Privacy Policy

This Privacy Policy explains what personal data TikPro collects, why we use it, who we share it with, how long we keep it and what your rights are. It applies to the TikPro app and to our web pages (legal pages and forms). Please also read our Terms of Use.

1. Who the controller is

The controller of your personal data is the operator of TikPro: MOBI TICKET SERVIÇOS DE TELEINFORMÁTICA E CONSULTORIA LTDA, CNPJ [TO BE CONFIRMED], with its address at [TO BE CONFIRMED: address], Brazil.

Data Protection Officer (DPO, "encarregado"): [TO BE CONFIRMED: DPO name], at privacidade@tikproapp.com.

2. Data we collect

2.1 Account data

• name and email address;
• password, stored only as a hash (we never have access to the password itself);
• your Google or Apple account identifier, when you sign in with them, and the link to your Google profile photo, when you sign in with Google;
• app language and time zone;
• the date and version of the Terms of Use you accepted;
• email verification status;
• your notification preferences (download and editor notifications, weekly summary);
• if the account is suspended for breaking the Terms of Use: the date, the reason and our internal notes.

If you use Apple's "Hide My Email", we only receive the relay address created by Apple.

2.2 Device and app data

Platform (operating system), app version, the device name given to the session (for example, "iPhone 15 Pro Max"), language and time zone, as well as the IP address and user agent of the requests made to our servers.

2.3 Access records

As required by Brazil's Marco Civil da Internet (Lei nº 12.965/2014, art. 15), we keep the IP address and the date and time of sign-ups, sign-ins and the first use of the app from each IP address each day. These records are kept for 6 months, under confidentiality, and then deleted. We only provide them under a court order or a legal obligation.

2.4 Usage data

• Links you submit: used to fetch the public post. We do not keep them as a personal history unless you save, bookmark or edit the post.
• Download history: which post, the kind (video, photo, audio, repost or preview), the quality and the date.
• Edits: the settings of each edited video (trim, filters, stickers, speed and volume).
• Quota counters for the free plan.
• Bookmarks, folders, hashtag sets and the public TikTok profiles you track.

2.5 Public data about third parties

For Analytics, we periodically collect the public counters of the TikTok profiles that users choose to track: followers, likes, number of videos and the sum of plays, comments and shares of the last 30 videos. We also keep public metadata of the posts we process: caption, author name, handle and avatar, and counters.

We process this data on the basis of legitimate interest, and it is already public. If you own a profile and want us to stop tracking it or to delete this data, write to privacidade@tikproapp.com.

2.6 Support, reports and notices

• support tickets, feedback, ratings and content reports, with the messages sent and the reply email;
• technical device information sent with them: model, OS version, app version, language, time zone and user agent;
• copyright notices sent through the web form: name, email, organization, the URLs and descriptions provided, the statements ticked and the IP address.

2.7 Purchases

We receive your subscription status from RevenueCat: product, store, period type (including free trial), expiry date, renewal state and purchase events. We never receive your card or payment details: they stay with the app store (Apple).

2.8 No ads and no tracking

TikPro shows no ads. We do not use advertising SDKs, we do not collect the device advertising identifier (IDFA) and we do not track you across apps and websites of other companies. If we ever introduce ads, we will announce it in the app and publish an updated version of this Policy before they appear.

2.9 Error diagnostics

Our servers send technical error reports to Sentry without personal data by default: tokens, passwords, codes and cookies are removed before sending.

2.10 Push notifications

If you allow notifications, the app registers your device with Firebase Cloud Messaging (FCM), a Google service, and sends us the device's notification token, the platform and the app version. We store the token linked to your account and to the session of that device, and use it only to tell you that a download or an edited video is ready (or could not be finished) and, once a week, to send a summary of the profiles you track in Analytics. To reach your phone, the title and text of each notification pass through Google (FCM) and, on iPhone, through Apple (Apple Push Notification service).

The token is deleted when you sign out on that device, when the session expires (90 days), when you delete your account, when you turn notifications off in your phone's settings, or when FCM tells us the token is no longer valid. You can turn off each kind of notification in the app settings, or all of them in your phone's settings.

3. What we do not collect

• Photos: we only ask for permission to save files to your gallery (on iOS, "add only" access). We do not read your photo library.
• We do not collect precise location, contacts, microphone or camera data, or the device advertising identifier.
• Cookies: the app does not use cookies. Our web pages (legal pages and forms) do not use cookies either; only the internal admin panel uses a session cookie.

4. How we use your data

• Provide the Service: create and maintain your account, process downloads and edits, keep your Bookmarks, hashtag sets and tracked profiles, and build Analytics.
• Plans and subscriptions: apply the free plan limits and unlock Pro features.
• Security: prevent fraud, abuse and automated use, and rate-limit requests.
• Support and moderation: answer your requests, handle content reports and copyright notices, and suspend accounts that break the Terms of Use (for example, after repeated copyright notices).
• Legal obligations: for example, keeping access records and meeting tax obligations.
• Service emails: verification codes, confirmation codes for sensitive actions (deleting your account or adding a password to an account created with Google or Apple), notices about your account (password changes, suspension) and support answers. We do not send marketing emails.
• Notifications: tell you when a download or an edited video is ready and send the weekly Analytics summary, as you choose in the app settings.
• Product improvement: use aggregated statistics. For example, Trendy ranks posts by the number of distinct users who downloaded them, without identifying anyone.

5. Legal bases

5.1 Brazil (LGPD)

We process personal data under Brazil's General Data Protection Law (Lei nº 13.709/2018), art. 7:

5.2 Angola

In Angola, processing follows Lei n.º 22/11, de 17 de Junho (Personal Data Protection Law), based on the performance of the contract (providing the Service), compliance with legal obligations (for example, access records and tax obligations) and legitimate interest (security, abuse prevention, analytics of public profiles and improvement of the Service). The processing may be subject to notification to, or authorization by, Angola's Data Protection Agency (Agência de Protecção de Dados, APD) [TO BE CONFIRMED: notification/authorization with the APD].

6. Who we share data with

We only share data with the providers and partners below, to the extent needed for each function. Some act as our processors; others, such as Apple and Google, also process data as independent controllers under their own privacy policies.

In addition:

• Source platforms: when you paste a link, our servers request the public post from that platform. The platform sees our server, not you.
• Authorities: we share data when the law requires it, for example under a court order.

We do not sell your personal data.

7. International data transfers

Your data leaves Angola and Brazil and is processed in the European Union (where our servers are) and in the United States (where some providers are). To protect it, we use:

• contractual clauses and data processing agreements with our providers;
• encryption in transit (HTTPS) and at rest, where the provider offers it;
• private file storage, accessible only through signed links that expire after 30 minutes.

These transfers follow article 33 of the LGPD and the transfer rules of the Angolan law [TO BE CONFIRMED: transfer mechanism / APD authorization].

8. How long we keep data

9. Account deletion

You can delete your account in the app (settings icon → My account → Delete account) or through the form on the Delete account page, even without the app. When you do:

• your personal data is anonymized at once, and all sessions are ended;
• the account and its related data are permanently deleted, normally within minutes and at most within 30 days;
• access granted through Sign in with Apple is revoked;
• your customer record at RevenueCat is deleted;
• access records remain stored for the 6 months required by law.

Deleting your account does not cancel your subscription in the App Store. Cancel it in the store first, as explained in the Terms of Use.

10. Your rights

10.1 Brazil (LGPD, art. 18)

You have the right to:

• confirmation that we process your data;
• access to your data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data;
• data portability;
• deletion of data processed on the basis of consent;
• information about the entities we share data with;
• information about the possibility of not giving consent and the consequences of refusing;
• withdrawal of consent;
• review of automated decisions (TikPro makes no automated decisions with legal effects on you);
• lodging a petition with Brazil's National Data Protection Authority (ANPD).

10.2 Angola

Under Lei n.º 22/11, you have the rights of information, access, rectification, erasure and objection to processing, as well as the right to lodge a complaint with the Data Protection Agency (APD).

10.3 How to exercise your rights

• In the app: edit your profile and language, delete bookmarks, hashtag sets and tracked profiles, or delete your account.
• By email: write to privacidade@tikproapp.com from your account's email address.

We may verify your identity before handling the request. We answer within 15 days (LGPD) or within the deadline set by the applicable law.

11. Security

We use technical and organizational measures to protect your data, including:

• connections protected by HTTPS;
• passwords stored only as hashes, and one-time codes also stored as hashes;
• sensitive actions (deleting the account, adding a password) ask for your password, a code sent to your email or a new Sign in with Apple, so a stolen session alone cannot do them;
• rate limiting to prevent abuse;
• private file storage, with signed links that expire after 30 minutes;
• platform cookies and secret keys stored encrypted;
• administrative access with two-factor authentication and least privilege.

No system is completely secure. If a security incident occurs, we will notify the authorities and the affected users when the law requires it.

12. Children

TikPro is not directed to people under 18 [TO BE CONFIRMED: minimum age], and we do not knowingly collect their data. If we learn that an account belongs to a minor, we will delete it. Parents and guardians can contact us at privacidade@tikproapp.com.

13. Changes to this Policy

We may update this Policy. When we do, we will publish the new version with its date. Significant changes will also be announced in the app.

14. Contact

For privacy questions or to exercise your rights, contact our Data Protection Officer at privacidade@tikproapp.com. For other questions about the app, write to suporte@tikproapp.com.