Privacy Policy

Last updated: 2026-05-06. Working draft pending counsel review.

1. Who we are

DecKid ApS, Copenhagen, Denmark ("we") operates RapBattle under the LabelKid umbrella. We are the data controller under the EU General Data Protection Regulation (GDPR) for personal data processed via this service.

2. What data we collect

From TikTok Login: your TikTok stable identifier (open_id), display handle, avatar URL, and follower count, with your consent at sign-in.
From the Display API: public metadata about videos you submit as entries — video ID, share URL, sound ID, posted timestamp, and engagement counts (views, likes, shares, comments, saves).
Drafts we send via the Content Posting API (Inbox mode):when you tap "Send to TikTok drafts", we upload a video file to your TikTok drafts. You then open the TikTok app, type your own caption, add the sound and hashtag, and publish from inside TikTok. In this mode we never publish on your behalf and we never set caption, sound, or privacy on your behalf.
Posts we send via the Content Posting API (Direct Post mode):when you tap "Post entry to TikTok", RapBattle posts your selected or recorded video to your TikTok account on your behalf, with the caption, privacy setting, interaction controls (comment/duet/stitch), AI-generated content disclosure, and branded-content disclosure that you reviewed and confirmed on the Export page. We never post without your explicit per-post Confirm tap. While our app is in TikTok's Content Posting audit, every Direct Post is set to "Only you" (private to your account); you can change that visibility yourself inside the TikTok app afterwards. For each post we store: the caption text, privacy level, interaction control settings, disclosure flags (AI-generated, your-brand, branded-content), the TikTok creator_info response we used to build the page, the consent timestamp, your user-agent, your IP address, and the TikTok publish_id and log_id. We do not retain the uploaded video bytes after TikTok confirms the post is processed. We do not schedule, queue, or repeat posts.
Webhook events from TikTok:after we send a draft (Inbox) or post a video (Direct Post), TikTok notifies our server when the post finishes publishing (or fails). We store the event ID, type (publish-completed/publish-failed), timestamp, and the resulting video's public metadata so we can register your battle entry.
From your in-app activity: bets placed, predictions, Bars currency transactions, lounge messages, notification preferences, age you provide at signup.
Technical data: IP address, device, browser, and standard log data.

3. Why we collect it

To provide the tournament gameplay and prediction features.
To compute engagement scoring and bracket outcomes.
To assemble draft TikTok posts for one-tap battle entry, which you either finalize inside the TikTok app (Inbox mode) or post directly after reviewing on our Export page (Direct Post mode).
To register your entry the moment your post is published, via webhook events from TikTok.
To keep an audit trail of each Direct Post (caption, privacy, controls, disclosures, consent timestamp + IP + user-agent) so we can reproduce what you saw and confirmed if a post is ever disputed.
To prevent fraud and abuse.
To send notifications you opted into.
To meet legal obligations, including age verification.

4. Lawful basis

Consent (TikTok Login, optional notifications) and contract performance (running the gameplay you signed up for).

5. Sharing

We do not sell personal data. We share with: TikTok (for OAuth and Display API calls); our hosting providers (Vercel, Supabase); and legal authorities when required.

6. Retention

TikTok-derived fields are purged within 30 days of deauthorization or account deletion. Aggregate, anonymized statistics may be kept for product reporting.

7. Your rights (GDPR)

You may at any time request access, rectification, erasure, restriction, portability, or object to processing. Contact us at the email below. You may also lodge a complaint with the Danish Data Protection Agency (Datatilsynet).

8. Contact

niclas@deckid.com

This is a working draft. Final Privacy Policy will be drafted with Danish counsel before public launch and will replace this version.