Throng privacy policy
Throng is an app where TikTok LIVE creators run a closed fan space for their community: battle calendar, reminders, team chat, ranks and badges. This policy explains what we collect, why, who sees it, how long we keep it, and your rights.
Throng is not made, sponsored or endorsed by TikTok.
1. Who is responsible
Throng is run by DarkByte, a personally owned business (personligt ejet mindre virksomhed) owned by Christian Behrens-Thomsen, CVR 33941285, Nordvanggårdsvej 6, 2. 3., 3460 Birkerød, Denmark.
DarkByte is the data controller for Throng. For the data inside a creator's fan space, DarkByte and that creator are joint controllers (section 9).
Contact for anything about your data: christian@darkbyte.dk. We answer in English or Danish. DarkByte has no data protection officer; it is not required to have one.
2. Throng is for adults only
You must be 18 or older to use Throng. When you sign up we ask for your date of birth. If you are under 18, we delete your account at once, including your sign-in account at Clerk and the details received from TikTok or Apple, and you cannot use Throng. If we learn that an account belongs to someone under 18, we close it and delete its data.
3. What we collect
Your account
- You sign in with a code sent to your email address, with TikTok, or with Apple (on iPhone). Sign-in runs through Clerk, our sign-in provider (section 6). Throng has no passwords.
- A Clerk user ID, which links your Throng account to your sign-in account at Clerk. We do not store your Apple user ID.
- The verified email address on your sign-in account at Clerk, if it has one, whichever way you sign in. With Apple this can be a private relay address. When it changes at Clerk, we update our copy.
- Your display name, which other members of the spaces you join can see.
- Your birth year and the time you confirmed you are 18 or older. You type your full date of birth, the app works out your age, and we keep only the year.
Signing in with email
- Clerk sends a one-time code to the email address you type. Clerk keeps the address with your sign-in account, and we store a copy on your Throng account (see above).
Signing in with TikTok
- TikTok asks for your consent and sends Clerk your TikTok user ID for Throng (open_id), your TikTok display name, your profile picture link and, if you allow it, your username. Clerk keeps these with your sign-in account. We store the ID and the username on your Throng account. If you have no Throng display name yet, we use your TikTok display name. We do not store the profile picture link on our own server.
- TikTok also issues an access key for this. Clerk receives it and keeps it on its servers. Our own server does not store it.
Signing in with Apple
- Apple sends Clerk a user ID that is unique to Throng and stays the same each time you sign in. Clerk keeps it. Our own server does not store it; it knows you by your Clerk user ID.
- The first time you sign in, Apple may also send the name you chose to share. We use it as your display name if you have none yet. You can change it in Throng.
- Apple may also send an email address (your own or a private relay address from Apple). Clerk keeps it with your sign-in account, and we store a copy on your Throng account (see above). Apple also tells Clerk whether you are likely a real person; we do not store that.
- If you signed in with email or Apple, you can link your TikTok account later. This is optional. If you do, we store your TikTok ID and username on the same account, as described above.
Staying signed in
- Clerk keeps your login session. Your phone keeps a session key in its secure storage.
- During sign-in, Clerk records your IP address and details about your device, to detect abuse and keep you signed in.
Fan spaces you join
- Which spaces you belong to, your role there (member, captain, moderator or owner), and your notification settings.
- Your RSVPs to battles, your check-ins, and the XP, streaks, ranks (Rookie, Soldier, Sergeant, General) and badges you earn. If the creator or a moderator makes you a Captain or picks you as Fan of the night, we keep that too, with a log of the picks. These come only from what you do in Throng. We never use gifts, coins or money spent on TikTok.
- What you post: chat messages and feed posts. In this version you cannot upload photos or videos.
- If a moderator removes you from a space, a record of that.
Notifications
- A push token for your phone (from Apple or Google, passed through Expo), and your platform (iPhone or Android). We use it to send battle reminders and rally alerts you have switched on.
TikTok
- We do not read anything from your TikTok account after sign-in or linking.
- We never collect TikTok gift data, coin balances, gift amounts or top-gifter ranks.
Reports and moderation
- If you report a post or a chat message, we keep who reported it, a reference to what was reported (not a copy of it), the reason you picked, any note you add, and the decision.
- If you send a report by email, we keep your email and what you write in it, such as your name (you may leave your name out for reports of child sexual abuse material).
- If a moderator removes your post or chat message, or removes you from a space, we keep the statement of reasons the app shows you.
Support
- If you email us, we keep the email and our reply.
What we do not collect: no passwords, no payment data (Throng is free and has no payments), no TikTok gift or spending data, no contacts, no location, no photos from your phone, no advertising IDs. There are no ads and no third-party analytics in the app, and we never sell or share your data for marketing.
4. Why we use it, and on what legal basis
| What we do | Legal basis (GDPR) |
|---|---|
| Run your account, sign you in with email, TikTok or Apple (through Clerk), show your spaces, posts, ranks and badges | Art. 6(1)(b): needed to provide the service you signed up for |
| Check that you are 18 or older | Art. 6(1)(b) and (f): Throng is an adult-only service, and we have a legitimate interest in keeping minors out |
| Send reminders and rally alerts | Art. 6(1)(b). You choose which ones; you can switch them off in the app or in your phone's settings |
| Link TikTok to an email or Apple account | Art. 6(1)(b), at your request. TikTok also asks for your consent |
| Keep the service secure: rate limits, Clerk's sign-in security checks, abuse prevention | Art. 6(1)(f): our legitimate interest in a safe, working service |
| Handle reports, moderate content, send statements of reasons | Art. 6(1)(c): our duties as a hosting service under the EU Digital Services Act (Arts. 16 and 17), and Art. 6(1)(f): keeping the community safe |
| Keep records of reports and moderation decisions | Art. 6(1)(f): to answer appeals and defend legal claims |
| Answer your emails and requests | Art. 6(1)(b) or (f), depending on the request |
Where we rely on legitimate interest, you may object (section 8).
Please do not post sensitive information (health, religion, sexuality, political views) about yourself or others. We do not want it and do not use it.
5. Automated tools
Throng does not use automated tools to moderate content. People make every moderation decision. Throng makes no automated decisions about you with legal or similarly significant effects.
6. Who gets your data
Other people in Throng. Members of a space see your display name, badges, rank and posts in that space. The creator and the moderators of a space also see the membership list, RSVPs, check-ins and moderation history for their space.
Creators. The creator of each space is a joint controller with DarkByte for that space (section 9). Creators may only use member data inside Throng.
Service providers who process data for us (processors):
| Provider | What they do | Data | Where, and transfer basis |
|---|---|---|---|
| Clerk, Inc. | Runs sign-in (email codes, Sign in with TikTok, Sign in with Apple), sends the sign-in code emails, and keeps you signed in | Email address, sign-in method, TikTok or Apple account ID and username, the name and profile picture link TikTok or Apple send, TikTok and Apple access keys, login sessions, IP address and device details for sign-in security | USA. Clerk, Inc. is certified under the EU-US Data Privacy Framework, so the transfer rests on the EU adequacy decision for the framework (GDPR Art. 45). Clerk's data processing addendum adds the EU Standard Contractual Clauses as a fallback. Clerk uses its own subprocessors, which it lists on its website. |
| suble.io | Hosts our servers and backups | All data in this policy, except what only Clerk holds | EU |
| Expo (650 Industries, Inc.) | Relays push notifications to Apple and Google | Push token, notification text | USA. 650 Industries, Inc. is certified under the EU-US Data Privacy Framework, so the transfer rests on the EU adequacy decision for the framework (GDPR Art. 45) |
| Apple (Apple Push Notification service) | Delivers notifications to iPhones | Push token, notification text | Apple's terms; EU-US Data Privacy Framework or standard contractual clauses |
| Google (Firebase Cloud Messaging) | Delivers notifications to Android phones | Push token, notification text | Google's terms; EU-US Data Privacy Framework or standard contractual clauses |
| Google Ireland Ltd (Google Workspace) | Hosts our contact mailbox, christian@darkbyte.dk | Emails you send us and our replies | Ireland (EU). Google may use subprocessors outside the EU under the EU Standard Contractual Clauses. |
Notification texts name the space and the opponent of a battle, for example "<space>: rally now" with "Battle vs <opponent> is on. Open Throng and check in.", or "<space> vs <opponent> in 15 min" with "You're in. See you there." They never contain your age or anything sensitive.
Independent controllers. Apple and TikTok are not our processors. When you sign in with Apple, Apple runs the sign-in and decides itself what it collects; it handles that data under its own privacy policy (for users in the EU, the controller is Apple Distribution International Limited, Ireland). When you sign in with or link TikTok, TikTok likewise handles your data under its own privacy policy. What they send to Clerk and to us is then handled under this policy. If you test Throng through Apple's TestFlight, Apple collects tester information under its own terms.
Authorities. We share data with police or other authorities when the law requires it, and we report threats to someone's life or safety to the police (Digital Services Act Art. 18).
7. How long we keep it
| Data | Kept for |
|---|---|
| Your account and profile, including your email address, your Clerk user ID and, if linked, your TikTok ID and username | Until you delete your account |
| Your sign-in account at Clerk (email address, TikTok or Apple details and access keys, sessions, sign-in IP and device records) | Until you delete your Throng account, which deletes your sign-in account at Clerk too. How long Clerk keeps its own logs and backups after that is up to Clerk, under its privacy policy and data processing addendum |
| Email sign-in codes (sent by Clerk) | A few minutes; they stop working once used or expired |
| Session keys | Until you log out or the session expires |
| Push tokens | Until Apple or Google report that your device is no longer registered, you register more than 10 devices (the oldest token is then deleted), or you delete your account. Logging out and the notification switches in the app do not delete the token; the switches only change which alerts you get in each space |
| RSVPs, check-ins | Until you delete your account, or the creator deletes their account (which deletes the space) |
| Posts and chat messages | Until you delete your account, or the creator deletes their account (which deletes the space). If you or a moderator remove a post or message, it is hidden from the space but not erased: the text stays on our server until then, and the moderators of the space can still see removed content that was reported on their report desk |
| A TikTok link added to an email or Apple account (ID, username) | Until you unlink or delete your account |
| Reports (who reported, a reference to what was reported, the reason, any note, the decision) | Until the account of the person who reported, the reported user, or the space the report was made in is deleted. A report on a post or message is also deleted when its author removes it or deletes their account |
| Moderation decisions and statements of reasons | Until the account the decision was about is deleted, or the space is deleted |
| Emails you send us, and our replies | As long as we need them to handle your request and any follow-up, such as an appeal |
| Backups | Deleted data disappears from our rolling backups within 15 days |
8. Your rights
You have the right to:
- see the data we hold about you, and get a copy;
- have wrong data corrected;
- have your data deleted. You can delete your account in the app (Me tab > Delete my account) or on our website at https://getthrong.com/delete-account;
- get your data in a machine-readable format (portability);
- object to processing based on legitimate interest;
- ask us to restrict processing while a complaint is checked.
Email christian@darkbyte.dk. We answer within one month. So nobody else can get your data, we may ask you to confirm the request from inside the app while signed in to your account, or ask you questions that show the account is yours.
You may complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, dt@datatilsynet.dk, www.datatilsynet.dk, or to the authority where you live.
9. Fan spaces: what DarkByte and creators are each responsible for
Each fan space is run by its creator. DarkByte and the creator are joint controllers for the personal data of that space (GDPR Art. 26). In short, the arrangement between us says:
- DarkByte runs the app and servers, keeps the data secure, picks and contracts the service providers, handles all requests about your rights, reports data breaches, and provides the platform-level report path and takedown.
- The creator shares the space code (anyone with the code can join) and can remove members afterwards, asks DarkByte to set up moderators (there is no way to appoint them in the app), sets any extra house rules, and decides what is announced to members. The creator and their moderators moderate the space.
- The creator may use member data only inside Throng. Creators may not export, copy or use it for marketing.
- DarkByte is your single contact point. Send all requests to christian@darkbyte.dk, also about a creator's space. You may also contact the creator, who must pass your request to us. You can exercise your rights against either of us.
10. Security
Throng's own data is stored on servers in the EU; what Clerk holds for sign-in, Clerk stores in the USA (section 6). Connections are encrypted (HTTPS). Sign-in codes and login sessions are handled by Clerk. Our own server does not store TikTok or Apple access keys. Access to the servers is limited to DarkByte. Backups are stored on our server with restricted access (only DarkByte can read them; file mode 600) and are deleted within 15 days.
11. Changes
If we change this policy in a way that matters, we tell you in the app before the change applies. The date at the top shows the latest version.