Privacy Policy

1. Who is responsible for your data

Effective date: 29 September 2026. This Policy explains how your information is used by the controller, the individual resident in France who runs Katchik. The controller's email is privacy@katchik.com.

There is no company. In this Policy, "Katchik", "we" and "us" mean this person. This notice covers members, people entering through the web form and support contacts.

UK residents can contact us directly at privacy@katchik.com.

2. Information we collect and what you need to provide

• Account: your email address, your password stored only as an Argon2id hash, and the display name you choose. Email and password are needed for an account.
• TikTok identity: open_id, union_id, username, display name and avatar URL.
• Linking record: a keyed hash of your TikTok open_id, so the linking credit is earned only once per TikTok account. It is kept after you disconnect TikTok, and for 12 months after your Katchik account is erased.
• TikTok statistics: follower, following, likes and video counts, with periodic snapshots.
• TikTok connection: granted permissions, access and refresh tokens stored encrypted on the server only, and deauthorisation events.
• Missions: your own public videos' captions, covers, links and counts. These are read to assess campaign hashtags or mentions and mission completion.
• Follow checks: if you are selected, whether your TikTok account follows the round's featured creator and @katchikapp. We check this on TikTok, against the follower lists of those two accounts; for @katchikapp that is Katchik's own account. Free web entries are not checked.
• Participation: entries, points, tickets and round history.
• Invites: your invite code, who invited whom, and whether the invited player has joined a first round, which is shown to the inviter.
• Public round records: list fingerprints, the beacon round and the accepted winner's TikTok handle and profile photo. We never publish another entrant's name.
• Web entry: round, full name, country, email address, TikTok username, age confirmation, rules acceptance and email confirmation. These fields are needed to process and verify this route. We do not require a follow or an app account for entry.
• Prize claims: only the delivery details that the specific prize needs.
• Candidate checks: if you are selected, the proof of age and country you send us; we delete it once checked.
• Support: the emails and information you send to support@katchik.com or privacy@katchik.com.
• Security: IP addresses and request IDs used for rate limiting and fraud prevention.

TikTok data is required for the linked app features you choose to use, including app entry and statistic-based points. The mission-video permission is needed to verify a mission through the API, not for the web-entry form.

We obtain account and web-form information and a candidate's proof of age and country from you, TikTok information from TikTok after you authorise it, and follow-check results from TikTok if you are selected. Support information comes from your correspondence. Security information is generated when you use the service.

The website sets no analytics or tracking cookies.

3. Why we use information and our lawful bases

• Provide your account and requested app features: account information, the necessary TikTok connection, participation records and invites are used to perform our contract with you under Article 6(1)(b).
• Process entries and provide prizes: entry details, ticket allocations, eligibility checks including the follow checks at selection, candidate contact and necessary prize-claim details are used to perform the round contract under Article 6(1)(b).
• Calculate points and verify missions: the requested public-stat and public-video data are used to perform those programme features under Article 6(1)(b).
• Protect the service and investigate abuse: security logs, the linking record, proportionate entry checks and necessary support evidence are used for our legitimate interests in preventing fraud, duplicate entries, a second linking credit and technical abuse under Article 6(1)(f).
• Maintain verifiable round records: necessary proof records are used for our legitimate interests in demonstrating fair administration and resolving disputes under Article 6(1)(f).
• Publish the accepted winner's handle and profile photo: we ask for the winner's specific consent under Article 6(1)(a) before publication.
• Keep legally required records: any legally reportable prize records are kept under Article 6(1)(c), only where an identified legal obligation applies.
• Answer support requests: we use your emails to perform an existing contract where the request concerns that contract. For other enquiries, our basis is our legitimate interest in answering and resolving the enquiry under Article 6(1)(f).

These bases refer to the EU GDPR and the corresponding UK GDPR provisions. The two regimes are not identical, including their automated-decision rules. Consent to an optional feature is separate from acceptance of rules or a platform permission screen; your rights and our information duties still apply.

4. TikTok connection and data

Your Katchik account uses email and password. TikTok Login Kit links a TikTok account afterwards; it is not a Katchik sign-in method. We request the permissions needed for the data described above and show them in the authorisation flow.

We read your profile identifiers, public account statistics and, for missions, your own public video information. We use these data to identify the linked account, calculate points, verify missions and administer the features you request. We do not sell TikTok data or use it to target sponsored cards or any other advertising.

TikTok data is stored server-side in our API and database, in the United States (Railway, US East region, Virginia). Access and refresh tokens are encrypted on the server and never stored in the app.

Disconnecting TikTok revokes the token at TikTok and purges the TikTok data we hold, except the linking record. On deauthorisation, we stop access and purge the data when the event is received; TikTok has already revoked the access token at that point.

The optional 30-day account-deletion cancellation window does not delay a TikTok-disconnection purge. We do not keep TikTok information to meet a legal obligation unless that obligation is specifically identified and allowed by TikTok's terms.

TikTok is a separate controller and data source, not our processor. Its own policies govern its services and the information you give it directly.

5. Information sharing and disclosure

We share only information needed for the purposes stated in this Policy. A brand does not receive the participant list because it supplies a prize or has a sponsored card in the app, and a sponsored card gives its brand no access to players' personal data.

Publication with your consent. Only an accepted winner's TikTok handle and profile photo are published as personal information in the public round record. We obtain the publication consent described above before doing so. Other entrants' names, emails and handles are not published. The public proof also contains the list fingerprint and the beacon round.

Service providers and platform recipients. We use these service providers:

• Railway Corporation: API and database hosting.
• Cloudflare, Inc.: website hosting, DNS, forwarding of emails sent to support@katchik.com and privacy@katchik.com, and access control for our admin tools.
• Resend: transactional emails, such as password-reset and deletion links.
• Sentry (Functional Software, Inc.): error reports, without IP addresses, request bodies or stored values.

These providers process service data on our instructions under their data processing agreements. Prize delivery details go only to whoever sends the prize, Katchik or the prize provider, only to send it, and are deleted 90 days after delivery.

Legal requirements. We disclose information where a specific legal obligation requires it, or where a necessary and proportionate disclosure is justified to establish or defend legal claims. We assess each request and disclose only what is needed.

6. International transfers

Our providers process information outside the European Economic Area and the United Kingdom, mainly in the United States. For each one, the place of processing and the safeguard we rely on are:

• Railway Corporation (USA): API and database hosting in the US East region (Virginia). Safeguards: the EU-US Data Privacy Framework with its UK Extension, and the Standard Contractual Clauses with the UK Addendum in its data processing agreement.
• Cloudflare, Inc. (USA): website hosting, DNS, forwarding of emails sent to support@katchik.com and privacy@katchik.com, and access control for our admin tools. Safeguards: the Data Privacy Framework and the Standard Contractual Clauses.
• Resend (USA): transactional emails (password reset, deletion links). Safeguards: the Data Privacy Framework and the Standard Contractual Clauses.
• Sentry (Functional Software, Inc., USA): error reports stored in its EU region (Frankfurt), without IP addresses, request bodies or stored values; some account metadata stays in the US. Safeguards: the Data Privacy Framework where certified, otherwise the Standard Contractual Clauses.

Choosing a European region does not remove every international transfer, which is why each provider above carries a safeguard. You can ask for a copy or an explanation of these safeguards at privacy@katchik.com, with confidential information protected where necessary.

7. How long we keep information

We keep information only for its stated purpose and for as long as the law requires:

• Account data: while the account exists; erased 30 days after a confirmed deletion request, unless a valid earlier erasure request applies.
• TikTok identifiers, profile and permissions: while connected; purged at disconnection or deauthorisation.
• Linking record (keyed hash of your TikTok open_id): kept after you disconnect TikTok, and for 12 months after your Katchik account is erased; then deleted.
• TikTok access and refresh tokens: while connected; a replaced token is deleted when it is replaced.
• Statistics snapshots: 90 days, or sooner at disconnection, deauthorisation or account erasure.
• Mission evidence (captions, covers, links, counts and the outcome): 12 months after verification, or sooner at disconnection, deauthorisation or account erasure.
• Deauthorisation events: 90 days.
• Entries, points, tickets and round history: while the account exists.
• Invite links between accounts: while both accounts exist; removed when either is erased.
• Free-entry form data: 12 months after the round closes.
• Proof of age and country from a candidate: deleted once checked, including any copy sent by email; only the result of the check is kept with the round history.
• Public list fingerprints and beacon records: as long as the round's public record exists. They hold no name.
• Public winner handle and photo: as long as the round's public record exists; replaced by "a player" at account deletion or on request.
• Support emails: 2 years after the last message.
• Security logs with IP addresses and request IDs: up to 30 days.
• Backups: none are kept during the closed beta. Once backups are enabled, daily copies are kept 6 days and weekly copies 27 days, so deleted data leaves backups within 30 days.
• Password-reset and deletion links: a password-reset link lasts 1 hour and a deletion link 24 hours; expired links are deleted daily.
• Prize delivery details: 90 days after delivery.

If a particular legal obligation requires keeping a limited record beyond ordinary deletion, we isolate it, restrict its use and tell you the category, the reason and the period.

8. Automated scoring and selection

App points depend on linking TikTok, capped public TikTok statistics, completed missions and invites. The formula, caps and each mission's and invite's points are published for each round. Each point held at close is one ticket, every eligible entrant has at least one ticket, and the Official rules explain how a free entry's tickets are counted.

The system seals the entry list and uses public drand quicknet randomness to produce a deterministic ticket-weighted selection. Its practical effect is to set the order in which candidates are considered. A candidate must still accept within 48 hours and pass the stated checks, including the follow checks, before becoming the winner.

If a check fails, we tell you which one, and you have 24 hours to show us it is wrong; a person reviews what you send before we move to the next candidate. You can also challenge incorrect data or eligibility treatment at privacy@katchik.com.

For UK residents, UK GDPR Articles 22A to 22D apply: you can ask for information about such a decision, make representations, obtain human intervention and contest the decision.

9. Security

Passwords are hashed with Argon2id, every connection uses HTTPS, sign-in tokens expire after 15 minutes and are rotated, a replayed token revokes its whole session family, our admin tools sit behind Cloudflare Access, and error reports exclude IP addresses, request bodies and stored values. TikTok access and refresh tokens are encrypted and held on the server only.

No security measure can promise that an incident will never occur.

10. Links to other websites

TikTok applies its own privacy notice to its services. Following an external link does not mean that the service behind it acts as Katchik's processor.

Only TikTok is connected for social-platform data. We do not request data from other social accounts.

11. Children's privacy

Katchik accounts and entries are for people aged 18 or older. Contact us if you believe someone under 18 has created an account or entered a round, so we can investigate and take appropriate action.

12. Deleting personal information

Request account deletion at katchik.com/delete-account through an emailed link. You have 30 days to cancel that request. After the window, account data, points, missions, round history and the TikTok connection are erased; the linking record is kept for 12 months after erasure, so a new account cannot earn the linking credit again for the same TikTok account.

Published proofs keep fingerprints only, without personal account links, and a winner's handle and photo are replaced by "a player". Legally required records, if any, are handled as described under retention, not kept as an active app profile.

Disconnecting TikTok revokes the token at TikTok and purges our TikTok data, except the linking record, without waiting for account deletion. Deauthorisation triggers the same purge when we receive the event. Disconnecting does not erase your TikTok account.

If you entered on the web without a Katchik account, email privacy@katchik.com to request erasure or to use another right. You may also ask for earlier erasure rather than wait for the optional cancellation window.

13. Your rights

Depending on the processing and applicable law, you can request access, correction, erasure, restriction and portability. You can object to processing based on legitimate interests and withdraw consent at any time, without affecting the lawfulness of earlier consent-based processing.

Use the account and connection tools, katchik.com/delete-account, or email privacy@katchik.com. We may ask for proportionate information to confirm your identity. Requests are generally answered within one month; if the law allows us longer, we tell you why.

You can complain to the CNIL, the UK ICO, or the supervisory authority where you live or work or where an alleged infringement occurred. Contacting us first can help resolve an issue, but does not remove your right to complain.

14. Changes to this Privacy Policy

We date each new version and explain material changes by email and with a notice in the app before the change applies. A new notice does not by itself authorise a new use of data or replace consent where consent is required.

Before any round checks entries against a featured creator's follower list, and before we send push notifications, we will update this Policy.

15. Contact us

Contact the controller at privacy@katchik.com. For anything that is not about personal data, write to support@katchik.com. See also the Terms of Service, the Official rules and the legal notice.