Privacy Policy

Updated 26 October 2026

1. What we collect

  • Account: your email address, optional display name, language and time zone; verified Google or Apple account identifiers if you use those sign-in methods; your Telegram user identifier and name if you use the bot or link Telegram. These identifiers connect one account on the website and in the bot.
  • Sign-in and security: a password hash if you set a password; the sign-in method, browser and device type, and the times a session started and was last active. We keep hashes of session identifiers and email-change confirmation tokens, never the original passwords or confirmation tokens. You can review and end sessions in your account settings; this metadata is removed when you delete your account.
  • Content: the scripts, messages, characters and project settings you create. Music you upload: kept as an audio file without its tags or cover art; the title comes from the file name.
  • Connected accounts: if you choose to connect a TikTok account, TikTok sends us your account identifier, display name and avatar, and an access key that lets us upload the videos you pick to your TikTok drafts (permissions user.info.basic and video.upload). The key is stored encrypted and used only when you send a video yourself. We do not read your other videos, followers or messages, and nothing is published without your action. You can disconnect at any time in Connections: we revoke the access at TikTok and delete the key.
  • Plan and usage: how many videos you downloaded, which plan you are on, and whether a payment went through. For a tagged link to our Telegram bot, we temporarily retain the landing language and page type against a pseudonymous Telegram identifier for up to seven days. When you confirm an account action, we associate that source and subsequent product milestones with your account to measure whether people reach a finished video. These records are removed when the account is deleted.
  • Account activity and notifications: task and allowance history, event topic and time, the related action, read status and delivery outcome. We keep your chosen channels, proof of access to your current email and separate consent to product emails. Notification history contains no copies of scripts or emails. Optional messages are off by default; you can change channels and consent in notification settings.
  • Audience: anonymous counts of page views (page, language, referring site) — no cookies, no IP or device identifiers, and nothing that can be linked to you.
  • Sign-up source: where your browser first came to us from (the referring site without the page address, or a tag in the link) and the first page it opened. Before you sign up this stays only in your browser, for up to 30 days; we link it to your account once, and only if the account was created in the last two days. This also covers your optional answer to «What are your videos for?». We look at this only in aggregate, to see which channels bring creators. It is part of your data export and is deleted with your account.
  • Error reports: when something breaks we receive a technical report (page, error, browser version) — IP addresses are not stored.
  • Analytics, only if you agree: Google Analytics and Yandex Metrica set cookies and record the pages you open, the approximate area your address belongs to, and your browser and device type. Google receives its copy in the United States, Yandex in Russia. Decline and neither is loaded.
  • Payments: card or banking details are entered with the payment provider and are not received by TextFlick. We retain the payment reference, amount, currency, status, paid period and refund or renewal details. Stars payments use a Telegram payment reference and a Stars amount. If you choose Platega at checkout, that provider processes the payment and sends us its result.
  • Messages: what you write to our contact addresses, and the address you write from.

2. Why we use it

To run your account, save your projects, prepare and store your videos, answer your messages, send service email, take payments, keep the service secure, and meet accounting and legal duties.

3. Legal grounds

Performing our contract with you: your account, projects, videos and payments. Our legitimate interest: keeping the service secure, fixing errors, and counting page views anonymously. Legal duty: keeping payment records for tax. Consent: Google Analytics and Yandex Metrica, which you can withdraw at the bottom of this page. Product emails require separate consent; you can withdraw it in notification settings. Required account security messages continue to work.

4. AI assistant and content checks

Topics, scripts, character names and other displayed text are sent through OpenRouter to the selected model provider for script generation and automated prohibited-content checks. Checks also cover manually written scripts and bot messages before saving or export. We do not add your email, account identifier or payment details to moderation requests; the text can contain information you put in it. Do not enter other people’s personal data or confidential information. We do not sell scripts. A temporary moderation cache contains a text fingerprint and a decision, not the text itself; rejected content is not saved as a new project or finished video. You can appeal an automated refusal through support.

5. Who else processes data for us

Stripe handles card payments and invoices. Telegram handles bot messages, account sign-in and Stars. OpenRouter and its selected model provider handle AI scripts and content checks. Our hosting provider in Kazakhstan runs the service. FirstVDS in Russia stores finished videos and backups. Sentry in its EU region receives error reports. Resend sends service email. TikTok is involved only when you connect an account and send a video. Google and Yandex receive analytics only with your consent. Platega processes payments when you choose that method at checkout. Providers receive only the data needed for their task. We do not sell your data.

6. Where your data is stored

The application runs in Kazakhstan, videos and backups are stored in Russia, and error reports are processed in the EU region. Payment, email, Telegram and AI providers may process data in other countries, including the United States. With OpenRouter, processing locations depend on the selected model provider. If you are in the EEA or UK, data may be transferred outside your country, including to countries without a European Commission adequacy decision. We send only what the relevant function needs.

7. Your rights

You can download a copy of your data or delete your account yourself in Your Data, at the bottom of this page when you are signed in. You can also ask us to correct your data, to restrict or object to processing, or complain to the data-protection authority in your country. Write to privacy@textflick.app; we answer within 30 days.

8. How long we keep it

A finished video stays available for 24 hours and is then deleted from storage. Projects, characters and drafts stay until you delete them or delete your account. Action history and notification settings stay until you delete your account. Notifications are available in your account for 90 days and then removed during regular cleanup; minimal details of an unfinished delivery stay until its outcome is processed, to prevent sending the message again. Database backups are kept for 30 days. Payment records are kept as long as tax law requires. Page-view counts are anonymous from the start and are kept in aggregate. Analytics data, if you agreed to it, is kept by Google for 14 months.

9. Cookies and staying signed in

We remember that you signed in, so you do not have to sign in on every visit, and we remember the language you chose. In browser storage, not cookies, we keep a draft made without an account and the first-visit source until you sign up. If you accept the banner, Google Analytics and Yandex Metrica add their own cookies to tell repeat visits apart; they last up to two years and you can withdraw at the bottom of this page or by clearing them in your browser. That is all we set ourselves. We show no ads and sell no data; the two counters set their own cookies and fetch their own service pixels, but only after you agree — and their cross-site profile matching is blocked by this site's security policy.

10. Children

TextFlick is not meant for children. You must be at least 13 years old, and at least 16 in the EEA and the UK. If we learn that an account belongs to a younger child we delete it.

11. Changes to this policy

If we change this policy we update the date at the top of the page, and when the change is significant we tell you by email or in the app.

12. Contact

Questions about privacy, or anything about the data we hold on you: privacy@textflick.app. Everything else: support@textflick.app.

Analytics on this site

You have not answered yet.