Privacy & Data Protection

Privacy Policy

Effective Date: September 28, 2026 · Last Updated: October 5, 2026 · Compliant with GDPR, UK GDPR, CCPA / CPRA

1. Information We Collect

TikRSS collects only the information strictly necessary to provide customized, high-signal briefings:

Account Identifiers: Your email address for passwordless Magic Link authentication, account administration, and daily briefing delivery.
Subscription & Channel Selections: Public creator handles, YouTube channels, TikTok profiles, Bilibili accounts, and podcast RSS feeds you choose to follow.
Custom Prompt Lenses & Delivery Preferences: Scheduled briefing delivery time (e.g. 07:00), local timezone, preferred summary language (original vs translated bilingual summary), and custom analytical prompt lenses.
Third-Party Integration Tokens: Encrypted OAuth access tokens if you connect Notion, or your Telegram user identifier if you activate real-time notifications via @TikRssBot.
Payment & Billing Records: Credit card and billing details are processed directly by our PCI-DSS Level 1 certified processor, Stripe. TikRSS never stores your raw card numbers or CVV codes.

2. Legal Bases for Processing (GDPR Article 6)

We process personal data under transparent legal bases:

Contractual Performance (Art. 6(1)(b)): To operate your account, extract transcripts, generate executive AI briefings, deliver morning emails, and synchronize notes to your connected Notion and Obsidian workspaces.
Legitimate Interests (Art. 6(1)(f)): To safeguard infrastructure against abuse, enforce rate limits, and maintain high-performance global delivery.
Legal Obligations (Art. 6(1)(c)): To maintain financial transaction records, comply with tax laws, and respond to statutory takedown notices.

3. Third-Party Sub-processors & Safeguards

To maintain reliable, enterprise-grade availability, TikRSS partners with trusted infrastructure providers. Each sub-processor is bound by strict Data Processing Addendums (DPAs) and robust technical controls:

Sub-processorRole & Data InvolvedTransfer Safeguard

Supabase Inc. (USA)Primary cloud PostgreSQL database, auth sessions, encrypted user tokensEU Standard Contractual Clauses (SCCs)

Cloudflare Inc. (Global)Edge Workers, Email Routing (tikrss.com), SSL/TLS, and DDoS mitigationEU Standard Contractual Clauses (SCCs)

Stripe Inc. (USA)Subscription processing, customer billing portal, and affiliate commission payoutsPCI-DSS Level 1 & DPF Certified

Resend Inc. (USA)Transactional emails and scheduled daily executive morning briefingsEU Standard Contractual Clauses (SCCs)

AI Model Providers (USA / Global)LLM inference (OpenRouter, DeepSeek, Google Gemini, Groq) for transcript summarizationZero Data Retention (ZDR) Enterprise API Terms

4. Data Retention & 30-Day Erasure Grace Period (GDPR Art. 17)

You may request permanent deletion of your account at any time via Account Settings. To protect against accidental loss of your curated research archive, we implement a transparent 30-day soft deletion grace period:

Upon requesting deletion, all feed polling and email dispatches cease immediately.
You may restore your account within 30 calendar days simply by logging back in.
After 30 days, automated maintenance tasks permanently purge your profile, feed subscriptions, personal tokens, and custom lenses from our databases.

5. Your Privacy Rights (GDPR & CCPA / CPRA)

Depending on your location, you hold the following statutory rights:

Right of Access & Portability: Export your followed creator feeds and briefing archives into standard Markdown and JSON formats.
Right to Rectification: Update delivery email, notification schedules, or prompt lenses directly from your user dashboard.
Right to Erasure (“Right to be Forgotten”): Initiate complete account and data deletion at any time.
California Consumer Privacy Act (CCPA) Notice: TikRSS never sells or shares your personal data or reading habits with third parties for cross-context behavioral advertising.

6. Children's Privacy

TikRSS is strictly intended for individuals who are at least 13 years of age (or 16 years of age for residents of the European Economic Area). We do not knowingly collect or solicit personal information from minors.

7. Contact Our Privacy Office

To exercise your privacy rights, request an export, or submit a data inquiry:

Email: legal@tikrss.com / support@tikrss.com