Privacy Policy
Last updated: 3 September 2026
TokSift is a tool for exporting and analyzing public TikTok comments. This policy explains exactly what we collect, why, who else touches it, and how long we keep it. It covers toksift.com and everything served from it. If anything here is unclear, write to support@toksift.com and we will answer.
The short version
- You can use the viewers and small exports without an account and without a TikTok login.
- If you sign in, we store two things about you: your Google account ID and your email address. Nothing else.
- We never see your card number. Payment happens on our payment provider’s own page.
- Files you export are deleted 7 days after the job finishes.
- We do not sell personal data, and we do not share it for advertising.
1. Who we are
TokSift is operated by WHALEPLUS PTE. LTD., a company registered in Singapore at 71 Ubi Road 1, #08-34, Oxley Bizhub, Singapore 408732. We are the controller of the personal data described in this policy. For anything in it — questions, requests, complaints — the contact point is support@toksift.com.
Purchases are distributed by Waffo.com Limited, an authorised distributor of our products, registered at RM 1903, 19/F Lee Garden One, 33 Hysan Avenue, Causeway Bay, Hong Kong. Its name, rather than ours, may be what appears on your card statement.
TokSift is an independent tool. It is not affiliated with, endorsed by, or sponsored by TikTok or ByteDance Ltd.
2. What we collect about you
We collect the minimum needed to run the service. Concretely:
| What | Why we have it |
|---|---|
| Google account identifier and email address | Only if you choose to sign in. The identifier is what credits and background jobs are attached to; the email is how we can reach you about a purchase. We do not receive your Google password. Your name and profile picture are passed to your browser by Google so the site can greet you, but they are not stored on our servers. |
| Order records | Which plan you subscribed to, the billing period, the amount, the currency, the status of each charge, and the identifiers our payment provider uses. Required to deliver what you paid for and to keep accounts that reconcile. |
| Credit ledger | An append-only list of credits granted and consumed. It is how your balance is calculated, and it is the record we check when a charge is disputed. |
| Job inputs and outputs | The TikTok URL you submit and the file produced from it, so you can come back and download the result. |
| Aggregate counters | Server-side counts of exports, analyses and failures. These carry no identifier — no email, no account ID, no IP address. They answer “is anything being used and what does it cost us”, not “who did what”. |
| Analytics | Google Analytics 4 runs on this site. It sets cookies in your browser and reports page views, approximate location derived from IP, and device type to Google. See section 5. |
| Server logs | Our hosting provider records requests, including IP addresses, for a short period. This is standard infrastructure logging used for security and debugging, not profiling. |
We do not ask for your TikTok credentials, and the product never needs them. Anything that asks you to log in to TikTok in order to use TokSift is not us.
3. TikTok comments you export
This is the part most privacy policies in this category skip, so we will be direct about it: the comments you export are other people’s personal data. They contain usernames, written opinions, and timestamps.
We only ever retrieve comments that are already public on TikTok, through a third-party data provider. We do not access private accounts, deleted content, or anything behind a login. We do not build profiles from this data, we do not resell it, and we do not use it to train models.
Once you download an export, you decide what happens to it. Under GDPR terms, that makes you the controller of that data and us a processor acting on your instruction. If you are in a jurisdiction with data protection law, the obligations that come with holding it — lawful basis, retention limits, responding to the people in it — are yours, not ours. Section 4 of the Terms says the same thing in operative language.
4. AI analysis
If you run an AI analysis, a sample of the comments is sent to a third-party large language model provider through our own gateway, and the summary comes back to you. The sample is capped — we do not send the full export.
We do not use your comments or your analyses to train any model. We ask the same of our providers, but their handling is governed by their own terms, and we cannot promise on their behalf what we do not control.
5. Cookies and analytics
Two kinds of cookies exist on this site.
- A session cookie, set only after you sign in. It keeps you signed in. Without it the site cannot tell who you are, so it cannot be switched off while you are logged in.
- Google Analytics cookies, which measure traffic — how many people arrive, from where, and which pages they read.
The analytics cookies are not essential to the service. You can block them with your browser settings, a tracking blocker, or Google’s official opt-out add-on, and the site will keep working normally. Google processes this data under its own terms as an independent controller.
6. Who else processes your data
We do not sell personal data and we do not share it for advertising. We do rely on the following providers to operate, each with access limited to what its job requires:
| Provider | What it handles |
|---|---|
| Vercel | Hosting, file storage for exports, and request logs. |
| Neon | The database holding accounts, orders and the credit ledger. It runs in Singapore. |
| Sign-in (OAuth) and website analytics. | |
| Waffo.com Limited | Payment processing, as an authorised distributor of our products. Card details are entered on their page and never reach our servers. |
| TikHub | Retrieval of public TikTok data. |
| An AI model provider | Generating the analysis, for the sampled comments described in section 4. |
We will also disclose data where the law actually requires it — a binding legal request — and not merely because someone asks.
7. Where your data goes
Our database is hosted in Singapore and our application runs in the same region. Our providers operate globally, so data may be processed outside your country, including outside the European Economic Area. Where that happens for people in the EEA or the UK, transfers rely on the providers’ standard contractual clauses or an adequacy decision.
8. How long we keep it
| Data | Retention |
|---|---|
| Exported files and job records | Deleted 7 days after the job finishes. |
| Account record (identifier and email) | Until you ask us to delete it. |
| Orders and credit ledger | Kept after account deletion for as long as tax and accounting law requires. These are financial records; we cannot erase them on request, and any provider that says otherwise is not keeping books. |
| Payment provider notifications | Kept as received, for reconciliation and dispute handling. |
| Aggregate counters | Kept indefinitely. They contain no identifiers and cannot be traced back to a person. |
| Analytics data | Retained by Google under its own retention settings. |
9. Your rights
Depending on where you live — the GDPR in the EEA and UK, the CCPA/CPRA in California, and comparable laws elsewhere — you have some or all of the following rights. To use any of them, write to support@toksift.com from the address on your account. We respond within 30 calendar days.
| Right | What it means here |
|---|---|
| Be informed | Know what we hold and why. That is what this document is for. |
| Access | Get a copy of what we hold about you. |
| Rectification | Have inaccurate data corrected. |
| Erasure | Have your account deleted, subject to the accounting records noted in section 8. |
| Restriction | Have us pause processing while a dispute is resolved. |
| Portability | Receive your data in a machine-readable format. |
| Object | Object to processing we base on legitimate interests. |
| Withdraw consent | Withdraw consent where processing rests on it. Revoking our access in your Google account settings ends the sign-in permission immediately. |
If you are in the EEA or the UK and think we have handled this badly, you can complain to your national data protection authority. We would rather you told us first.
10. Legal bases (EEA and UK)
- Performance of a contract — running your account, delivering exports, honouring purchases.
- Legitimate interests — keeping the service secure, preventing abuse, and understanding aggregate usage.
- Legal obligation — keeping financial records and responding to binding legal requests.
- Consent — where you give it, and which you can withdraw at any time.
11. Security
Traffic to the site is encrypted in transit. Access to the database and to production credentials is restricted. Card details never reach our systems at all, which removes an entire class of risk rather than mitigating it.
No service can promise it will never be breached, and we are not going to pretend otherwise. If a breach affects your personal data, we will notify you and the relevant regulator within the timeframes the law sets.
12. Children
TokSift is a business tool and is not directed at children. Do not use it if you are under 16, or under the minimum age of digital consent in your country if that is higher. If we learn we hold data from a child, we delete it.
13. Changes to this policy
When this policy changes we update the date at the top. If a change materially affects your rights, we will say so on the site rather than relying on you to notice a new date.
See also our Terms & Conditions. Questions: support@toksift.com