Privacy Policy

Information We Collect

Website downloader: the TikTok link you submit, and standard request logs (IP address, timestamp, user agent) used only for rate limiting and abuse prevention. Using the website downloader does not create an account or a stored profile.

Website account: your email address, password hash, account settings, creators you choose to monitor, subscription tier and usage counters, password-reset records, and metadata for saved Stories shown in your library. Accounts that took part in the former private LIVE recording test may still have historical LIVE recording metadata (see Data Retention).

Telegram notifications: if you connect Telegram (available on paid plans and during a free trial), Telegram Login gives us your Telegram user ID and, where your Telegram profile has them, your username and name. We do not request or receive your phone number. We keep these to send you Story notifications, together with a record of each notification (the creator, a Story reference, when it was sent and whether Telegram accepted it). Commands you send to our bot (/start, /help, /stop) are acted on but their text is not stored.

Free trial: if a free trial starts on your account, we keep a record that your account used it, including its start and end dates and any creator you chose to keep. To stop a free trial being used more than once, we also keep a one-way, keyed code derived from your verified email address or sign-in identity. If you sign up with a password, we also keep a record that you verified your email address. We do not use device fingerprints for this.

Payments: if you upgrade, payment is handled entirely by Stripe. We receive your subscription status and tier, not your card details.

How We Use Information

To fulfill download requests, run the Story monitoring jobs you enable, enforce plan limits, provide account and password-recovery features, apply rate limits and detect abuse, process billing, and keep the service reliable. We also keep aggregate daily product counts for a small allowlist of events and outcomes. With your permission, StoryHideout additionally records a limited first-party funnel using a random identifier so we can understand first landing page, broad source, whether a public tool returned a result and Monitor was clicked (page and result type only, never the creator or link), signup, activation, and payment. We do not use fingerprinting or advertising trackers.

Data Sharing & Third Parties

Cloudflare provides the application, network, database, and object storage infrastructure. Google processes Google sign-in and provides a verified email address, a stable account identifier, and basic profile information when you choose that sign-in method. StoryHideout does not store Google access tokens. Stripe processes subscriptions and plan changes. Resend sends StoryHideout email: password resets and the account emails described under Email. Sentry receives sanitized application error and reliability events. Telegram delivers the Story notifications you turn on: it receives each notification message, which names the creator and links to the Story on StoryHideout, and never the Story itself. External font providers receive ordinary network request information when your browser loads their fonts. We do not sell personal data.

Email

Account emails — password resets, security and billing messages, a one-time confirmation that your account was created, and an email-verification link when you request one to start a free trial — are part of providing the service and are always sent.

Optional emails are sent only in the categories you chose: product updates and offers, which you can turn on in your account settings, and a single message when the first Story from a creator you track is ready to view, for accounts that chose it when signing up. Optional emails never include media or creator names, and links in them lead to pages you must be signed in to see.

You can turn product updates and offers off at any time in your account settings. Every optional email, including the one-time first-Story email, has a link to turn it off without signing in, and you can also contact us. We keep a record of when each choice was made and where (signup, settings or an email link) as evidence of your consent. Links in our emails carry a campaign label and a random reference so we can count, with your analytics permission, how often an email brings someone back; our emails contain no tracking pixels. If an address bounces permanently or reports our email as spam, we stop sending it optional email and keep a one-way hash of the address so it stays excluded, including after account deletion.

Cookies & Tracking

The website uses essential cookies for account sessions and to remember your analytics preference. If you allow analytics, an HttpOnly first-party visitor cookie lasts up to 90 days; only its one-way hash is stored. First touch stores the landing path without its query string, referrer hostname, bounded UTM values, and broad source category. Until you make a choice, the browser tab keeps only the path of the page it opened on in session storage, with no identifier; it is sent only if you allow analytics and is removed when you choose. You can change your choice using “Analytics choices” in the footer. Withdrawing expires the visitor cookie and deletes the current unlinked visitor record when it can be identified. IP addresses are used transiently for rate limiting and abuse prevention. Web-font providers may see your IP address as an ordinary side effect of serving those resources.

Data Retention

Your access to a saved Story lasts for your current plan's window — 3 days on Free, 30 days on Starter, 90 days on Pro, and 365 days on Plus — measured from when the Story was captured, and updates automatically if you change plans. Because a Story posted by a creator you track may also be saved on behalf of other customers tracking the same creator, the underlying file may remain in shared storage for up to 365 days (the longest window any current plan allows) even after your own access to it has ended; your ability to view or download it is always governed by your own plan's window, never by how long the file happens to physically exist. LIVE recording has been discontinued. Data left from its former private test is no longer used and is deleted on the schedule it was collected under: delivered recordings after 14 days, failed recovery material after 72 hours, and recording records after 90 days (3 days for failed attempts), unless an operator applied a legal or diagnostic hold; any remainder is removed when that data is retired entirely. Password-reset links expire after 45 minutes; consumed and expired token records are cleaned up. When a Google sign-in matches an existing password account, a pending link record (the account, the Google account identifier and its verified email) is kept for up to one hour until you log in with your password, then deleted. Records of emails sent to you and your email choices are kept while the account exists and deleted with it. Your Telegram user ID, username and name are removed when you disconnect Telegram or delete your account; records of Telegram notifications are deleted 30 days after they were sent. Rate-limit counters are rolling. Watchlists, billing records, and account settings remain while the account exists, subject to legal accounting or dispute-retention duties.

Free trial: during a free trial your access to a saved Story lasts 7 days from when it was captured. When the trial ends, your current plan's window applies. The trial record and email-verification record are deleted with your account. The one-way code described above is kept for 365 days from when the trial started, including after you delete your account, and is then deleted automatically. It isn't linked to your account after deletion, and we can't read your email address from it.

Your Rights

You can ask what account data we hold, correct it, export it, or have it deleted — including your watched-creator list, usage counters, and any historical LIVE recording data. Use your account settings or contact us. If you're in the EU/UK, this includes rights to access, rectification, erasure, restriction, and data portability under GDPR; you also have the right to lodge a complaint with your local data protection authority. Deleting your account doesn't remove the one-way free-trial code described under Data Retention. You can object to us keeping it by contacting us and telling us the email address or sign-in identity you used.

Legal Basis for Processing & International Transfers

We process account data to perform the service contract and for legitimate interests such as abuse prevention, service reliability, and preventing repeat use of a one-time free trial; billing data is processed to administer a paid subscription. Product updates and offers are sent only with your consent, which you can withdraw at any time. Cloudflare, Stripe, Resend, Sentry, Telegram, and the external font providers operate infrastructure that may process data outside your country of residence and maintain their own transfer safeguards.

Children's Privacy

StoryHideout is not directed at children and isn't intended for use by anyone below the minimum age required to use TikTok in their country. We don't knowingly collect data from children.

Changes to This Policy

If this policy changes materially, we'll update the date at the top of this page and provide any notice required by law.

Data Controller & Contact Us

StoryHideout, operated from Denmark, is the data controller for personal data processed through this website. For privacy questions, data requests, or to exercise your rights, contact support@storyhideout.com.

Questions about this policy? Contact StoryHideout.