TikFoy. Back to TikFoy

Privacy policy

Last updated: 20 October 2026

This policy covers the TikFoy mobile app, tikfoy.app, and our related account and support services. Different features may be unavailable in a particular app version or region. Data described for an optional feature is processed when that feature is used or enabled.

1. Who is responsible

The controller responsible for TikFoy's processing of personal data is:

Haian Ibrahim, trading as Falcodes
Eschenburgstr. 33 D
23568 Lübeck
Germany
Email: [email protected]

Use that email for privacy questions and rights requests. Further business details are in our Impressum.

2. Data, purposes, and legal bases

Website visits and technical operation

Our hosting and security services process your IP address, request URL, request time, browser or app information, response status, and related technical logs. We use these to deliver pages and API responses, investigate faults, and protect against misuse. Necessary session and request-security cookies support session continuity and secure requests. Fonts and page assets are hosted with the site; the landing and legal pages do not embed analytics or advertising trackers.

The legal basis is our legitimate interest in operating and securing the service, Article 6(1)(f) GDPR, or performance of a contract where the request is needed to provide it, Article 6(1)(b). See our cookie and device-storage policy for storage details.

Account and authentication

Clerk handles account creation, sign-in, identity verification, and account security. Depending on your sign-in method and profile choices, it processes your email address, name or username, profile image, linked identity-provider information, authentication credentials, sessions, and security information. TikFoy's backend stores a Clerk user identifier, name, verified email address, account status, activity timestamps, and account administration information. We do not ask for or store your TikTok password.

We use account information to provide and secure your account, connect your orders and subscriptions, and answer support requests. The legal bases are performance of the account contract, Article 6(1)(b), and our legitimate interest in preventing unauthorized access and misuse, Article 6(1)(f). Information needed for a legal obligation is processed under Article 6(1)(c).

Google sign-in and Google user data

If you choose to sign in with Google, Clerk handles the sign-in connection for TikFoy. We request only these Google permissions:

  • openid: verify your Google identity using your Google account identifier.
  • email: receive your email address and its verification status.
  • profile: receive your basic profile information, such as your name and profile picture, where Google provides them.

We use this information to create or identify your TikFoy account, authenticate you, prevent unauthorized access, associate your orders and Pro access with your account, and respond to your support requests. TikFoy does not request access to your Gmail messages, Google Drive files, contacts, calendar, or YouTube account. We never receive your Google password.

Clerk processes the Google authorization response and linked identity information as our authentication provider. TikFoy's backend stores your Clerk user identifier, name, verified email address, and account records; the Google profile picture and linked Google identity can also appear in your Clerk-managed profile. Our backend does not retrieve Google OAuth access tokens to call other Google services.

Clerk and our hosting and security providers process the information needed to authenticate you and operate your account, as described in section 3. Authorized personnel can access necessary account information for administration or support. We do not sell Google user data, use it for advertising or AI model training, or send your Google profile, email address, or Google authorization tokens to TikTok order-fulfilment providers. Advertising and fulfilment do not require access to your Google account.

TikFoy does not provide AI image or video generation or editing. We do not use Google APIs or Google user data to create or distribute AI-generated non-consensual intimate imagery (AI NCII).

We protect account data with HTTPS for data in transit, application access controls, restricted administrative access, and restricted recovery backups. The production database is not exposed as a public database service. These safeguards reduce risk but do not make any online service risk-free.

The retention and deletion rules in sections 4 and 5 also apply to Google-derived account information. We keep it while your account is active and needed for the stated purposes, and complete verified deletion requests within 30 days or any shorter legally required period, subject to the stated legal exceptions. To request deletion from TikFoy and Clerk, email [email protected] or follow our account deletion instructions. Recovery backups expire within 30 days.

You can revoke Google's authorization through your Google Account connections. Revoking authorization stops the connection but does not itself delete information already held in your TikFoy account; use the deletion process for that request.

TikFoy's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We will update this policy and request any additional authorization before introducing a feature that needs further Google permissions.

TikTok targets and service orders

When you inspect a target or place an order, we process the TikTok username, profile or post URL, public profile or post information and images, selected service, requested quantity, timestamps, provider reference, status, and delivery results. We obtain this information from you and from public-target lookup and fulfilment services. We link the order to your TikFoy account and may record IP address and user-agent information for abuse prevention.

We use this data to check the target, send the requested service to a fulfilment provider, show progress, apply limits, and resolve disputes. The legal bases are contract performance, Article 6(1)(b), and legitimate interests in service integrity and fraud prevention, Article 6(1)(f). Only submit targets you own or are authorized to use. Publicly available target information may still be personal data.

Device integrity and abuse prevention

Security checks may process installation and device identifiers, public keys, device-attestation results, app version, platform, account-device associations, challenge responses, reward claims, and security decisions. Depending on platform and configuration, Google Play Integrity, Apple App Attest, or related device-check services can verify that requests come from a legitimate app and device. Network information may be stored as a time-limited keyed hash.

We use these checks to prevent automated misuse, repeated free-benefit claims, and forged requests. The legal basis is our legitimate interest in protecting the service and its users, Article 6(1)(f). Checks can automatically reject an order or restrict a feature; contact support if you believe a decision is wrong so it can be reviewed. We do not use these checks for decisions intended to have legal or similarly significant effects within Article 22 GDPR.

Support

We process messages, account and order references, reply timestamps, and screenshots you choose to attach to support tickets or emails. We use them to investigate requests, respond, and document their resolution, under Article 6(1)(b), or Article 6(1)(f) for general enquiries and establishing or defending claims. Please exclude passwords, payment details, and unrelated personal information from attachments.

Child safety and copyright reports can include the reporter's contact details, target URLs, account or order references, allegations, and our response records. We use the information needed to investigate misuse, protect people and rights, and handle legal claims under Article 6(1)(f), or Article 6(1)(c) when a legal obligation applies. Necessary information may be shared with competent authorities, relevant providers, or affected parties as required for the applicable process. The child safety standards and copyright policy explain reporting and notice handling. Do not send suspected child sexual abuse material; provide references and a written description.

Subscriptions

Apple or Google processes store payments. RevenueCat and TikFoy process an app-specific billing identifier, product and transaction references, purchase or receipt verification information, subscription state, expiry, refunds, and related events to supply and restore Pro access and prevent billing fraud. TikFoy does not receive your full payment-card information from store checkout.

The legal bases are contract performance, Article 6(1)(b), legal recordkeeping obligations, Article 6(1)(c), and legitimate interests in preventing fraud and resolving billing disputes, Article 6(1)(f). See our subscription terms.

Advertising

The app includes Google AdMob for ad-supported features, including rewarded ads. Google's SDK can process device and advertising identifiers, IP address, device and app information, ad interactions, and diagnostics. Reward verification links a reward claim and its outcome to your account and requested service. Ad requests currently specify non-personalized ads and use test ad units; non-personalized or test ads can still involve processing technical data.

Where consent is required for optional device storage or advertising processing, the legal basis is your consent under Article 6(1)(a) GDPR and the applicable device-storage rules. Necessary reward verification and fraud prevention rely on Article 6(1)(b) or (f). You can review available choices through Settings → Ad privacy choices in the app and your device's advertising settings. Withdrawing consent does not affect earlier lawful processing. We do not interpret account creation as advertising consent.

Notifications

When notifications are enabled, we process a push token, installation identifier, platform, app version, language or timezone where supplied, topic preferences, and notification delivery or interaction records. Google Firebase Cloud Messaging and, on Apple devices, Apple Push Notification service deliver notifications. We use this information for enabled account, order, support, or announcement updates.

The legal bases are contract performance for requested service updates, Article 6(1)(b), legitimate interests in delivering operational messages, Article 6(1)(f), and consent for optional promotional notifications where required, Article 6(1)(a). You can change topic preferences in TikFoy and revoke notification permission in device settings.

3. Recipients and international processing

Authorized personnel and service providers receive data needed for their roles. Our services include:

Providers can act as processors on our instructions or as separate controllers for their own activities, such as store payment administration. Their own privacy notices explain that processing. We may also disclose necessary records where legally required or to establish, exercise, or defend legal claims.

German VPS hosting does not mean all processing stays in Germany. Providers can process data in the United States and other countries outside the EEA. For transfers covered by GDPR, an applicable adequacy decision or appropriate safeguards, such as the European Commission's standard contractual clauses, are required unless a specific legal exception applies. Contact [email protected] for information about the safeguards applicable to your data and how to obtain a copy.

4. How long we keep data

We keep account, order, and support records while your account is active and the records are needed to provide the service, resolve requests, or meet legal obligations. We complete verified deletion requests within 30 days or any shorter legally required period, except where retention is legally justified. We do not keep records merely because storage is available.

Existing automatic cleanup includes these category-specific limits:

  • Support screenshots are eligible for deletion 90 days after a ticket is closed; message text follows the account/support retention rule above.
  • Notification history is eligible for cleanup after 90 days; stale notification devices are revoked after 60 days of inactivity.
  • Expired security challenges, sessions, and action proofs are eligible for cleanup after a further day; routine security decisions after 30 days and administrator security audit records after 180 days.
  • Network hashes expire after seven days. Order IP addresses and user-agent details are cleared after seven days once applicable cooldowns have ended.
  • Inactive security devices are eligible for cleanup after 90 days unless active security cases, restrictions, reservations, or unresolved orders require them.

Cleanup runs periodically, so expiry and physical deletion may not occur at the same instant. An account deletion request can require earlier removal of data than these routine limits. Security or legal exceptions are assessed for the particular records; they do not justify retaining an entire account indefinitely.

Rotating server backups are retained for no more than 30 days and are restricted to recovery use. Records subject to statutory tax or accounting retention are kept for the applicable legal period; records needed for a specific claim are kept while that need continues. We restrict their use and explain an applicable exception when responding to a deletion request.

5. Your choices and rights

Where the applicable conditions are met, you can request access, a copy of your data, correction, deletion, restriction, and data portability. You can withdraw consent at any time. You can object to processing based on legitimate interests for reasons relating to your situation, and object to direct marketing at any time.

To make a request, email [email protected]. We may verify your identity using proportionate information and normally respond within one month. If a lawful extension is needed, we explain it within that month. See our account and data deletion page for the email pathway, scope, and retention exceptions. A request does not require reinstalling the app.

You may complain to a data protection authority, including the authority where you live or work. Our local authority is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD).

Account identifiers and order targets are necessary for the corresponding features. If you do not provide them, we may be unable to create your account or fulfil an order. Optional screenshots, profile details, and notification permissions are not required just to view this website.

6. Children and younger users

TikFoy is not intended for children under 13. Users aged 13 or older still need any parent or guardian permission required by local law for a contract or consent-based processing. In Germany, the relevant GDPR age for a child's own consent to an information-society service is 16; other countries may apply different thresholds. We do not claim that a store age rating verifies a user's age or obtains parental consent.

If you believe a child has provided data without the required authorization, contact [email protected] so we can investigate and address it.

7. Changes to this policy

We update this policy when processing or legal requirements change. The date at the top identifies this version. We provide additional notice or seek fresh consent where required; a policy update alone does not authorize a new consent-based use of data.