Scope and responsibility
AnytimeViral is owned and operated by Haney Hatson, an individual. Anytimeviral.com (AnytimeViral, we, us or our) is preparing a research workspace for public TikTok profiles and content. We are responsible for deciding how account and service information is used as described here. Our operator, contact address and privacy email are listed above. AnytimeViral is not represented as a registered corporation.
Production account services use separate Production authentication and database resources; the Sandbox uses development resources. Live subscription checkout is configured for authenticated accounts with access to the service. A subscription payment requires the buyer's approval in PayPal; account registration alone does not authorize a charge. Billing configuration does not itself approve public website publication.
Account information
Clerk handles signup, email verification, password authentication and sessions. Account information can include email address, username, optional first and last name, profile image and an authentication identifier. Phone authentication is disabled. The application does not ask for your TikTok password.
Our server resolves the authenticated identity and stores its Clerk identifier and primary email in an application user record. Plan, access status, credit balance and trial dates are maintained separately. Password entry and authentication verification are handled by Clerk, not stored in the application users table.
Google sign-in requests openid, https://www.googleapis.com/auth/userinfo.email and https://www.googleapis.com/auth/userinfo.profile. These permissions identify your Google account and provide your email address and available basic profile information, such as your name and profile image. Google and Clerk process this information to authenticate you. AnytimeViral uses the Clerk identity and primary email for account access and synchronization, and available name/profile image for account display. These permissions do not provide access to Gmail messages, Google Drive files, Google Contacts or Calendar content. The application does not request those permissions or use Google account data for advertising.
Research and saved information
When research is available, we process TikTok usernames, niche keywords and hashtags that you submit, analysis type, time, status and credits spent. Completed Search History can contain normalized public profile and content information: creator identifiers, names, captions, hashtags, content types, media references and available engagement counts. This information comes from third-party public-content data services, not from a private TikTok login. These are planned or existing-record data categories, not a statement that live research is available during public pre-launch.
Saved Results reference stored searches and include titles and optional notes. Own-account snapshots record available metrics and capture times for historical comparison. Public creator information can still be personal information. Do not submit sensitive personal information or information you are not entitled to use in queries or notes.
Results describe available data, not guaranteed platform-wide coverage or predictions. Missing data remains unavailable; historical comparisons require actual snapshots. Video discovery may return no results even when photo discovery returns content.
Payments and subscription records
If a subscription is enabled and approved, PayPal handles payment approval and payment credentials. AnytimeViral maintains payment-provider customer, subscription and plan identifiers, subscription status, billing periods, trial dates, payment-event identifiers and credit-grant records to reconcile access and prevent duplicate grants. Existing payment records and webhook reconciliation may continue while new checkout is disabled. Account registration and unpaid early-access requests do not authorize a payment. The application does not store full card numbers or PayPal buyer passwords.
A browser return from checkout is not proof of payment. Access and credits depend on verified server-side payment and subscription information. Current Sandbox tests do not represent live purchases. PayPal processes payment information according to its own applicable privacy terms.
Purposes and applicable legal bases
We use identity and research information to provide account access, run requested analyses, reopen history and maintain saved results. We use subscription and payment records to administer the chosen service and reconcile credits. We use limited security information to prevent abuse, enforce account ownership and investigate service failures.
Where applicable law requires a legal basis, processing needed for your requested account, research and subscription service is based on performance of the user contract; proportionate service security and fraud prevention rely on legitimate interests where legally permitted; and mandatory records are retained to comply with legal obligations. If an activity requires consent, that consent must be obtained for that activity and may be withdrawn as applicable. These descriptions do not assert that consent covers every operation or that every legal basis applies in every jurisdiction.
For public creator information about people who are not account holders, a user contract is not by itself a legal basis for processing their data. Where legally permitted, proportionate public-content research may rely on legitimate interests, subject to assessment of necessity, impacts and safeguards. Public availability alone is not consent. Applicable bases and public-creator disclosure obligations require review before launch, and relevant data-rights requests can be made through our privacy contact.
We do not offer automated decisions with legal or similarly significant effects based on research analytics. Available engagement calculations describe public content; users decide how to use the findings.
Cookies and browser storage
Clerk uses authentication/session cookies and related browser state to maintain sign-in. The compact-table preference is saved in local storage under anytimeviral:compact. Session storage holds an analysis retry identifier associated with the analysis type and entered target, helping avoid a second charge after a connection interruption.
The current application has no marketing pixel or dedicated visitor-analytics SDK. Application research analytics are calculations on requested TikTok data, not advertising tracking of landing-page visitors. Hosting and authentication providers can process technical request data under their own service terms. Optional future tracking would need a separate review and appropriate notice or choices before introduction.
Browser controls can clear stored preferences and session data; blocking necessary authentication storage can prevent sign-in. Signing out ends the current application session but does not erase saved research or billing records.
Security and operational information
Application event logs use a limited event name, success/failure outcome and, where applicable, an internal record identifier. Database operation timestamps, request identifiers, credit transactions and per-user request counters support abuse prevention and accounting. Hosting/authentication services may separately process IP addresses, device/browser details and diagnostic information needed to deliver their services.
The application uses server-side data access, authenticated ownership checks and database security policies. These measures reduce risk but do not guarantee absolute security. Do not send passwords, payment credentials or API keys in support messages.
Recipients and service providers
The current service uses Clerk for authentication, Supabase for database hosting and Netlify for application hosting. Google processes Google sign-in under its own privacy terms. PayPal receives information required for approved checkout and subscription handling and has its own payment-service privacy obligations. Our support/privacy mailbox is hosted by Proton; information you email is processed to answer your request. You do not have to email sensitive documents to open a request.
For enabled research, the integration uses Tikfly's tiktok-api23 service through RapidAPI. It sends the public account handle, keyword or hashtag and necessary query options, not your Clerk password or PayPal payment credentials. Live Production research is not available during public pre-launch. Optional Upstash caching, when enabled, holds normalized public research for up to 15 minutes, not authentication secrets or private account records. Research-provider access is not a license to reuse creator media or proof of a lawful basis for every public-data operation.
Media displayed from third-party sources may involve requests to the media host. Necessary service providers receive information required to operate these functions. We may also disclose information where required by law or reasonably necessary to address security threats, protect rights or resolve disputes, subject to applicable law. We do not sell personal information through the current application or use it for cross-context advertising.
Provider processing is subject to the applicable service terms and arrangements. This policy does not invent vendor certifications, specific contractual commitments or guarantees about their handling of information.
Retention and deletion
Account and service information may be retained while your account is active and afterward only as reasonably necessary to operate the service, prevent security threats and fraud, resolve disputes, enforce agreements, maintain accounting and payment records, and comply with legal obligations. We do not prescribe a fixed deletion period that the application does not implement.
Removing a Saved Result removes its bookmark and notes, not the underlying Search History. The current application does not provide an automated whole-account export/erasure workflow or retention purge. Changing or deleting a sign-in identity does not by itself remove application database or payment records. Optional normalized-data caching expires after 15 minutes when enabled; browser storage follows the browser/session lifecycle.
When deletion is requested, applicable data will be deleted or anonymized, subject to legal, security and operational retention requirements and verification of the request. Retained information should be limited to what those requirements justify. We do not promise instant removal from all systems or backups. Requests may require coordination with relevant service providers; applicable legal response requirements remain unaffected. We review what must be retained case by case, restrict any retained records to the justified purpose, and address the request again if a backup is restored. Deleting a sign-in identity does not cancel an active PayPal subscription; cancellation and necessary payment-record retention must be handled separately.
International processing
The operator is based in India and may access account and support information there. Service providers and their subprocessors may process information in other countries, including the United States. The Production application uses a separate Supabase database in Frankfurt, Germany (eu-central-1). The protected Sandbox uses the separate development database. A database region alone does not establish where all hosting, authentication, payment and support processing occurs.
Netlify, Clerk and Supabase publish data-processing terms describing applicable contractual safeguards, including standard contractual clauses for transfers within their scope. Publication of those terms is not evidence that every account-specific requirement, transfer assessment or controller obligation has been completed. Google and PayPal also describe their own international processing arrangements. We do not claim that all processing stays in the EU or that every transfer has been cleared. Where a proposed transfer requires a safeguard not yet established, the affected processing must not proceed until it is resolved.
You can ask our privacy contact for information about the countries, recipients and applicable safeguards relevant to your request, and a copy or explanation of relevant contractual safeguards subject to appropriate redactions. Research-provider arrangements and our own controller obligations still require review before affected research is activated; these disclosures do not themselves establish a legal basis or content license.
Your choices and rights
Depending on applicable law and the circumstances, you may have rights to information, access, correction, deletion, restriction, portability or objection, and to complain to the relevant data-protection authority. Where processing relies on consent, applicable withdrawal rights must be respected. These rights are not an unconditional promise to delete every accounting record or disclose another person's information.
Send privacy and data-rights requests to anytimeviral@proton.me. Identify the account or public-content information concerned and the request you want to make; do not include passwords or payment credentials. We may require proportionate identity verification before fulfilling sensitive requests, and may ask for clarification where needed. We will assess requests under the law that applies, explaining any applicable retention or rights-of-others limits.
We handle requests manually and respond within the time required by applicable law. Where EU GDPR applies, this is generally within one calendar month, with a permitted extension of up to two further months for complex or numerous requests and notice within the first month. Other laws can have different deadlines and verification rules. We will explain any lawful refusal or extension and applicable complaint routes; submitting a request does not require buying a subscription.
You can update supported profile details through the account menu and remove saved bookmarks in Saved Results. Access, correction, deletion, portability, objection or restriction requests are handled through the privacy contact where legally applicable; they are not universal or unconditional rights for every user. No GDPR, CCPA or other compliance certification is claimed.
Eligibility and children
You must be at least 18 years old and have the legal capacity to enter into these Terms. If using the Service for an organization, you must have authority to act for it. We do not claim an automated age-verification system.
The Service is not intended for anyone under 18. If you believe an under-18 person has provided account information, contact anytimeviral@proton.me so we can assess and address it under applicable law.
Changes to this policy
We may update this policy to reflect service changes or applicable requirements. The last-updated date identifies the version of this document, not a production-launch date. Material changes will be communicated appropriately. New processing purposes or optional tracking must receive any notice or choices required by applicable law.
Contact and requests
Find the current contact availability on our Contact page. Read our Privacy Policy and Terms of Service.