, transfers are protected by the EU-US Data Privacy Framework (Adequacy Decision 2023). Google LLC and Vercel Inc. are DPF-certified.
• For all other US transfers we rely on EU Standard Contractual Clauses (SCCs) and additional technical and organizational measures (encryption in transit and at rest, access controls).
• You acknowledge that US authorities may have access rights to data processed in the US, and that effective legal remedies may be more limited than under EU law.

Singapore, Ireland and other jurisdictions (TikTok)

For the TikTok API integration and the TikTok Pixel, personal data may be transferred to TikTok Technology Ltd. (Ireland), TikTok Pte. Ltd. (Singapore) and TikTok Inc. (USA). TikTok states that data may also be made accessible to its corporate group, including entities in China, where engineers may have remote access for technical and security purposes.

• Transfers outside the EEA are protected by EU Standard Contractual Clauses (SCCs) and supplementary measures published by TikTok in their Privacy Policy and Project Clover documentation.
• There is currently no adequacy decision for Singapore or China; you acknowledge that the level of data protection in these jurisdictions may be lower than in the EEA and that effective legal remedies may be limited.
• You can withdraw your consent for the TikTok Pixel at any time via our cookie banner.

Canada (EulerStream)

EulerStream, the provider that delivers the public LIVE events, is based in Canada. The European Commission has decided that Canada offers an adequate level of data protection for commercial organisations (Decision 2002/2/EC), so this transfer needs no further safeguards.

Other Countries

Currently none. Any future transfers will use appropriate safeguards (SCCs, adequacy decisions)

You have the right to request information about safeguards for international transfers.

7.2 Purchases and Payment Providers

You can pay for TikPlay Super, Day Passes and Tiks packs by card or with PayPal. The payment is processed through Stripe Checkout. PayPal is offered there as a payment method, and you are forwarded to PayPal to approve the payment.

Data processed for a purchase:

• Sent by us to Stripe to open the checkout: your account e-mail address (to prefill the form and send the receipt), the product, the amount and a reference to your TikPlay account.
• Entered by you at Stripe or PayPal: for example card details, billing details or your PayPal login. We never receive your full card number or your PayPal password.
• Received and stored by us: checkout session ID, payment reference, product, amount, currency, time and status, including refunds and disputes, and for Super the Stripe customer and subscription ID.

Purposes and legal bases: concluding and performing the purchase and delivering Tiks, Day Passes or Super (Art. 6(1)(b) GDPR); keeping accounting and tax records (Art. 6(1)(c) GDPR in conjunction with § 257 HGB and § 147 AO); preventing fraud, handling refunds and chargebacks and defending legal claims (Art. 6(1)(f) GDPR).

Stripe (Stripe Payments Europe Ltd., Ireland) and PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) process payment data for their own purposes, such as fraud prevention, money laundering checks and regulatory duties, as independent controllers under their own privacy policies. We are responsible for the data we store about the purchase.

Recipients: Stripe and PayPal and, where the law requires it, tax authorities and auditors. Our hosting providers listed in Section 7 only process the data on our behalf.

Stripe and PayPal may process data in the United States and other countries. Where the recipient is certified, the transfer is protected by the EU-US Data Privacy Framework. For all other transfers we rely on EU Standard Contractual Clauses (SCCs) and additional technical and organizational measures (see Section 7.1).

7.3 Tiks, Rewards and Challenges

On the website and in the app we run the virtual currency Tiks and a rewards system. For this we store the following with your account:

• your Tiks balance and a ledger entry for every change (amount, balance after the change, reason such as purchase, reward, spending or refund, a reference and the time)
• your daily streak (number of days and date of the last claim)
• your reward claims and the results of TikPlay tickets and other random rewards, stored as receipts so that a reward cannot be claimed twice, a repeated request returns the same result and you can see your history
• your progress in weekly challenges, counted per week, and the challenge rewards you have claimed
• purchases made with Tiks, such as streaming time and cosmetic items from game shops (purchase receipt, items you own and wear)

Purposes: to provide the currency and the rewards you use, to credit and spend Tiks correctly, to prevent double claims and abuse and to show your history. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and, for abuse prevention, our legitimate interest (Art. 6(1)(f) GDPR).

We do not use this data for automated decisions or profiling that have legal effects on you or significantly affect you in a similar way (Art. 22 GDPR). The results of random rewards come from a random draw, not from an assessment of you.

7.4 Records for the Right of Withdrawal

When the checkout asks you to agree that digital content is delivered right away and that your right of withdrawal ends on delivery, Stripe records your agreement with the checkout session. We keep the session reference and the purchase confirmation sent to you by e-mail.

Purpose: proof that you agreed and were informed, as required by § 356 (5) BGB, and the defense of legal claims. The legal basis is Art. 6(1)(c) GDPR, and as far as the proof goes beyond the legal duty, Art. 6(1)(f) GDPR. The records are kept as described in Section 8.1.

8. Data Retention

We retain your data for specific periods based on the type of information:

• Account Information: Until you delete your account
• Game Performance Data: Until you delete your account
• TikTok Integration Data: Until you remove your TikTok username from your profile or delete your account
• Viewers Page Data: Until the streamer deletes it or their TikPlay account, or earlier on the viewer's request (per-day values for the charts: 90 days; names of YouTube viewers: 30 days after their last support)
• Top Supporter List (statistics): Until the streamer's account is deleted, or earlier on the viewer's request
• Twitch / YouTube Link: Until you unlink it, remove TikPlay's access at Google or Twitch, or delete your account
• Twitch / YouTube Stream Recaps: Until you delete your account (names and pictures in YouTube recaps: 30 days)
• Twitch / YouTube Live Events: About 1 hour in the replay buffer (recap counts during a stream: at most 24 hours)
• Payment/Subscription Data: 6 to 10 years depending on the type of record (§ 257 HGB, § 147 AO), see Section 8.1
• Analytics Data: Vercel Web Analytics: aggregated page statistics without cookies, kept for as long as Vercel provides them under our plan
• Support Communications: 3 years after case closure
• Security Logs: 6 months after incident

When you delete your account, this data is deleted. Data with a statutory retention period (accounting records) remains in restricted form until that period ends (Section 8.1) and is then deleted.

Figures without any link to a person stay in our statistics after deletion: the daily totals of gifts, diamonds, likes, comments, follows and shares, and the playtime per game. They contain no user ID, name or TikTok username and cannot be traced back to you.

8.1 Purchase Records and Account Deletion

Purchase records, Stripe payment references and the confirmations belonging to them are accounting records. We keep them for the statutory periods of § 257 HGB and § 147 AO: 10 years for books and annual accounts, 8 years for accounting vouchers and 6 years for business letters, each counted from the end of the calendar year in which the record was created. As a small business under § 19 UStG we still have to keep such records.

When you delete your account, we delete your profile with name, e-mail address and TikTok details, your Tiks balance, your daily streak, your reward claims and ticket results, your challenge progress, your owned shop items and your settings.

What remains until the statutory period ends: the purchase records, the payment lookup record and the Tiks transaction history, which also lists reward credits. They are no longer linked to your profile, only to an internal account ID, are not used for any other purpose and are restricted to what the law requires (Art. 17(3)(b) and Art. 18 GDPR). After the period they are deleted. Stripe and PayPal keep their own records under their own legal duties.

9. Children's Privacy

TikPlay is not directed to children. In the European Union, and specifically in Germany, the digital age of consent under Article 8 GDPR is 16 years. Users under 16 require verifiable consent from a parent or legal guardian to use TikPlay or have their personal data processed. We do not knowingly collect personal information from children under this age without such consent. If you believe a minor has provided us with personal data without proper authorisation, please contact us at support@tikplaygames.com and we will delete the data without undue delay.

10. Data Protection Officer

Based on our current processing activities and company size, we are not required to appoint a Data Protection Officer under Art. 37 GDPR.

For data protection inquiries, contact us directly at support@tikplaygames.com.

We will reassess this requirement as our business grows and will appoint a DPO if legally required.

11. TikPlay Mobile App (Android / iOS)

This Privacy Policy also applies to the TikPlay mobile app for Android and iOS. In addition to the processing described above, the following applies specifically to the app:

Advertising in the App (Google AdMob)

The app uses Google AdMob for optional rewarded ads and occasional full-screen ads at natural breaks, such as leaving a game or finishing an offline multiplayer round. Full-screen ads are disabled with active streaming access or Remove Ads; rewarded ads remain optional. AdMob processes advertising identifiers, IP addresses, device information and ad interactions to deliver and measure ads and prevent fraud. We request ads only when Google UMP reports that they may be requested. Where required, a consent form is shown before the first ad request; you can revisit your choice in the app settings. Google sends a signed transaction ID and user ID to our server to confirm rewarded ads and prevent duplicate rewards.

We use our own infrastructure to record app setup steps, game readiness, successful chat interactions, sessions and purchase outcomes. Before sign-in, usage events use a random session ID. Signed-in usage can be linked to your account to measure return visits. Raw usage events are kept for up to 30 days, daily account activity for up to 90 days, and aggregate counts longer. Error reports can also be sent before sign-in. These reports do not include chat messages or screen recordings. Network identifiers used for rate limiting are hashed and rotate daily.

In-App Purchases (Google Play / Apple App Store)

Purchases in the app (Tik packs, the weekly TikPlay Pass, Remove Ads) are processed entirely by Google Play Billing or the Apple App Store. We never receive your payment details such as card numbers. To credit your purchase and handle refunds, we receive and store purchase confirmations (order ID, product ID, purchase token/receipt) linked to your TikPlay account, together with a transaction ledger of your Tiks balance. Google Play and the App Store also notify our server about subscription renewals, cancellations and refunds so that your entitlements stay correct. Purchase records are retained as described in Section 8 (payment data).

Virtual Currency and Rewards

Your Tiks balance, daily reward streaks, referral codes and reward claims are stored as part of your account so they stay available across devices. This data is deleted together with your account; only purchase records and the Tiks transaction history remain for the statutory period (Section 8.1).

Account Deletion in the App

You can delete your TikPlay account directly in the app under Settings > Account > Delete account. Deletion removes your personal data in accordance with Section 8; records we are legally required to keep (e.g. purchase records under tax law) are retained for the statutory periods only.

12. TikPlay Launcher (Windows)

This Privacy Policy also applies to the TikPlay Launcher for Windows. In addition to the processing described above, the following applies specifically to the launcher:

Usage statistics

While you are signed in, the launcher sends usage statistics to our own servers: the launcher and Windows version, which launcher pages you open, which games you open (web, Unity, mod or Minecraft), when you go LIVE and for how long, when you open a checkout, and mod installs. They are linked to your TikPlay account so we can count active users and return visits and see which features are used. We do not record chat messages, gift senders, screen content or anything you type. Nothing is sent before you sign in. Individual events are kept for up to 30 days, daily account activity for up to 90 days, and aggregate counts without your account longer. You can switch the statistics off at any time in the launcher under Settings > App > "Usage statistics".

The same statistics also record a few steps that we measure the same way on our website and in the app: account created in the launcher, TikTok connected, first game opened, first viewer interaction in a LIVE, free streaming time used up and checkout opened. Each step is stored once per account with its date, so we can see where people stop between signing up and buying. The same switch as for the usage statistics applies.

Error reports

If the launcher runs into an error or one of its windows crashes, it sends an error report to our own servers: the error message, a shortened technical trace, the launcher version and, if you are signed in, your TikPlay account. It also contains technical details of that moment: which launcher page was open, how long the launcher had been running, how much memory the launcher and your computer had in use, how many game windows were open and, for graphics errors, the model of your graphics card and its driver version. File paths containing your Windows user name, email addresses and access codes are removed before sending. Error reports are also sent before you sign in and when usage statistics are switched off, because we need them to fix errors. They do not contain chat messages, screen content or anything you type. Identical errors are grouped; when you delete your account, the reference to it is removed from these groups.

Purchases started in the launcher

When you buy a subscription or day pass from a checkout opened in the launcher, we note that the checkout came from the launcher, together with the plan and the amount of the first payment. Payment itself is handled by Stripe as described above.

Deletion

Usage statistics and launcher activity are deleted together with your account. Purchase statistics are kept without any reference to your account; records we are legally required to keep are retained as described in Section 8.

13. Contact Us

For privacy-related questions or concerns, contact us at: