Privacy Policy

This policy explains how A.B. DIGITAL HORIZON SYNDICATE LIMITED (HE 451879), Archiepiskopou Makariou III, 95, CHARITINI BUILDING, Floor 1, Flat 102, 1071 Nicosia, Cyprus (“we”, “the Company”) handles personal data for TT Stats and https://ttstats.app.

We collect only what is needed to run accounts, licences, and the website. Overlay math runs in your browser. We do not sell personal data.

Controller contact: privacy@ttstats.app.

1. Data the Chrome extension processes

Chrome Web Store listing URL for this extension: https://ttstats.app/chrome-privacy.

• Local metrics: public video counts already on the page (views, likes, comments, shares, saves, dates) are read in-memory to compute engagement rate, median multiples, views/day, and a results summary for that grid. That feed is not stored on our servers.
• No TikTok account access: we do not read TikTok passwords, cookies, DMs, or payment details.
• No general browsing history: the extension does not run on sites other than TikTok web, except our own website for licence delivery.
• Offline licence check: the service worker verifies a signed token with public-key cryptography (ECDSA P-256). It does not ping us on every page view.

2. Account data

When you register or sign in on https://ttstats.app we process:

• Google Sign-In: email, name, and Google account id, via OAuth 2.0. Scopes are limited to sign-in. We do not request Gmail, Drive, or Contacts.
• Email sign-in: email address, verification codes / magic links, and a password hashed with PBKDF2 (SHA-256, 100,000 iterations). We never store plaintext passwords.
• Licence: tier, issue and expiry timestamps, in Cloudflare D1.
• Newsletter: only if you tick a separate opt-in. Unsubscribe from any message.

3. Payments (Paddle)

Paid plans are sold by Paddle.com Market Ltd as Merchant of Record. Paddle is an independent controller of checkout data (name, billing email, tax location, payment-method tokens). We do not receive full card numbers. Paddle may share with us: your email, country, tax status, transaction id, subscription status, and renewal dates, so we can turn Pro on or off.

See Paddle’s Privacy Notice. Billing questions: paddle.net.

4. Analytics and telemetry

• Website: Google Analytics 4 on ttstats.app (page views, referrer, device, country) via first-party cookies.
• Extension: anonymous events to GA4 Measurement Protocol and to our /api/telemetry endpoint (install/update, popup view, setting toggle, licence activation, errors). Identifiers are a random client_id and rotating session_id, not your email.
• Telemetry is not used to reconstruct which TikTok videos you watched.

5. Processors and infrastructure

• Cloudflare: Workers, D1, DNS, TLS, and transactional email (verification codes).
• Google: OAuth sign-in and Analytics.
• Paddle: payments, invoicing, tax, refunds (independent controller for payment data).

Traffic is encrypted in transit (TLS). Database contents are encrypted at rest by the provider.

6. Google API Limited Use

Use of information received from Google APIs adheres to the Google API Services User Data Policy, including Limited Use. We use Google user data only to authenticate you and issue a licence. We do not use it for ads. We do not sell it. Human review happens only for security investigations or with your consent.

7. Legal bases (GDPR)

• Contract: creating an account, issuing a licence, sending verification mail.
• Legitimate interests: securing the Service, aggregate product telemetry, preventing abuse.
• Consent: newsletter; non-essential website analytics where required.
• Legal obligation: tax and accounting records related to paid plans (held by Paddle and, where needed, by us).

8. Retention

• Account and licence records: for the life of the account, then deleted on a valid deletion request except where we must keep a stub for security or law.
• Verification codes: minutes (typically 15).
• Telemetry: aggregated or rotated; we do not keep raw browsing trails.
• Payment records: Paddle’s retention schedule.

9. International transfers

We are established in Cyprus (EU). Cloudflare, Google, and Paddle may process data in other countries. They use Standard Contractual Clauses or equivalent safeguards where required.

10. Your rights

Depending on your jurisdiction (including GDPR and CCPA-style laws) you may:

• Access a copy of the personal data we hold
• Correct inaccurate data
• Delete your account and associated records
• Object to or restrict certain processing
• Withdraw consent (newsletter)
• Lodge a complaint with the Office of the Commissioner for Personal Data Protection of Cyprus, or your local authority

Email privacy@ttstats.app. We will need enough detail to find your account (usually the sign-in email).

11. Cookies and local storage

The extension uses chrome.storage.local / chrome.storage.sync for display preferences, the licence token, and an anonymous analytics id. The website uses essential session cookies for signed-in users and administrators, plus GA4 cookies on the marketing site.

12. Children

The Service is not directed at children under 16. We do not knowingly collect their data. If you believe we have, email us and we will delete it.

13. Changes

Material changes will be posted on this page with a new “Last Updated” date.

14. Contact