Privacy Policy.
This Privacy Policy explains how ttokviewer handles personal information when you visit ttokviewer.com, explore public TikTok content, create an account or contact us. It also explains your choices and how to make a privacy request. Our Terms of Service describe the rules for using the service.
1. Who is responsible for your information
ttokviewer is an independently operated service run by an individual operator. In this policy, “ttokviewer,” “we,” “us” and “our” refer to that operator, who is responsible for deciding how personal information is used for this service. Our privacy and support contact is support@ttokviewer.com.
2. Information we collect
Information you provide
- Email registration: your email address and password. Your display name is derived from the part of your email before @; no separate name field is required. Before verification, we hold the pending registration, a salted password hash and a hashed verification token. After verification, the account record includes an account identifier and verification time. We do not store your password in plain text.
- Google sign-in: Google shares your account identifier, verified email address, name and profile image. We use these details for authentication and your account menu. We request basic identity permissions only, with no access to Gmail, Drive or your TikTok account. Google sign-in is optional and is not automatically linked to an email/password account.
- Queries and public content: search terms, creator usernames, public video links or identifiers, and pagination parameters. Returned content can include public names, avatars, biographies, videos, comments, replies, follower/following lists and engagement counts. Publicly available content may still contain personal information.
- Credits and exports: we store your account's credit allocations, usage, reservations and export task history to enforce limits and avoid duplicate charges. Export rows are collected and temporarily stored on our servers. Completed rows can be downloaded only by the owning account for 24 hours, after which access expires and payloads are removed on that account's next credit refresh. Canceled or expired collection payloads are removed on its next credit refresh. Usage ledger and task metadata remain as account and billing records.
- Support: your email address, message and any information or attachments you choose to send. Please do not send passwords, verification links or full payment-card details.
- Future purchases: when checkout becomes available, order details may include your account/email, plan or credit pack, amount, currency, transaction identifier, payment/refund status and subscription or credit activity. The payment provider will collect the billing and payment details needed to process your order. We do not currently collect payment-card details on this site.
Information received automatically
Our hosting and delivery services receive normal web-request information, such as IP address, browser/user-agent, requested URL, request time and response status. Operational logs may include query parameters, video identifiers and error or performance information. For account-abuse prevention, the application uses hashed identifiers derived from email addresses and IP addresses, with attempt counters and expiry times. Hashing these identifiers does not make them anonymous.
We do not request precise device location, contacts, private TikTok messages or your personal TikTok browser cookies. Media and other external resources also generate requests to their hosts, as explained in Section 5.
3. How and why we use information
We use information for the purposes below. Where applicable law requires a legal basis for processing, the relevant basis depends on the purpose and circumstances.
| Purpose | Information used | Basis, where applicable |
|---|---|---|
| Provide requested features | Queries, public-content results and browser/session data | Performance of our agreement with you; legitimate interests in delivering a usable service |
| Create and secure accounts | Email or Google identity, verification records, password hashes and abuse counters | Performance of our agreement; legitimate interests in preventing abuse and unauthorized access |
| Support and service notices | Contact details, correspondence and relevant account information | Performance of our agreement; legitimate interests in answering requests and communicating service changes |
| Maintain reliability and security | Request/error logs, cache entries and technical data | Legitimate interests in diagnosing faults, protecting the service and preventing fraud |
| Process future purchases | Order, subscription, credit and payment-status records | Performance of our agreement; applicable accounting and legal obligations |
| Meet legal requirements | Records relevant to a legal obligation or claim | Legal obligation; legitimate interests in establishing or defending legal claims |
Where processing requires your consent, we will request it for that purpose. Acknowledging this policy is not blanket consent to optional tracking or marketing.
6. Security
Our hosted configuration uses HTTPS. Email-account passwords are stored as salted PBKDF2-SHA256 hashes; verification tokens are stored as hashes. Sessions are encrypted and use HttpOnly cookies, and account endpoints limit repeated attempts. Verification links expire and can be used only once. Application authentication error logs omit credentials and provider-token details.
No online service or transmission is completely secure. Protect your email account, use a password you do not reuse elsewhere and sign out on shared devices. If a security incident requires notice to affected people or regulators, we will provide the notices within the periods required by applicable law. Report suspected account or data-security issues to support@ttokviewer.com.
7. How long we keep information
| Record | Period and handling |
|---|---|
| Verified email account | Retained while your account exists, until a verified deletion request is processed, subject to any necessary legal or dispute-related retention. |
| Pending registration | The verification link is valid for 30 minutes. Pending records are removed when verification succeeds or during expiry cleanup on a later registration; expiry alone does not immediately remove the stored record. |
| Authentication session | Seven-day cookie validity, renewable during use. Sign-out clears the current browser’s session cookie. This does not delete your email account. |
| Abuse-prevention counters | Login windows last 15 minutes; registration windows last up to one hour. Expired counters stop restricting attempts and are cleared or replaced during later account activity. There is no scheduled deletion at the exact expiry time. |
| Public-query caches | The native server reuses results for 60 seconds. Optional data services use result windows of 60–120 seconds and creator-identity windows of five minutes. Expired entries are not reused, but may stay in bounded process memory until cleanup, replacement or restart. |
| Browser preview and export data | Video previews can stay in session storage for the tab session, with a ten-minute reuse window. In-memory results last while the page is in use. Downloaded files remain on your device until you remove them. |
| Support correspondence | Kept for handling your request and any necessary follow-up, security investigation or dispute. No automatic fixed-period deletion is currently configured; you can request deletion where applicable. |
| Infrastructure logs and provider records | Retention follows the relevant hosting, email or data provider’s settings and policies. These periods may differ from application cache windows; we do not promise deletion of provider records when a cache expires. |
| Future transaction records | No purchase records are created by the current site. Once payments launch, transaction records will be kept for applicable accounting, tax, refund and dispute requirements, with retention details updated before checkout opens. |
Where a deletion request applies, we delete or de-identify information under our control unless retention is required for a specific lawful reason, which we will explain. Provider-managed backups and logs may follow separate expiry cycles. We do not maintain a permanent account-linked search-history feature.
8. Your choices and privacy rights
Depending on where you live and the law that applies, you may have rights to:
- Understand our processing and request access to a copy of your personal information.
- Correct inaccurate or incomplete information, or request deletion.
- Restrict certain processing or object to processing based on legitimate interests.
- Receive eligible information in a portable, machine-readable format.
- Withdraw consent for processing that depends on consent, without affecting prior lawful processing.
- Complain to the data-protection authority responsible for your location and exercise applicable privacy rights without unlawful discrimination.
Send requests to support@ttokviewer.com, preferably from the email associated with your account. Explain the request and include relevant public-content URLs if needed. We may ask for proportionate information to verify your identity or an authorized agent’s authority. Do not email your password or a full payment-card number.
We aim to respond within 30 calendar days, and will follow any different deadline required by applicable law. If an extension is permitted and needed, we will explain the reason and timing. If we cannot fulfill part of a request, we will explain the applicable reason and any available review or complaint options.
Account deletion is handled by email; the current site has no self-service deletion screen. Logging out only clears this browser’s session. You can also revoke ttokviewer’s access in your Google account’s third-party connection settings; this is separate from deleting records held by ttokviewer. Revoking Google access does not itself clear an existing ttokviewer session, so sign out as well.
We do not use personal information for automated decisions that produce legal or similarly significant effects. Automated account rate limits are used to prevent abuse; contact us if you believe they incorrectly block access.
9. Email and marketing
The current service sends registration-verification email and may respond to support requests. We do not currently run a marketing mailing list or send promotional campaigns. Future marketing would require the consent or other permission applicable to it and an accessible way to opt out before it begins.
Necessary service messages, such as requested verification, security notices, policy changes and future purchase confirmations, are distinct from marketing. Contact support@ttokviewer.com if you receive an unexpected message.
10. International processing
Cloudflare, Google, Resend, TikTok, TikWM and other providers described in this policy operate internationally. Requests and records may be processed outside the country where you live, and applicable privacy laws may differ. The location depends on the provider, its infrastructure and the service configuration; this service does not promise storage in a single country.
For questions about the providers, processing locations or transfer safeguards relevant to your information, contact support@ttokviewer.com. Any processing or transfer must remain subject to requirements that apply to it. This policy does not replace those requirements or limit your rights.
11. Children and age requirements
ttokviewer is intended for people aged 18 or older, as set out in our Terms. We do not knowingly collect account information from children under 18. If you believe a child has provided personal information to us, contact support@ttokviewer.com so we can investigate and take appropriate steps to remove it.
12. Third-party services and public content
This policy describes ttokviewer’s processing. TikTok, Google and other external services have their own privacy policies and controls. Review those policies when visiting their sites, authorizing sign-in or using a future payment checkout. ttokviewer is independent of TikTok and ByteDance.
Public content is retrieved from its source and can be cached temporarily. Deleting a ttokviewer account does not delete source content on TikTok. To remove source content, use TikTok’s controls or contact the original publisher; you may also contact us about ttokviewer’s display or processing of that content. Public availability does not remove anyone’s privacy or intellectual-property rights.
Spreadsheet exports are assembled in your browser from loaded public results. Media downloads may pass through our download endpoint. Once you save or share a file, you control that copy and are responsible for handling it lawfully. The current service does not send your queries or exports to an AI model.
13. Changes to this policy
We will update this page’s version and date when our processing changes. For material changes, we will normally provide at least 14 days’ notice through a site notice or an email to your registered address, where practical. Urgent security or legal changes may take effect sooner, with an explanation where appropriate. Where new processing requires consent, we will request it separately.
14. Contact us
For privacy questions, account deletion, data requests, public-content concerns or security reports, email support@ttokviewer.com. Use a subject such as “Privacy request” and describe what you would like us to do. This is also the contact for support and future billing or refund questions.