TokAllityPrivacy policy
1. Controller
For the TokAllity website and accounts, the controller of personal data is TokAllity, contact by email, email contact@tokallity.com.
This policy follows the Law on Personal Data Protection of Bosnia and Herzegovina (Official Gazette of BiH no. 12/25).
2. In short
The app runs on your computer. We (the provider) do not receive your settings, your viewers' data or your files. We only receive your TokAllity account data (section 3), because you cannot connect TikTok without signing in.
The website uses no cookies, no analytics and no ads.
3. Website and TokAllity account
The website is delivered by Cloudflare. On every visit Cloudflare technically processes your IP address, browser type and the requested address in order to deliver the site and protect it from attacks. The legal basis is our legitimate interest in website security. We do not use this data to track visitors.
If you email us, we process your address, name and message only to reply. We keep messages for up to 12 months unless the law requires longer.
TokAllity account: we process your email, password hash (not the password itself), Google ID if you sign in with Google, verified TikTok usernames with the verification time, and sessions (token hash, device type, time). Email, password hash and Google ID are kept while the account exists, TikTok names while the account exists or until you unlink them, and sessions for up to 30 days after last use.
We use your IP address to limit sign-in attempts and protect against attacks. Only its hash is stored and it is deleted within 24 hours.
Legal basis: contract (your account) and legitimate interest (security and attempt limits).
Processors: Cloudflare (server and database), Resend (sending email confirmation and password reset emails) and Google (only if you sign in with Google). Some of them process data outside BiH and the EU. That transfer is covered by standard contractual clauses.
You delete your account yourself at api.tokallity.com/delete (in the app: Account → Delete account). We then delete your email, password hash, sessions and verified TikTok names.
4. What the app stores on your computer
Settings, actions and events; a list of your LIVE viewers (username, nickname, profile picture address, points, level, number of gifts, likes and comments, first and last seen time); points history; summaries of past LIVEs; your sounds, images and videos.
Everything is in the %APPDATA%\tokallity\data folder on your computer. You delete it in the app (Setup → Reset points, or deleting a single viewer) or by deleting that folder.
5. Services the app connects to
TikTok: to read public events of your LIVE. TikTok's privacy policy applies.
Euler Stream (eulerstream.com): a service the connection library uses to sign the TikTok connection. It receives your TikTok username or room ID and technical connection parameters.
YouTube (Google): only if you use song requests. The app fetches the song title and plays it through youtube-nocookie.com.
Profile and gift images are loaded from TikTok's servers.
TTS voices are Windows voices and run on your computer. OBS, Minecraft and Streamer.bot connect only if you enable them, within your own network.
6. As a streamer you process viewer data
When you use the app, you process your viewers' data (usernames, comments, points) and you are the controller of that data.
Recommendation: say in your profile or on stream that comments may be read aloud and that points are tracked. Do not keep data longer than needed. If a viewer asks, export or delete their data (Points → Viewers).
7. Your rights
You have the right to access, rectify and erase your data, restrict processing, data portability and to object. Send requests to the email in section 1. We reply within 30 days.
You have the right to lodge a complaint with the Personal Data Protection Agency of Bosnia and Herzegovina (azlp.ba).
8. Security
The app's local server only accepts requests from your computer and rejects requests from other websites. OBS and Minecraft passwords are not shown in the interface and are not exported.
You only type your account password on our sign-in page; the app never sees it. The sign-in token on your computer is encrypted (Windows DPAPI).
9. Children
The app and the website are not intended for anyone under 18.
10. Changes
When we change this policy, we publish the new version with a new date in the app and on the website.