Halaman ini hanya tersedia dalam bahasa Inggris. Teks bahasa Inggris adalah versi yang mengikat.
Privacy Policy
Version 2026-09-28. Last updated 28 September 2026.
1. Who is responsible
The controller for personal data processed through CrowdArena is the operator named in the Legal notice. For anything about your data, email privacy@crowdarena.net.
2. What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Account: email address, password (stored only as a salted scrypt hash), account status, licence, the date you created and confirmed the account | To create and run your account, sign you in and check your licence | Contract, Art. 6(1)(b) |
| Consent records: the Terms version you accepted, your confirmation that you are 18+, the time, your IP address at sign-up, and your newsletter choice; at checkout, your email, plan, time, IP address and your request for immediate access | To prove what you agreed to | Legal obligation and legitimate interest in proving consent, Art. 6(1)(c) and (f) |
| One-time codes: a hash of the code, only in memory, for up to 10 minutes | Email verification and password reset | Contract, Art. 6(1)(b) |
| Sign-in and security data: hashed session tokens, a pseudonymous ID of the PC the app runs on, IP addresses, times and results of sign-ins and licence activations, and integrity checks of the app (file hashes and whether debugging tools were detected) | To keep accounts secure, limit a licence to one PC, and detect abuse and cracking | Legitimate interest in security, Art. 6(1)(f) |
| Your settings: gift-to-action mappings, the TikTok gift list of your room, uploaded sounds and icons, overlay layouts | To run the Service the way you set it up | Contract, Art. 6(1)(b) |
| Your stream: the TikTok handle you enter and the room ID | To connect to your LIVE | Contract, Art. 6(1)(b) |
| Your viewers' public stream events: TikTok user ID, username and display name of viewers who send gifts, likes, follows, shares or comments in your LIVE, the gift and its coin value, and the comment text | To trigger game actions, show the live feed and names in the game, and keep a short stream history | Legitimate interest in providing interactive streams, Art. 6(1)(f) |
| Game servers: a pseudonymous player ID derived from your account, game progress, and the IP address of the game connection | To run server-hosted games and save progress | Contract, Art. 6(1)(b) |
| Newsletter (only if you opted in): email address and opt-in status | To send product news and offers | Consent, Art. 6(1)(a), which you can withdraw at any time |
| Support emails: what you write to us and our replies | To answer you | Contract or legitimate interest, Art. 6(1)(b)/(f) |
| Payment: handled by our payment provider (name, email, billing address, payment method). We receive only the email, plan, status and amounts | To take payment and keep required tax records | Contract and legal obligation, Art. 6(1)(b)/(c) |
| Website visits: our hosting provider processes your IP address, browser type and the page requested in its server logs. We use no analytics and no tracking | To deliver the website securely | Legitimate interest, Art. 6(1)(f) |
We do not use your data for automated decisions with legal effects, and we do not create advertising profiles.
3. Information for viewers of a CrowdArena stream
If you watch a TikTok LIVE that uses CrowdArena, the public events you create in that LIVE (your public username and display name, gifts, likes, follows, shares and comments) are processed by CrowdArena to trigger game actions and may be shown in the stream and in the game. We do not receive your TikTok account details or private information. You can object at any time by writing to privacy@crowdarena.net with your TikTok username.
4. Service providers
We use these providers to run the Service. They process data only on our instructions, under data processing agreements:
- Server hosting: Hetzner Online GmbH, Germany (servers in the EU)
- Website hosting: Netlify, Inc., USA
- Email (inbox and sending codes): Zoho Corporation, EU data centre
- DNS and network protection: Cloudflare, Inc., USA (if the website is routed through Cloudflare)
- Payments: Stripe Payments Europe, Ltd. (Ireland) and its affiliates, which process your payment details under Stripe's own privacy policy; we never see your full card number
- Connection to TikTok LIVE: the Service connects to TikTok's servers to read the public events of your LIVE, and may use a third-party signing service for that connection; only your TikTok handle and room are sent
We share data with authorities only where the law requires it. We never sell personal data.
5. Transfers outside the EU
Where a provider processes data outside the EU/EEA (for example in the USA), the transfer is protected by an adequacy decision (such as the EU–US Data Privacy Framework, for certified companies) or by the European Commission's Standard Contractual Clauses.
6. How long we keep data
- Account, settings and consent records: while your account exists. When you delete your account, they are deleted when the 48-hour waiting period ends, except for records we must keep (below).
- Accounts whose email was never confirmed: deleted automatically after 7 days.
- Stream history (viewer events): 90 days, then deleted automatically. Live events that are only passed through to your game are not stored.
- Security logs (sign-ins, licence activations, integrity checks): 12 months.
- Records of what you agreed to at checkout, and billing records: as long as tax and commercial law requires (up to 10 years for invoices in some countries), then deleted.
- One-time codes: at most 10 minutes, in memory only.
- Backups: overwritten within 7 days.
7. Security
All connections use encryption (HTTPS/TLS). Passwords are stored only as salted scrypt hashes, session tokens only as hashes, and one-time codes only briefly and hashed. Sign-in, codes and sign-up are rate-limited. Your data is kept separate from other customers' data. On your PC, the app stores a remembered sign-in encrypted with Windows' own data protection. No system is perfectly secure, but we work to keep your data safe and will tell you and the authorities about a breach where the law requires.
8. Your rights
You have the right to:
- get a copy of your data (access) and receive it in a portable format;
- have wrong data corrected;
- have your data deleted: delete your account yourself in the app (Settings → Delete account…; confirmed with your password and an emailed code, carried out 48 hours later so a stolen login cannot silently wipe your account), or email us;
- restrict or object to processing based on legitimate interests;
- withdraw consent (for example to the newsletter) at any time, without affecting earlier processing;
- complain to a data protection supervisory authority, in particular in the EU country where you live or work. Our lead authority is the Italian Garante per la protezione dei dati personali (garanteprivacy.it).
To use these rights, email privacy@crowdarena.net from the email address of your account. We answer within one month.
9. Children
CrowdArena is only for people aged 18 or older. We do not knowingly collect data from children. If you believe a child has created an account, write to us and we will delete it.
10. Cookies
See our Cookie Policy. In short: no tracking or advertising cookies.
11. Changes
We will update this policy when our processing changes and show the date at the top. We will tell you about significant changes by email or in the app.