Privacy Policy

This policy explains how TikTokAPI.io handles personal information about visitors to tiktokapi.io and about customers who use the console and the API. “We” means the operator of TikTokAPI.io.

Public TikTok content that customers retrieve through the API is a different matter, covered in Public TikTok data below.

Account details. Your email address and a password hash if you sign up with email, or the profile Google shares if you use Google sign-in (see Google sign-in). We also store what we create for you: API keys (as a one-way hash plus the last four characters), your credit balance and your settings.

Sign-up checks. The first time you open the dashboard, we record your IP address, approximate country, browser details, an anonymous identifier kept in your browser and the result of an automated bot check. We use them to decide whether a new account receives promotional credits and to spot people creating accounts in bulk.

Payments. Card and crypto payments are handled by our payment processors. We receive a confirmation with the amount, currency, status and the processor’s reference, and for cards a limited description such as the brand and last four digits. Full card numbers and security codes never reach us. For a crypto payment we also keep the deposit address, the currency, network and amount we asked for, and the payment status. Transfers on a public blockchain, including the address you send from, are visible to anyone; we use them only to match your payment.

API requests. For every call we log the endpoint, the time, the account and key used, the request parameters, the response status, the credits charged and the originating IP address. This is what lets us bill accurately, answer support questions, enforce rate limits and stop abuse.

Website visits. Our network provider processes your IP address, browser type and the pages you request in order to deliver the site and protect it from attacks. It also gives us aggregate page analytics (pages viewed, referring site, browser, country and load performance) through a small script that sets no cookies and does not follow you across other websites.

Messages. If you contact us, we keep your message, your email address and our reply.

If you choose Google sign-in, we ask Google only for the basic sign-in scopes: openid, email and profile. Google then shares your name, email address, profile picture and Google account identifier, and issues sign-in tokens. We store these with your account record. We do not request access to Gmail, Drive, Contacts or any other Google service, and we do not use the tokens to call Google on your behalf.

We use this information only to create your account, sign you in and contact you about the service. It is not sold, not used for advertising, not used to train AI or machine learning models, and not shared except with the service providers listed below. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke TikTokAPI.io’s access at any time from your Google Account’s third-party connections page. That does not delete your TikTokAPI.io account; email support@tiktokapi.io if you want that too.

• TikTok account credentials, session cookies, or user passwords.
• Advertising or analytics cookies on this website.
• Personal information bought from data brokers.

• To create your account, issue API keys and answer your API requests.
• To count usage, deduct credits, take payments and issue refunds.
• To keep the service secure: rate limiting, fraud and abuse detection, incident investigation.
• To answer support emails and warn you when something goes wrong with a payment or your account.
• To let you know about changes to pricing, these policies or the service.
• To keep the tax and accounting records the law asks for, and to act on breaches of our terms.

Where the EU or UK GDPR applies, we rely on the following legal bases: performing our contract with you, our legitimate interest in running a secure and reliable service, compliance with legal obligations and, where required, your consent.

We do not sell personal information and we do not share it with advertising networks. The following categories of service providers process it on our behalf, each only to the extent its job requires:

Outside that list, information is disclosed only if a court, regulator or police authority legally compels it, if it is needed to stop fraud or abuse aimed at customers or at TikTokAPI.io, or if the business changes hands, in which case the new owner must protect it at least as well as this policy does.

The public website sets no tracking cookies. Signing in sets a session cookie on api.tiktokapi.io; without it the dashboard cannot work. The dashboard also keeps an anonymous identifier in your browser’s local storage for the sign-up checks above, and a flag that you are signed in so the site header can link to your dashboard. The password-reset form and your first dashboard visit run an invisible bot check from our network provider, which may set a strictly necessary cookie of its own.

• Account details: for as long as your account is open, and deleted when you ask us to close it.
• Detailed request logs: for a limited period needed for billing questions, support and abuse investigations, then deleted.
• Payment and refund records: as long as tax and accounting rules require, including after an account is closed.
• Support conversations: until the issue is closed, plus a reasonable period in case it comes up again.

Responses from the API contain content anyone can already see on TikTok, such as public videos, comments and profiles, and some of it is personal information about the people who posted it. Which accounts and videos are fetched, and what happens to them afterwards, is the customer’s decision and the customer’s responsibility under our Terms of Service. People on TikTok who want to raise a question about their own public data can reach us at support@tiktokapi.io.

You can ask us to show you the personal information we hold about you, correct it, export it, delete it, or stop or restrict a particular use of it. Send the request to support@tiktokapi.io from your account email so we can verify it is really you. Payment records with a legal retention period survive deletion.

Residents of the EU, the UK and California, among other places, have additional statutory rights. Exercising any of them will never change the price or quality of service you get, and you can always lodge a complaint with your data protection regulator.

All traffic to the website and the API is encrypted with HTTPS, access to production systems is restricted, and we monitor for abuse. No system is completely secure; if a breach affects your personal information, you and the competent regulator will be told within the time limits the law sets. Treat API keys as secrets and rotate any key you suspect is exposed.

We and our providers process information in more than one country, which may not be the country you live in. Where the law requires it, we use appropriate safeguards such as standard contractual clauses for these transfers.

TikTokAPI.io is a developer tool, not a service for children, and accounts are not meant for anyone younger than 16. If we find out that one belongs to a child, it will be closed and its data erased.

This page is revised as TikTokAPI.io evolves; the “last updated” line shows the current version.