Legal

Privacy Policy

Effective 2 September 2026 · Last updated 7 September 2026

This policy explains what TokElements collects when you use the overlay service, why we need it, who else sees it and how long we keep it. We have written it to be read rather than skimmed past. If something is unclear, ask us and we will explain it.

1. The short version

• We ask for an email address and a password. We never ask for your TikTok password.
• To connect your channel we need only your public TikTok username.
• While you are live we process what happens in your broadcast, which includes information about your viewers.
• We do not sell data. We advertise this site on Google, and we measure which ads lead to a subscription; section 4a explains exactly what that involves. We also use one analytics product, Microsoft Clarity, which records how pages of this site are used; section 4 explains it and how to switch it off.
• Our servers are in Germany. We are a US company, so our own staff reach that data from the United States.
• We do not sell data, and we do not share it except with the providers listed in section 6.
• We offer the Service to people in the EU and the UK, so the GDPR and the UK GDPR apply to them and this policy is written to meet them.

2. What we process

Your account

Your email address, a display name if you set one, and your password. The password is not stored: we keep only an Argon2id hash of it, which cannot be turned back into the password. We also record when the account was created and changed.

Email we send you, and marketing

Two messages are part of the account itself: a link to confirm your address when you register, and a link to set a new password when you ask for one. Both work once and expire — 24 hours for a confirmation, one hour for a reset — and we store only a hash of the link, so our own database cannot be read to produce a working one.

Marketing email is separate and off unless you tick the box when you register. We record the choice and the moment you made it, so the answer to “did they agree, and when” is an actual record rather than an assumption. You can withdraw it at any time by writing to us, with effect for the future, and doing so changes nothing about your account. We do not sell or share your address, and account email is sent whether or not you take marketing.

Mailgun delivers these on our behalf and therefore sees your address and the contents of the message. It acts as our processor.

The bot check on sign-in and sign-up

Both forms carry Cloudflare Turnstile, which decides whether the request comes from a person without asking you to identify traffic lights. To do that it loads a small script from Cloudflare and looks at signals from your browser — how the page was interacted with, browser and device characteristics, and your IP address. It sets no advertising cookie and does not track you across other sites. Cloudflare already delivers this site, so it sees the request either way; the check is covered by our legitimate interest in stopping automated sign-ups and password guessing, Art. 6(1)(f).

Signing in with Google

If you choose “Continue with Google”, Google tells us three things about you: a permanent account identifier, your email address and whether Google has verified it, and the display name on your Google profile. We store the identifier and the email so we can recognise you next time, and the name only to fill in your display name. We receive no password, no contacts, no calendar and nothing else from your Google account, and we cannot act on your behalf there.

Google itself sees that you signed in to TokElements, and handles that under the Google Privacy Policy, as its own controller. An account created this way has no password stored at all. If you already had an account with the same address, signing in with Google attaches to it rather than creating a second one — Google having verified the address is what makes that safe.

Signing in

For each active session we store its expiry, the browser user agent and the IP address it was created from, so that you can be signed in and so that we can spot suspicious access. We keep a security log of sensitive actions, such as sign-ins and changes to your linked channel, with the IP address they came from.

Your linked TikTok channel

The public username you enter, the public profile picture belonging to it, and the time we last saw that channel live. We do not receive or store TikTok credentials, and we have no access to your TikTok account.

Activity during your broadcast

While your channel is live, we receive the events your overlay reacts to. For each event this can include the TikTok user identifier of the person, their display name, their public profile picture, and what they did: a gift and its coin value, a like, a follow, a share, a subscription, or the text of a chat message. We do not store these events. They are processed as they arrive, counted into a daily total per channel, and then dropped. What is kept is that daily total and per-viewer totals such as points, coins and level.

This is information about other people, and section 5 explains how responsibility for it is divided between you and us.

Your widgets, files and settings

The widgets you build or install and their settings, the state a widget saves so it survives a reload, your overlay layout, and any images, sounds or other files you upload to your asset library. Files you upload may contain whatever you put in them, so please do not upload personal data you do not need.

Spotify or SoundCloud, if you connect one

A music connection works through a userscript that you install in your own browser, for example with Tampermonkey. It runs on the web player while you are logged in there, reads what is currently playing, and sends that to us so a widget can show it. We never receive your login for either service, we hold no access tokens for them, and we cannot reach those accounts ourselves. What the script does is up to your browser, and you can remove it at any time.

What arrives here is the track title, the artist, the address of the cover image, the position and length of the track, whether it is playing, your upcoming queue if you turn that on, and whether the account is a paid one. None of it is written to our database. It is held in memory and expires by itself: the current track after 30 seconds, the marker that says your browser is still connected after 2 minutes, and the pairing code that ties that browser to your account after 60 days, or as soon as you disconnect.

Tokens for external tools

If you connect external software or an AI assistant, we store a name for the connection and a SHA-256 hash of the token. The token itself is shown to you once at creation and never stored, so we cannot recover it for you.

Payments

If you buy a paid plan, the payment is handled by our payment provider, who acts as merchant of record. They collect your billing details and card data directly; we never receive your full card number. We receive what we need to run the subscription: which plan you have, whether it is active, the billing period, an invoice reference and the country used for tax.

3. Why we are allowed to process it, and on what basis

Where we rely on consent you can withdraw it at any time with effect for the future, and where we rely on legitimate interest you can object as described in section 8.

4. What we do not do

We do not sell or rent personal data. We do not run advertising and we embed no advertising or social media trackers. We do not use your data to train machine learning models. We make no automated decisions with legal effect for you, and we do not build profiles to target you.

Google Ads measurement

We buy advertising on Google. When you arrive from one of those ads, the link carries a click identifier that Google generated (gclid, or gbraid/wbraidfrom an app campaign). It identifies the click, not you by name.

We keep that identifier in a first-party cookie called te_ref for up to 90 days, and if you then create an account we store it on the account together with the campaign name. If a subscription on that account is later paid for, we send Google Ads a line saying: this click identifier, this date, this amount, this currency. Nothing else goes with it — no name, no email address, no account identifier.

We do this to know which campaigns pay for themselves. We run no Google advertising script on this site, so Google receives nothing about your visit from us beyond the line described above, and only if a subscription was bought after clicking an ad. Clearing this site’s cookies removes the identifier, and blocking cookies for this site stops it being kept at all; every part of the Service works either way.

Microsoft Clarity

We use Microsoft Clarity, a product of Microsoft Corporation, to understand how this site is actually used — which buttons people look for, where a page loses them, and what breaks. We would rather name it plainly than describe it as “anonymous statistics”, because it does more than count visits.

Clarity records, for pages of this site that you open in a browser:

• A replay of the page. Mouse movement, scrolling, clicks, taps and rage-clicks are reconstructed into a session that we can play back. It is a redrawing of the page, not a video of your screen — nothing outside this site’s tab is captured.
• Heatmaps of where people click and how far down a page they read.
• Technical context: the pages you visited and in what order, referring URL, browser, operating system, device type and screen size, approximate location derived from your IP address, and your IP address itself, which Microsoft processes to produce that location and to detect bots.

What Clarity does not see. It masks text input by default: what you type into a form — your email address, your password, a widget you are writing — is not recorded. We have not turned that masking off. We do not send Clarity your account identifier, so a recording is not labelled with who you are, although a recording of a signed-in session can still contain content that identifies you, such as your channel name on screen.

Where Clarity does not run at all. Not on the overlay URL you paste into OBS (/overlay/…), so nothing about your broadcast or your viewers reaches Microsoft, and not in our own admin area. Clarity therefore never sees your viewers’ data — only the site you use to configure things.

Cookies it sets. Clarity stores identifiers in your browser, currently _clck and _clsk, to recognise a returning browser and to stitch a session together. These are analytics cookies, not strictly necessary ones. Microsoft is a separate controller for the data it receives and combines it with data from other Microsoft services in line with the Microsoft Privacy Statement, which also sets out how long Clarity keeps it. Microsoft is established in the United States; see section 10.

How to switch it off. Any of these stops Clarity for you: a browser setting or extension that blocks clarity.ms, a browser “do not track” or tracking-protection mode that covers it, or writing to us at [email protected] — under Art. 21 GDPR you can object to this processing, and we will act on it. We rely on legitimate interest here rather than asking for consent, and you can object at any time as described in section 8.

One more cookie, only for visits from an ad. te_ref holds the click identifier described in section 4a and expires after 90 days. A visit that did not come from an ad never gets it.

Our own cookies are two, both strictly necessary: te_session to keep you signed in and te_csrf to protect forms against cross-site request forgery. Neither is used to track you.

5. Your viewers

When your stream is live, information about the people watching it reaches us so that your widgets can react. For that data you are the controller and we act as your processor: we process it on your instructions, only to deliver the service, and we do not use it for our own purposes. Our Terms set out what you are responsible for.

A viewer who wants their data removed can write to the creator whose stream they were in, or to us at [email protected], and we will help the creator act on it. Viewer records are deleted with the creator's account, and event history is not stored at all, as set out in section 7.

The events themselves come from TikTok. What TikTok collects and shows publicly during a live broadcast is governed by TikTok's own privacy policy, not this one.

6. Who else processes it

We keep the list short on purpose. Each of these acts as a processor for us under a data processing agreement, except where noted.

Spotify and SoundCloud are deliberately not on this list. We send them nothing: the userscript in your own browser talks to them under your own session, so that connection is between you and them.

We disclose data beyond this only if we are legally required to, for example on a valid order from a public authority, or where it is necessary to establish or defend legal claims.

Assistants you connect yourself

You can connect an AI assistant — Claude, ChatGPT, or anything else that speaks the Model Context Protocol — to your TokElements account. Nothing happens until you do: you sign in here, you see which permissions are being asked for, and you approve them. A connection can be withdrawn from the same place at any time, and withdrawing it stops the access immediately.

While it is connected, the assistant can read and change the things you granted: your widgets and their code, your overlays and what is placed on them, and the names and URLs of files in your asset library. It cannot reach another account, and it cannot change anything shared with other creators. It cannot upload files — a widget that needs an image or a sound produces a link you open yourself. It has no access to your TikTok credentials, because we never hold any.

What travels to the assistant is what its tools return, and that is decided by the request you made: ask it to write a widget and it receives the widget it wrote back. Once that content is in a conversation it is handled by whoever runs that assistant, under their privacy policy, not ours. When a widget preview is rendered inside a conversation, the link that loads it is signed and unguessable and carries no session of yours.

We keep the connection itself: which client you authorised, the scopes you granted and when it was last used, so the studio can show you what has access. Revoking a connection deletes its tokens.

7. How long we keep things

Closing your account deletes your data on the schedule above. Backups roll over within 30 days, so a copy can persist that long before it is overwritten.

8. Your rights

Under the GDPR you can ask us to:

• tell you what we hold about you and give you a copy (Art. 15);
• correct anything inaccurate (Art. 16);
• delete your data (Art. 17);
• restrict how we use it (Art. 18);
• hand it to you or another provider in a machine-readable form (Art. 20);
• stop processing based on legitimate interest, on grounds relating to your situation (Art. 21).

Write to [email protected] from the address on your account and we will answer within one month. We may ask you to confirm who you are if there is genuine doubt.

If you are in the EU or the UK you can also complain to a supervisory authority, normally the one for the country where you live or work, or to our Art. 27 representative named at the top of this page. Residents of US states with privacy laws have the rights set out in section 11.

9. Security

Traffic is encrypted in transit with TLS. Passwords are stored as Argon2id hashes, and tokens for external tools are stored only as hashes. Databases and internal services are not reachable from the internet, and administrative access is limited to key-based logins. No system is perfectly secure, so if a breach ever creates a serious risk to you, we will tell you and the competent authority as the law requires.

10. International transfers

Your data is stored on servers in Germany. We are established in the United States, so our own staff access it from there, and some providers in section 6 operate globally. Microsoft Clarity is the one place where data leaves that setup by design: what Clarity collects goes to Microsoft in the United States. For people in the EU and the UK those accesses are transfers to a third country, and we rely on the European Commission's standard contractual clauses together with the additional safeguards described in section 9, or on an adequacy decision where one covers the recipient.

You can ask us for a copy of the safeguards that apply to a specific transfer.

11. Your rights if you live in the United States

Several US states, including California, Colorado, Connecticut, Texas and Virginia, give residents privacy rights. Where one of those laws covers you, you can ask us to tell you what categories of personal information we collected about you and why, to give you a copy, to correct it, and to delete it. You can also appeal if we turn a request down.

We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are used in California law, so there is nothing for you to opt out of. We do not use personal information for targeted advertising or for profiling that produces legal or similarly significant effects. We will not treat you differently for exercising a right.

Make a request by writing to [email protected] from the address on your account. An authorised agent may act for you if they can show your written permission.

12. Children

The Service is not meant for children under 16 and we do not knowingly create accounts for them. If you believe a child has given us personal data, write to us and we will delete it.

13. Changes to this policy

We update this policy when the Service or the law changes. The date at the top shows the current version. For changes that materially affect you we will tell you by email or in the studio before they take effect.

14. Who is responsible, and how to reach us

The controller for the data described in this policy is SMART CREATOR AI LLC, a limited liability company formed in Wyoming, United States, which operates TokElements. We will provide our postal address on request.

For any question about this policy, or to exercise a right in section 8 or section 11, write to [email protected].