Privacy Policy

Account update reminders

Plus monitoring is optional and requires a TikGhost account with a verified email address. When subscriptions open, the single plan will cost USD 5 per month, with no free trial, for up to 20 stored public accounts, including paused accounts.

When you confirm a public account to monitor, we store its username, public TikTok ID and display name, your chosen language, monitoring settings, and the link to your TikGhost account in Cloudflare D1.

Checks run about every 30 minutes, without a guarantee of instant or complete notifications. To avoid repeats and retry failed emails, we keep post IDs, short captions, publication times and email processing records for up to 31 days. We do not monitor private accounts or store video or image files as a media archive.

Alert emails may include a public profile photo and post cover images. We fetch these previews temporarily and embed them in the email; we do not archive the image files in the app. Delivered copies may remain in your mailbox until you delete the email. We do not add email-open tracking pixels.

We send alerts only for accounts you choose, to your verified email address through Cloudflare Email Sending. You can pause a monitor or use an alert’s unsubscribe link. Posts from paused periods are not sent later. Pausing these emails does not cancel Plus renewal; renewal is managed in Billing.

When monitoring access expires, checks and alerts pause. Your list is retained for 30 days, then removed unless access is restored or you remove it sooner. Removing a monitor deletes its monitoring subscription and pending email records. Completed account deletion removes all your monitors and their email records. Accounts with no remaining monitors are removed during daily cleanup. Monitoring and billing pages and unsubscribe links are excluded from our public visitor reports and Google Analytics.

In Short

The main points, each explained below:

• Public viewing, downloads and exports need no account; optional paid monitoring requires registration. We never ask for your TikTok login.
• Server logs are deleted within seven days.
• We don't store the files you download or export.
• We don't show ads. We count visits ourselves and with Cloudflare Web Analytics, and neither uses cookies. Outside the EEA, the UK and Switzerland, we also use Google Analytics, which does.
• TikTok videos and images load straight from TikTok's servers, under TikTok's own privacy policy.
• We don't sell personal data.

Optional TikGhost Accounts

For account operations, we keep hourly counts of registrations, new sign-in sessions, visits to Account, My monitors and Billing, and successful monitoring and subscription actions, linked to your TikGhost user ID. Page-visit counts are deduplicated over five minutes. To analyze conversion from registration to payment, we also record the first time each fixed step is reached: viewing My monitors, selecting a target, viewing Billing, creating checkout, payment confirmation and enabling monitoring. These first-step records contain only your user ID, the fixed step and its timestamp. Creating checkout does not mean payment has been confirmed. Both the hourly counts and first-step records help us understand usage and service problems; they contain no IP address, browser user agent, search terms, target names, target usernames or URLs. They are available only to administrators, retained for up to 31 days, and deleted with your account. We do not send them to Google Analytics.

If you choose to register, we store your email address and a hash of your password in Cloudflare D1, not your plain-text password. Passwords must be 12–128 characters long, and you must verify your email address before signing in. A TikGhost account does not connect to TikTok, and we never ask for your TikTok password.

When you sign in, we create a session that lasts seven days. Your browser keeps a session token in a cookie marked HttpOnly, Secure and SameSite=Lax. It authenticates account requests. We do not keep your IP address or browser user agent in session records, or cache account data in the session cookie.

We use Cloudflare Email Sending to send verification and password-reset emails to your address. These are account service emails; creating an account does not subscribe you to marketing emails.

We keep your account until you delete it. Before deletion, cancel automatic renewal and resolve any pending payment in Billing. Once deletion completes, we remove the account, its credentials and its sessions from our database. Expired sessions, verification records and account rate-limit records are cleaned up daily. Existing server logs are still deleted within seven days. Deleting a TikGhost account does not itself erase payment records held by Waffo Pancake.

Account pages are excluded from our public visitor reports and Google Analytics. We do not send their email addresses or verification and reset tokens to external analytics, and remove query strings and fragments from page and referrer URLs sent to Google Analytics.

Optional Payments

Payments are not open yet while our Waffo Pancake merchant application is under review. If they open and you choose to subscribe, Waffo Pancake will act as merchant of record. Checkout will ask you to explicitly authorize monthly automatic renewal; canceling renewal in Billing takes effect at the end of the paid period.

To create checkout, we send Waffo Pancake your account email and an internal account reference. The provider processes payment and billing data under its own privacy policy at www.waffo.ai/privacy. TikGhost does not store your card details.

In Cloudflare D1 we keep the minimum subscription and order references, status and relevant dates needed to manage access, reconcile payments and handle billing enquiries. These are separate from the monitor list’s 30-day retention. Payment records held by the provider follow its own privacy and retention policy.

When You Visit

Like any website, we receive your IP address and basic details about each request when you visit, such as the page requested, the time and your browser type. TikGhost runs on Cloudflare, which processes this information to deliver the site and protect it from abuse.

When a request looks like the automated traffic the site gets, Cloudflare may first check that a person is using the browser. For now that happens when an account or video page is opened directly in Chrome or another Chromium browser on a Linux computer. The check usually passes by itself within a second or two. Passing it sets a Cloudflare cookie, cf_clearance, which shows the check was passed, so you aren't checked again for up to a day. The check may also set other Cloudflare cookies whose names start with cf_chl, which Cloudflare uses to find problems with it. Cloudflare handles all of this under its own privacy policy.

Our server logs are kept for up to seven days, and we use them to find and fix problems. Separately, we keep a record of problems reaching TikTok, such as which Cloudflare location it turned away and when. It contains nothing about visitors and is deleted after 90 days. We also use your IP address for rate limits, which count requests over about a minute so that no one can overload the site. If an address is used to download from TikGhost in bulk with a program, we may block it. We keep a blocked address for 30 days, and then it is deleted automatically.

Browsing normally does not require a check. If frequent browsing requests need data that is not in our cache, Cloudflare Turnstile may ask you to confirm you are a person. After verification, the page resumes the action you were taking. Passing the check does not remove the site's overall request limits or blocks.

We use Cloudflare Web Analytics to count visits and measure how fast pages load. A small script from Cloudflare reports the page you opened, the site that sent you, your browser, your device type, your country and load times. It doesn't set cookies or store anything in your browser, and it doesn't follow you over time or across sites.

We also count page views ourselves, without cookies. When a page opens, your browser tells our server which page it is, and on the first page of a visit, which site sent you, from the referrer or from the utm_source tag some sites add to their links. Our server adds your country, device type, browser and language from the request, then adds one to counts per minute and per hour. The counts don't include your IP address or anything else that tells visitors apart, and we keep them for up to 400 days.

So we can see what's happening right now, we keep each page view's address, time and country for up to two hours, with a random number your browser makes up when the page opens. That number only lets us count how many tabs have the site open. It isn't stored in your browser and changes every time you open or reload the site.

Our server counts what the site does in the same way, such as lookups, downloads and exports, which Cloudflare location handled them and how TikTok answered. This includes which public TikTok accounts and videos are looked up most and how many visitors looked them up, kept for 30 days with nothing about who they were.

To estimate daily visitor numbers for the site as a whole, for each place visitors come from (such as Google or ChatGPT), for each account and video, and for downloads and export starts by type, our server keeps a hash of your IP address (not the address itself), with a salt that changes daily, alongside the accounts and videos you look up and your download and export-start counts that day. IPv6 addresses are grouped by their /64 network, and each address is counted once per day in Beijing time, without tracking across days.

The daily counts also let us estimate how many visitors use downloads or exports repeatedly (at least 2 times) or heavily (at least 10 times). Downloads count only when our server returns a successful file response or your browser reports success; playback and profile-picture views do not count, and exports count only when successfully started. The hashes and individual daily counts are kept only for today and yesterday; only aggregate download/export counts are kept for up to 400 days. These statistics collect neither export contents nor email addresses.

When a lookup fails and the page tries again, your browser tells our server whether that worked. When your browser saves photos straight from TikTok, it tells our server what kind of download it was and its size, so it's counted with the rest. When a visit starts on one of our blog posts, your browser also tells our server, once each, whether you click into the search box under a post's answer, whether that visit goes on to one of our tools and whether it opens an account or a video. We keep only the counts for each post.

When you click one of the popular accounts or videos on our home page, your browser tells our server which of the two it was. To spot programs that use the site in bulk, our server also counts pages, data requests and downloads by country, network (such as your internet provider) and browser, and keeps these counts for 30 days. A browser that an automation tool controls only tells our server that it opened a page, and downloads that don't come from a browser are counted separately.

Outside the European Economic Area, the UK and Switzerland, we also use Google Analytics, which loads after the page has finished loading. It records the pages you view, the site that sent you, your browser and device, and an approximate location that Google estimates from your IP address. It sets two cookies on this site, _ga and _ga_3J3QE0GJKQ. They hold a random ID so that visits from the same browser can be counted together, and they last up to two years. Google handles this data under its own privacy policy. You can opt out with Google's opt-out browser add-on (tools.google.com/dlpage/gaoptout) or by blocking cookies for this site. In the EEA, the UK and Switzerland, Google Analytics isn't loaded at all.

The home page shows badges from sites that list TikGhost, such as Fazier. Each badge loads from the site it links to, so that site receives your IP address and browser details. We ask your browser not to tell it which page you're on.

Downloads and Exports

When you download a video, an audio track, a story or a profile picture, the file streams from TikTok through our server to your device, and no copy is kept. Photos from a photo post download straight from TikTok to your browser, which also makes the ZIP. They only come through our server when that doesn't work. If you turn a photo post into a video, that video is made in your browser too.

Exports are put together in your browser, page by page, and saved to your device. Export files are never stored on our servers. To enforce the limit of 30 exports a day, we store a salted hash of your IP address (not the address itself) along with how many exports it started that day, with each half hour of a long export counting as one. These records are deleted automatically once they're a day or two old.

Before an export, and before a download from a video page, Cloudflare Turnstile checks that the request comes from a person. For this check, Cloudflare processes signals from your browser under its own privacy policy. So that the check is ready when you need it, pages with an export button may load its script in advance, and video pages run the check while you watch.

After you pass the check, your browser keeps a pass in its session storage. For 30 minutes, the pass lets you download, export and continue browsing in the same tab without repeating the check, and download links carry it. It works only from the same internet provider and country. Session storage is cleared when you close the tab. If the check doesn't finish in your browser, your browser tells our server why, and again if it passes later after all. It also does when you click a download before you have a pass. Our server counts these, and the checks it sees itself, by browser.

Public TikTok Data

When you look up an account or a video, our server fetches the public data from TikTok at your request. It's kept in a short-lived cache, from a few minutes to a few hours, and then expires, so the same request doesn't go to TikTok again and again. The one exception is an account's TikTok ID. We keep it under the username for 30 days, so the account's videos can be fetched together with its profile. We don't build profiles of TikTok users.

When you search, our server sends the words you typed to TikTok to get the videos and accounts it lists for them. Nothing about you goes with them. TikTok's answers are kept in the cache under those words for up to a day.

Your search is part of the page's address, so it shows up in our server logs like any other page, and those are deleted within seven days. We count how many searches are made, but we don't keep a list of what people searched for. Google Analytics is only told that a search page was opened, not what it was for.

Videos and Images From TikTok

Videos play in your browser straight from TikTok's servers. The files don't pass through ours. Your browser contacts TikTok directly, under TikTok's privacy policy. If you're logged in to TikTok in the same browser, TikTok may be able to link what you watch here to your account.

Profile pictures, video thumbnails and other images load straight from TikTok's servers, so those servers receive your IP address and browser details. We ask your browser not to tell them which TikGhost page you're on.

Cookies and Browser Storage

Outside the EEA, the UK and Switzerland, Google Analytics sets the two cookies described above. If Cloudflare checks your browser, it sets its own cookies, also described above. TikGhost uses the account session cookie described above and a separate cookie for language preferences. Some pages suggest another language at the top, based on your browser's language setting. When you choose a language there or in the language menu, or close the suggestion, this cookie keeps that choice for a year, so pages suggest the language you chose or stop suggesting one. There's also a sign-in cookie on our admin page, which only the people who run the site use. Cookies from TikTok's player are covered by TikTok's privacy policy.

Three other things may be kept in your browser. One is the pass described above. Another is the progress of an export that stopped before it finished, so you can resume it. It never leaves your browser, it's deleted when the export finishes or you start it over, and anything older than a day is deleted the next time you open an export. TikGhost always uses dark mode and does not store a theme preference.

The third is a list of the TikTok accounts you've opened here, which the search box shows as recently viewed. It holds the last eight, with each account's username, name, profile picture link and verified badge. It stays in your browser and is never sent to us. Anyone who uses the same browser can see it, and you can remove an account or clear the whole list under the search box.

Browser Extension

The TikGhost extension for Chrome, Edge, Firefox and Opera opens TikTok profiles and videos on this site. It sees the address of your current tab, a link you right-click, or text you select and search for, only when you use it, and only to work out what to open.

It can't read or change the pages you visit, and it doesn't store anything. A TikTok link it can't match by itself, such as a share link, goes to our server to be looked up, the same as a link you paste into the search box.

If You Own an Account Shown Here

TikGhost only shows content that's public on TikTok. Account owners can ask us to stop showing their account or a single post. To confirm the account is theirs, we send them a short code to put in their TikTok bio for a while. Then we block the account or post from lookups. The contact page has the details.

If you email us about this or anything else, we use your email address and what you write to reply to you.

Feedback You Send Us

If you send feedback with the form on our pages, we keep what you write and the kind you picked. With it we keep the address of the page you sent it from, the site's language, your country and, if you opened the form from an error message, which one it was.

Your email address is kept only if you give one. We don't keep your IP address with your feedback. Before it's sent, Cloudflare Turnstile checks that it comes from a person, as it does before an export.

Only the people who run the site read feedback, and we delete it after a year. We also get an email saying new feedback has arrived, with its kind, page, language and country, but not what you wrote.

Children, Changes and Contact

TikGhost is not directed to children under 13.

We don't show ads right now. If we decide to add them, we'll update this policy before we do. The date at the top shows when it last changed.

Questions about this policy or your data? Email support@tikghost.ninja.