Privacy Policy

Last updated: October 17, 2026

This Privacy Policy covers the TIKTOK Effect website, web dashboard, browser overlays and TIKTOK Effect Mobile for Android and iOS (together, the "Service"), operated by JK MEDIA, Netherlands, KVK: 68578458. The same policy applies when you use an account in either product; their features and access plans may differ. · Kasteelhoekstraat 17, 4433 AJ Hoedekenskerke

1. Information We Collect

We collect information you provide directly and limited information generated from public LIVE interactions while a creator has an active connection:

  • Account Data: We store your email address, account identifier, language preference, approval status and access plan. If you register with a password, we store a one-way bcrypt hash, not the readable password. Google-only accounts do not have a local password unless one is separately established through an available verified procedure.
  • Google Sign-in: If you choose Google login or registration, we request openid email profile. Google may include basic profile information in its identity response; our current implementation uses and stores your verified email address and stable Google account identifier to authenticate and link your account. It does not store the profile name or picture from that response. We do not receive your Google password or request Gmail, Drive, contacts or calendar access. Google access and refresh tokens are not stored for continuing access to Google services.
  • TikTok Login Kit Data: If you separately connect a TikTok account using Login Kit, we request ONLY user.info.basic and store your OpenID, display name and avatar URL. Login Kit is separate from Google or password login and does not provide us with LIVE video/audio feeds or private direct messages.
  • OAuth Tokens: We receive and securely store encrypted TikTok OAuth access and refresh tokens to maintain the authorized TikTok account connection. These tokens are separate from the local TIKTOK Effect login session.
  • Configuration: We store layouts, widget settings, colours, automation rules and mobile alert or speech settings needed for the functions you enable.
  • Media and text: We store images, sounds, videos, animations and browser recordings that you explicitly upload or save. A browser recording or device preview uses the camera or microphone only when you enable that function and grant the required browser permission. Text-to-speech processes the text selected by your rules through the available browser or device speech engine; voice availability and any online processing depend on that engine.
  • LIVE interaction and viewer data: When a creator starts a separate LIVE connection, we may process and store public viewer usernames or platform identifiers associated with gifts, follows, comments, and participation in interactive games, together with gift value, side, score, or contribution. This information does not come from Login Kit. It is used to render alerts, leaderboards, games, automations, and session history.
  • Session statistics: We store counts and totals such as gifts, gift value, follows, likes, viewers, and session duration for dashboard analytics.
  • Security and operational data: We process connection information such as IP address, browser/device user-agent, login times, authentication outcomes and administrative audit records for account protection, troubleshooting and abuse prevention. These records are not advertising profiles.
  • Mobile installation data: The app generates an installation identifier used to coordinate the active mobile receiver. Language and audio preferences are stored locally, and relevant alert configuration and session activity are associated with your account. This identifier is not an advertising identifier and is not used to track you across other apps.

2. How We Use Your Information

We use the collected information solely for operating and providing the Service to you, including:

  • Creating and authenticating your Service account, processing administrator approval and verifying a connected Google or TikTok identity.
  • Generating your browser overlays for TikTok LIVE Studio and OBS Studio and operating mobile alerts, audio and text-to-speech based on your configuration.
  • Tracking public live events to trigger your specified animations, alerts, and goals.
  • Showing public viewer attribution in creator-configured leaderboards, games, alerts, and session records.
  • Displaying historical stream statistics in your dashboard.
  • Protecting accounts, limiting unauthorised sharing, investigating incidents and providing audited support.

Google account data is used for account identity and authentication, not sold or used for advertising profiles or training AI models. A matching email does not silently link a Google identity to an existing password account: the existing password must be confirmed. Creating an account through Google does not bypass administrator approval.

Providing account data is necessary for account-based functions. Google login and the separate TikTok account connection are choices; declining them does not itself require you to disclose those providers' data. Some features require the relevant LIVE connection, device capability or permission.

3. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data. We only share information in the following circumstances:

  • Replit infrastructure: Our hosting, database and object-storage infrastructure processes account data, settings, uploaded media and operational traffic as needed to run the Service. See Replit's privacy policy.
  • Google: When you choose Google login, your browser communicates with Google and our server exchanges the authorisation code and verifies its identity response. Google handles its own account and authentication services under Google's privacy policy.
  • Mollie — planned payments: Mollie is the planned payment operator; checkout is not currently active. When Mollie payments are enabled and you choose a purchase, Mollie will process the payer, transaction and payment-method information required to complete and protect the payment. We will receive the order reference, amount, currency and payment status needed to grant access and handle the purchase, not the full card number or card security code. Mollie acts as a separate data controller for its payment services; see Mollie's privacy statement.
  • TikTok: If you authorise a TikTok connection or enable LIVE features, relevant requests and public interaction data are exchanged with the platform and connection services. TikTok handles its platform under its own privacy policy. These features are not a Google permission.
  • Creator-configured display: Public viewer names or identifiers and related interaction details may be delivered to the creator and displayed to the stream audience through creator-configured overlays, including alerts, leaderboards, games, and similar widgets. The creator controls which widgets are visible in their stream.
  • Legal Requirements: If required by law, regulation, or legal process.

A speech engine or another service explicitly selected for an optional function may process the content needed for that function. A payment operator, email service or external analytics provider must be identified in the relevant purchase flow or additional disclosure before that integration is used. A planned or disabled integration is not represented here as an active recipient of your data.

Infrastructure and authentication providers may process data outside the EEA depending on the hosting region and their operations. International transfers are subject to applicable data-protection requirements; use of the Service is not blanket consent to unrestricted transfers. Contact us for details of the destinations and safeguards applicable to your data.

4. Data Revocation and Deletion

You can disconnect TikTok in the dashboard or revoke its permission through TikTok. You can also remove the Google connection from your Google account's third-party connections settings. Revoking a provider connection does not by itself delete your TIKTOK Effect account, erase stored records or terminate an already issued Service session.

For deletion of the shared web/mobile account, email info@jkmedia.dev from the account address. We verify ownership without asking for passwords or tokens. The request covers Google identity links, account data, settings, uploaded media and stored session records, subject to necessary legal and security exceptions. See Data Deletion for instructions. Uninstalling the mobile app alone does not delete server-side data.

5. EU Data Rights (GDPR)

If you are located in the European Economic Area (EEA), you have specific rights under the General Data Protection Regulation (GDPR), including:

  • The right to access your personal data.
  • The right to rectification of inaccurate data.
  • The right to erasure ("right to be forgotten").
  • The right to restrict or object to processing.
  • The right to data portability.

We rely on performance of the service contract for account and requested product functions; legitimate interests, balanced against your rights, for security, abuse prevention and processing public LIVE interactions; legal obligations where applicable; and consent where a particular optional activity requires it. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.

You may complain to the Dutch Autoriteit Persoonsgegevens or the data-protection authority in your country. Requests can be sent to info@jkmedia.dev; we respond within the time limits required by applicable law.

6. Security, retention and cookies

Public connections use HTTPS. Passwords are hashed; stored TikTok OAuth credentials are encrypted. Google login uses validated identity tokens, PKCE and short-lived, single-use handoffs. The confidential Google client secret stays on the server. Access controls protect account-scoped information and sensitive administrative actions are audited. These measures are not a claim that every database field is encrypted or that security is guaranteed.

The web dashboard and mobile browser preview use session storage for their Service login token. The installed mobile app uses operating-system-protected secure storage for the token and temporary Google login verifier. Ordinary local storage holds non-secret preferences such as language, audio settings and the installation identifier. The Google browser flow uses a necessary, short-lived, encrypted HttpOnly cookie to bind the login attempt; it is not an advertising cookie.

Our application does not use advertising cookies or an external advertising profile. Product session statistics are distinct from third-party website visitor tracking. Any additional non-essential tracking must be disclosed and obtain consent where required before it is activated.

We retain account, provider identity, configuration, media and LIVE records while needed for the active account and requested service, and delete or anonymise them following a verified deletion request, subject to legal obligations, incident investigation and limited operational backups. Temporary login credentials expire; expiry does not imply that every diagnostic record is immediately erased. Security and audit records are retained according to their security, accountability and legal purpose, not for indefinite advertising use.

Viewers whose public interaction data appears in a creator's records may also contact us to exercise applicable data rights. Please provide enough information to identify the relevant creator and interaction without sending passwords or tokens.

We respond to data-rights requests without undue delay and within one month of receipt. Where necessary because of the complexity or number of requests, this may be extended by a further two months; we explain the extension and its reasons within the first month. Requests are normally free, subject to the exceptions permitted by law. Portability applies under the conditions of Article 20 GDPR, not to every record we hold. The application of GDPR does not depend solely on your current physical location.

7. Controller and contact

The controller is JK MEDIA, Netherlands, KVK: 68578458. Privacy, account access and security reports can be sent to info@jkmedia.dev. We may verify your identity before fulfilling a request. Never send passwords, login tokens, provider secrets or private overlay/device links. · Kasteelhoekstraat 17, 4433 AJ Hoedekenskerke

Report a suspected account compromise promptly. We investigate security incidents and notify the competent authorities and affected people when applicable law requires it. No online service or personal device is completely risk-free.

8. Independent Service Disclaimer

TIKTOK Effect is an independent third-party tool and is not affiliated with, endorsed, or sponsored by TikTok, Bytedance Ltd., or their affiliates.

9. Mobile permissions and background operation

The current mobile app plays effects and speech; it does not request microphone access for recording or use camera, contacts or precise-location permissions for these functions. On supported Android builds, starting a background audio session may request notification permission and display a foreground-service notification. Foreground-only builds and browser previews cannot provide the same background behaviour. The operating system may limit or stop background execution.

You control permissions in system settings. Turning off notifications or background operation may prevent the relevant session from functioning. Permission to operate a feature is not permission to use your data for unrelated purposes.

10. Age and changes to this policy

The Service is intended for users aged 18 or older. If we learn that an account holder is under 18, we may restrict access and handle account-data deletion with appropriate verification and applicable legal exceptions. Public LIVE interaction records may concern viewers who are not Service account holders; they retain applicable data rights.

We update this page when data practices change and display the revision date. Material changes are communicated through the Service or another appropriate channel; any new processing requiring consent must obtain that consent before it starts.

11. TikTok identity reservations

We retain a pseudonymised hash of the verified TikTok OpenID, the OAuth environment and application identifier, the first-link date and, where applicable, a trial-start date. The reservation is associated with your Service account while that account exists. It is separate from OAuth credentials and is not anonymous merely because it is hashed.

Unlinking TikTok does not automatically remove this reservation. Deleting the Service account may leave the reservation without its former Service account identifier. The mechanism detects previous assignments and can prevent linking the same TikTok identity to a new Service account. Its purposes are preventing conflicting assignments and access abuse, including repeat trials if a paid offer is introduced. Current BETA access remains free.

We assess this processing under legitimate interests in account integrity and abuse prevention, subject to necessity, proportionality and your rights. You may object, request erasure or ask for human review of an incorrect assignment by contacting info@jkmedia.dev. We must explain any lawful reason for retaining a limited record. A reservation is not a justification for indefinite retention or for refusing a valid paid entitlement. An automated linking refusal can affect access; contact us for individual examination rather than creating further accounts.

12. Retention by purpose

Account settings and uploaded media are retained for the requested account functions; detailed LIVE records and viewer identifiers must be assessed separately from aggregate statistics. Security logs, administrative audit trails, correspondence and identity reservations have their own security, accountability or claims-related purposes. We do not assume that every category must be kept for the whole life of an account.

Retention criteria include the need for the requested feature or historical record, the end of the relevant account relationship, the resolution of a specific incident or complaint, applicable legal duties and limitation periods. After the relevant basis ends, data must be deleted or genuinely anonymised. Limited backups may follow a separate rotation cycle and must not become a means of routine continued use of deleted data. Contact us for the retention criteria and exceptions applicable to a specific record; this policy does not promise an unverified fixed backup or deletion period.

13. Newsletter preferences and connection providers

We store the selected newsletter preference, the time and version of the consent statement and changes to that preference. Newsletter delivery is not currently enabled. An account email is not permission to send marketing. If delivery is enabled, marketing will require the appropriate separate permission, an identified provider and an accessible withdrawal route; necessary account and security messages are distinct from marketing.

The LIVE connector can use connection services including Euler Stream to resolve room information or obtain a signed connection, depending on the configuration. This can involve the creator or room identifiers and technical request information needed for that connection; it is not a statement that the provider receives our entire account database. Provider terms, roles and transfer safeguards must correspond to the actual service used. OAuth flows also use necessary short-lived transaction-binding mechanisms, including cookies, separate from advertising tracking.

14. Viewer information and responsibilities

Public LIVE data is obtained indirectly from platform interactions. Creators decide which configured information is shown in their broadcasts; JK MEDIA remains responsible for its own processing purposes. Responsibilities for a particular operation depend on who actually determines its purposes and means, not solely on a label in these documents. Where we process on a creator's instructions, the applicable processor obligations and any required processing agreement apply.

Viewers do not need a Service account to contact us about their data. Creators should make the relevant audience information accessible and avoid unnecessary exposure of comments, identities or scores, particularly those of minors. An adult-only rule for Service accounts does not mean that every viewer is an adult. Recordings made by the creator, platform or audience may exist outside our systems; this does not remove our obligations for the records and disclosures for which we are responsible.