Privacy

What we store about you

Your account is an email address, a display name, and a password we never see in the clear — it is hashed with bcrypt, which is one-way.

While you are signing up, or resetting a forgotten password, we also hold the six-digit code that confirms your address. It is hashed rather than stored as sent, it lives only in memory, and it is deleted the moment you use it or after fifteen minutes, whichever comes first.

To stop anyone guessing at an account or filling an inbox with codes, we count attempts — at signing up, logging in, resetting a password, creating games and testing them — against the address or account they are for, for an hour at most. The count is kept against a one-way hash, in memory, and then forgotten.

Your games are what you set up: the name, the TikTok handle you point them at, the settings you chose, and the overlay link.

If a game takes a picture — an army's badge, or a photo of you for the climber in Climb or Fall — it is shrunk to at most 256 pixels before it leaves your browser, kept with that game's settings, and shown on that game's overlay to anyone who has its link. Removing the picture, or deleting the game, deletes it.

We also keep a record of what happens on your account, to run, support and improve the service: signing up (including attempts that did not finish, and why), signing in, creating, changing and deleting games, switching them to test or live, each time your overlay link is opened and what opened it — OBS, the dashboard preview, the page you play a game from, or a browser — and whether your game's connection to TikTok worked. When you sign up we also keep where you first came from: the site that linked to us, the page you landed on, and any campaign tags on that link. Our mail provider also reports back whether each code was delivered, delayed, bounced or marked as spam, and we keep that against the address.

The first time you open your dashboard we ask, once and optionally, how you heard about us, with a short list of answers. We keep your answer, or that you skipped, on your account record, so we do not ask again on another device. It is used only to learn which of our channels bring people in, and it is seen only by us.

If you hold an OG Streamer spot (see the terms) we keep, on your account record, when you reserved it, when a live of yours confirmed it, and, if you give us one, the link to your post about TikGame and when you sent it. A person looks at that link to check it is a post about us, and it is used for nothing else. The card you can download is drawn in your browser: the handle you may type onto it is never sent to us. We send every host who holds a spot one email about OG Streamer closing, to the address on their account, and keep a note that we sent it.

If you buy a Pro game, or hold one some other way, we keep that on your account: which game, and how you came to have it — bought, through an OG Streamer spot, or because you had it set up before it became Pro. For a purchase we also keep the Paddle transaction id, the amount and currency you paid, the date you bought it and, if it was refunded, the date of the refund. We never see your card details; Paddle takes them. If a payment cannot be matched to an account, we keep its transaction id, amount and Paddle customer id so it can be sorted out by hand.

If you join the waitlist for All Access we keep the date you joined, against your account, so we can write to you when it opens. We also count presses of the Buy and All Access buttons, with where on the site they were pressed (and, for Buy, which game) and the visit id of that tab — the same one the page counter uses, forgotten when the tab closes. That count includes people who have no account; if you are signed in, we keep your account id with the press.

What we store about your viewers

When a game is connected to your TikTok LIVE we receive the public events of that live — the same ones anyone watching it sees: who joined, liked, commented, sent a gift, followed, shared or subscribed, with the TikTok account id, username and display name TikTok attaches, and what they wrote or sent. The game uses them to play, so each viewer's fighter is theirs and not somebody else's.

In Marathon Rush a new follower can be thanked out loud, by name. The voice is made on our own servers from the display name, cut down to a couple of plain words, and the sound is kept for a short while so that two screens showing the same game do not make it twice; no speech service outside TikGame ever receives the name. The host can leave the name out or switch the thanks off.

We also keep those events, together with how many people TikTok says were watching, so you and we can see what each live was like — viewers, likes, gifts, comments — and how that changes over time.

We never see anyone's TikTok password, and we cannot post, follow, or spend on anyone's behalf. We read the public stream of a live room, the same one anyone watching it receives.

What we do not do

We do not sell your data or your viewers'. We do not share it with advertisers or use it for advertising, and there is no tracking pixel or advertising script on this site.

Cookies and counting visits

We set one cookie, NEXT_LOCALE, and only when you choose a language with the language menu: it remembers that choice for a year and nothing else. Visiting a page that has a language in its address, such as /es, sets nothing. Your browser also keeps a sign-in token, a note that you dismissed the storage notice, and the page you first arrived from, which reaches us only if you sign up. Nothing here follows you anywhere else.

For the Pro games, two small notes stay in your browser. If you press Buy or All Access before you have an account, tikgame.pro-intent in session storage remembers what you pressed so the dashboard can carry on after you sign up; it is acted on once, within an hour, and goes when the tab closes. And tikgame.pro-launch.1 in local storage remembers that you dismissed the note on your dashboard about which games are Pro.

To pick a language when you have not chosen one we read the language your browser asks for and, if a service in front of our servers supplies it, the country your connection comes from. Neither is stored, and your IP address is not sent to any other service for it.

We count visits ourselves, without any third party. A visit gets an id that lives in that browser tab only and is forgotten when the tab closes, and we record the pages viewed, the site that linked to us, campaign tags on the link, the kind of device and browser, and the language it asks for — never an IP address, and nothing that ties one visit to the next. A browser set to Do Not Track or Global Privacy Control is not counted at all.

Who else is involved

The service runs on servers we rent in Europe. Connecting to a TikTok live room needs a signed handshake, which we obtain through a third party signing service; it receives the room identifier, never anything about you. Email — the code that confirms your address or resets your password — is sent through our mail provider. If you ask for a signup code and never use it, we send one reminder about a day later and no more; it contains nothing but a link to start again. We also send one email, once, to every host who holds an OG Streamer spot, to tell them OG Streamer has closed; it goes through the same mail provider, and it is not sent to anyone else.

Pro games are sold through Paddle (Paddle.com), which is the merchant of record: it takes your payment, and it handles the card details, tax, receipt and any refund. It processes what you enter at checkout — your email address, billing country and payment details — and which game you are buying. Its checkout is loaded from Paddle's own servers when you press Buy and opens over our page; it carries your account's email address and its account id, so that the payment comes back to the right account. It tells us the transaction, the amount and currency and any refund; it never gives us your card. What it keeps is covered by its own privacy policy.

Getting rid of it

Deleting a game deletes it and its overlay link; the record of what it did stays, without the game. We keep the record for as long as the service runs, unless you ask us to delete it. To delete your account and everything attached to it — including that record and the events of your lives — use Delete account on your profile page: it asks for your password and then deletes all of it at once, for good. We keep only a note that an account was deleted, with nothing in it about whose. If you cannot sign in, write to contact@tikgame.io and we will do it for you — we aim to within seven days. You can ask us what we hold about you at the same address, and so can a viewer who wants their events removed. Deleting your account also deletes our record of the Pro games you bought. Paddle keeps its own records of your purchases as merchant of record, under its own privacy policy, and deleting your account here does not remove those.

Changes

If this page changes in a way that matters, we will say so on the site rather than quietly editing the date at the top.