Privacy Policy

Last updated: 23 August 2026

This policy explains what Retold collects when you use this website or our mini app inside TikTok, why we collect it, and what control you have over it.

The controller of your personal data is Cupcakes Holdings Ltd, Menachem Begin 144, Tel Aviv, Israel. You can reach us at contact@retold-story.app.

1. Data we collect

Category	What it includes	Why we have it
Waitlist signup	The email address you enter on this site, plus the date, the country your request came from, and your browser's user-agent string	To tell you when Retold launches, and to detect spam and abuse of the form
TikTok account data	Your TikTok open ID (a pseudonymous identifier), display name and avatar image, provided by TikTok when you open the app	To identify your session, save your progress and show you as signed in
Viewing activity	Series and episodes opened, watch progress and completion, playback quality, saves and follows	To resume playback, build your library, and recommend series
Purchase records	Which items you bought, when, the amount, and unlock status. Card and bank details are handled by TikTok's payment system and never reach us.	To grant access to paid content, handle refunds and keep tax records
Device and technical data	Device model, operating system, app and SDK version, language, coarse region, IP address, crash and error logs	To make the service work on your device, fix faults and prevent abuse
Support and reports	Messages you send us, content reports and appeals	To answer you and to review reported content

We do not collect your precise location, contacts, photo library, microphone or camera. We do not knowingly collect special-category data such as health, biometric or political data.

2. Legal bases (where UK/EU-style rules apply)

Consent — your waitlist email address. You can withdraw consent at any time and we will delete it.
Contract — account data, purchase records and the technical data needed to deliver episodes you have asked for.
Legitimate interests — security, fraud and abuse prevention, crash diagnostics, and aggregate product analytics, balanced against your rights.
Legal obligation — tax, accounting and lawful requests from authorities.

3. How we use it

Email you once at launch, and occasionally before then with news about the app, if you joined the waitlist.
Run the app: play episodes, remember where you stopped, sync your library across sessions.
Handle payments and unlocks, and honour refunds.
Recommend series based on what you have watched.
Detect fraud, unlock circumvention, scraping and other abuse.
Measure how series perform in aggregate so we know what to commission next.
Respond to your messages, reports and appeals.

We do not sell your personal data. We do not share it with third-party advertisers for cross-context behavioural advertising.

4. Who we share it with

Cloudflare, Inc. — hosts this website, stores waitlist signups and routes email sent to our contact address, acting on our instructions.
TikTok / ByteDance — as the platform hosting the mini app and processing payments. TikTok's own privacy policy governs what TikTok does with your data as its own controller.
Google LLC — the fonts on this site are served by Google Fonts, which receives your IP address as part of that request.
Authorities, where we are legally required to disclose, and only to the extent required.
A successor, if the business is sold or merged. We will tell you before your data moves to a different controller.

5. International transfers

Retold will be available in Australia, Brazil, Canada, Indonesia, Japan, Mexico, New Zealand, South Korea and Thailand. Data may be processed in the United States and other countries where our providers operate. Where data leaves your country, we rely on recognised safeguards — Standard Contractual Clauses, adequacy decisions, or your consent where required — and apply the same protections described in this policy wherever the data is held.

6. How long we keep it

Waitlist emails: until launch plus 6 months, or until you ask us to remove you, whichever is sooner.
Account and viewing data: while your account is active, then deleted or anonymised within 12 months of your last session.
Purchase and tax records: as long as accounting law requires, typically 7 years.
Crash and security logs: 90 days.
Support correspondence: 24 months after the case closes.

7. Security

We encrypt data in transit with TLS and at rest, restrict internal access to people who need it, and review our controls periodically. No system is perfectly secure, but where a breach is likely to put you at risk we will notify you and the relevant regulator within the time limits the law sets.

8. Children

Retold is not directed at children under 13, and we do not knowingly collect data from them. Some series carry higher age labels and are restricted accordingly. If you believe a child has provided us with personal data, write to contact@retold-story.app and we will delete it.

9. Your rights

Wherever you live, you can ask us to give you a copy of your data, correct it, delete it, or stop a particular use. Write to contact@retold-story.app. We answer within 30 days, or sooner where local law requires, and we do not charge for reasonable requests or treat you differently for making one.

Additional rights by region

Canada (PIPEDA) — you may withdraw consent and complain to the Office of the Privacy Commissioner of Canada.
Australia (Privacy Act / APPs) — you may complain to the Office of the Australian Information Commissioner.
New Zealand (Privacy Act 2020) — you may complain to the Office of the Privacy Commissioner.
Brazil (LGPD) — you have rights of confirmation, access, correction, anonymisation, portability, deletion and information about sharing, and may complain to the ANPD.
Mexico (LFPDPPP) — you have ARCO rights (access, rectification, cancellation, opposition).
Japan (APPI) — you may request disclosure, correction and suspension of use, and contact the Personal Information Protection Commission.
South Korea (PIPA) — you may request access, correction, deletion and suspension of processing.
Thailand (PDPA) — you have rights of access, portability, objection, erasure, restriction and rectification.
Indonesia (PDP Law) — you may access, correct, delete and withdraw consent, and object to automated decisions.

10. Cookies and similar technologies

This website sets no cookies and runs no analytics or advertising trackers. The mini app uses local storage and equivalent identifiers to keep you signed in, remember playback position and prevent abuse; these are strictly necessary to run the service. Where we add optional analytics or personalisation identifiers, we will ask for consent first in regions that require it.

11. Changes to this policy

We will update the date at the top of this page when this policy changes, and for material changes we will give notice in the app before they take effect.

12. Contact and complaints

Cupcakes Holdings Ltd
Menachem Begin 144, Tel Aviv, Israel
contact@retold-story.app

You always have the right to complain to the data protection authority in your country.

Retold is an independent app and is not affiliated with, endorsed by or sponsored by TikTok or ByteDance.