Privacy Policy

• We ask for your email and your public creator handle so we can send you a brief.
• We do not sell personal data, and we do not share it with ad networks or data brokers.
• We never store raw IP addresses — only an irreversible hash.
• We collect public short-form video metadata from TikTok, Instagram Reels and YouTube Shorts to build aggregate trend signals. We do not touch private accounts or private posts.
• Ask us to delete your data and we will. Deleting your account cascades to the data attached to it.

Billing is currently switched off and Bitna is free to use. If we turn it on, payment details are handled directly by Polar as merchant of record — card numbers never reach Bitna's servers.

We do not collect anything outside that table. In particular, no government identifiers, biometrics or health data are requested anywhere in the product.

The sign-up form and the feedback widget need to stop the same person from submitting repeatedly in a short window. To do that we take your IP address, combine it with a secret salt, hash it with SHA-256 and store the first 32 characters. The raw address is written nowhere, and the stored value cannot be reversed back into an IP. It is used solely to compare whether two requests came from the same place.

Our hosting provider (Vercel) keeps ordinary server access logs of web requests under its own retention policy.

• Session cookie — set by Supabase Auth. It only keeps you signed in and is cleared when you sign out.
• Analytics identifiers — Google Analytics 4 and PostHog load, and set their identifiers, only if you allow them in the banner described below. PostHog is configured to create person profiles for signed-in users only.
• Your visit statistics choice — the allow/decline choice from the banner, and which notice it answered, is kept in your browser's local storage. It is not sent to our servers.

We run no advertising or retargeting pixels. The analytics scripts load only when their keys are configured in the deployment.

Visit statistics (Google Analytics 4) load only after you choose “Allow” in the banner at the bottom of the screen (consent to an international transfer under Article 28-8(1)(1) of Korea's Personal Information Protection Act). Until then the Google Analytics script is not loaded at all, and everything works the same if you never allow it.

• Data collected: a cookie identifier, the pages you view and when, the referring page, browser and device type, and an approximate location inferred from your IP address
• Purpose: usage statistics such as visit counts and which screens are used, so we can improve the service
• Recipient: Google LLC (Google Analytics 4) — contact https://support.google.com/policies
• Destination country: United States · When and how: sent over the network each time you view a page after allowing it
• Retention: 14 months (our Google Analytics event retention setting), then deleted
• How to decline and what happens: choose “Not now” in the banner, or change your choice at any time with “Analytics settings” at the bottom of the page. Declining does not limit briefs, sign-in or Radar.

Product analytics and session replay (PostHog) also load only after you choose “Allow” in the same banner (consent to an international transfer under the same article). Until then the PostHog script is not loaded and nothing is sent. No Bitna feature depends on PostHog, so everything works the same if you never allow it.

• Data collected: an anonymous identifier PostHog keeps in your browser (cookie and local storage), the pages you view and when, the referring page, clicks and other interactions (autocapture) with positions for heatmaps, session replays with input fields masked plus browser console logs, product events (opening a brief, clicking evidence and so on), browser and device type, and an approximate location inferred from your IP address. If you are signed in: your account identifier (profile ID) and platform, market, niche and follower band
• Purpose: to see which screens and features are actually used and where people get stuck, so we can improve the service
• Recipient: PostHog Inc. (PostHog) — contact privacy@posthog.com
• Destination country: United States (PostHog US Cloud, us.i.posthog.com) · When and how: sent over the network while you use the service, after allowing it
• Retention: events for 1 year (the PostHog free-plan retention) and session replays for up to 30 days on the free plan, per PostHog's documentation. If you ask us to delete your data sooner, we delete the person and their events in PostHog.
• How to decline and what happens: choose “Not now” in the banner, or change your choice at any time with “Analytics settings” (declining later stops sending and recording immediately). Declining does not limit briefs, sign-in or Radar.

Bitna's briefs and Radar are built from metadata about short-form videos posted publicly on TikTok, Instagram Reels and YouTube Shorts. We obtain it through the TikHub API.

What we collect:

• Video — platform video id, public URL, caption, hashtags, audio id, duration, posting time, cover image
• Metrics — point-in-time snapshots of view, like, comment, share and save counts
• Creator — public handle, display name, profile image, follower count, verified badge
• Comments — the text and like count of publicly visible comments

The legal basis is our legitimate interest (GDPR Art. 6(1)(f); Article 15(1)(6) of the Korean Personal Information Protection Act). The interest is producing aggregate signals about which creative formats are breaking out this week, and coaching briefs based on those signals — not monitoring or rating individual creators.

What we do not do:

• We do not sell this data or redistribute it as a data product.
• We do not collect private accounts, private posts, or anything that requires being logged in to see.
• We do not build profiles or identity databases about private individuals. What we process is public posts from accounts that publish publicly.
• We do not run face recognition, location tracking, or inference of sensitive characteristics.
• We do not collect contact details such as emails or phone numbers.

If you want your videos or account data removed, write to sean@notique.co. We delete that creator and their videos along with the attached snapshots, comments and derived signals, and exclude them from future collection.

Brief copy, signal explanations and the automatic triage of support messages are generated with DeepSeek models. What we send is the text and metrics of collected public videos, your own channel's public handle and aggregate metrics (post count, median views, hook mix, posting slots), and the body of a support message.

We do not send email addresses, IP hashes, billing data or account identifiers to the model. Support messages go out with the body, category, page path and language only — never the sender's email.

The following providers help run the service and process data only within the scope we give them.

Several of these operate outside your country, so using Bitna involves an international transfer of the data listed in section 2. If you do not want that transfer, stop using the service and ask us to delete your data. The transfers to Google Analytics 4 and PostHog happen only if you allow them in the banner (section 4), and declining does not affect the service. GitHub is used only when the support integration is configured, and issue bodies carry the message and page context but never the sender's email address.

• Account, profile, briefs, diagnosis — kept until you ask for deletion. Deleting the account removes the profile and every row that references it (subscriptions, saved signals, templates, briefs, sign-in tokens) through database-level cascade rules.
• Sign-up records — a submission made before you signed in is stored as a separate row, and the same deletion request covers it.
• Support messages — kept as support history. Deleting your account detaches the ticket from the account (the author field is cleared); deleting the ticket body itself can be requested separately.
• Public video data — only videos discovered in the last 30 days feed the signals. Older data drops out of the product surface. There is currently no scheduled job that purges older raw rows; we delete data on request.
• Billing records — once billing is enabled, transaction records are kept for the period required by applicable commerce and tax law.

Deletion means the database rows are removed; copies inside backups age out with the backup cycle.

You can exercise the following at any time:

• Access — ask for a copy of what we hold about you.
• Correction — have wrong values (handle, niche, market) fixed.
• Deletion — have your account and the data attached to it removed.
• Restriction and objection — ask us to stop sending briefs or to stop analytics processing. If you only want the emails to stop, the unsubscribe link at the bottom of the brief stops them immediately — it works without signing in, and the same page has a button to start them again. Your mail client's own unsubscribe button (Gmail, Outlook) does the same thing.

Send requests to sean@notique.co or leave them in the feedback widget at the bottom right of the site. Requests sent from the email address on the account are actioned without further identity checks; requests from another address may require one. We respond within 10 days of receipt.

If you are in the EEA or the UK and are unhappy with how we handled a request, you may lodge a complaint with your local supervisory authority. In Korea, the Personal Information Protection Commission (pipc.go.kr) and the Privacy Infringement Report Centre (privacy.kr, 118) handle such complaints.

• All traffic runs over HTTPS.
• Every database table has row level security enabled with no public policy, so the publishable key exposed to browsers can neither read nor write any row — only server code holding the server-only key can.
• API keys and secrets live in deployment environment variables, never in the repository.
• IP addresses are stored only as hashes (section 3).
• Sign-up submissions are rate limited; support submissions are rate limited and screened by a honeypot against bots.
• The internal operations console is password protected and is hidden entirely when no password is configured.

Bitna is not directed at children under 14, and we do not knowingly collect their personal data. If we learn that we have, we delete it without delay.

When this policy changes we publish the effective date and what changed on this page, and update the “Last updated” date above.

Changes that materially affect your rights — the purposes, the categories of data, or the retention periods — are announced on this page and by email to the address on your account at least 30 days before they take effect. Notice periods for the Terms of Service are set separately by section 11 of those terms.

• 2026-09-28: Google Analytics 4 now loads only after you allow visit statistics in the banner, and section 4 now describes the international transfer (recipient, country, timing and method, retention, how to decline). If the transfer details change we will ask for consent again.
• 2026-09-28 (second revision): Product analytics and session replay (PostHog) now also load only after you allow them in the same banner, and section 4 lists what is collected, PostHog Inc., the United States and retention. Visitors who had allowed Google Analytics only will see the banner once more.

Notique Inc. is the controller of the personal data described in this policy. Our named privacy contact is Kim Sihyun — reach us at sean@notique.co or through the in-app feedback widget.

Company

Notique Inc. (주식회사 노티크)

Representative

Kim Sihyun (김시현)

Registered address

Room 641-A, 2F, 47, Gangnam-daero 112-gil, Gangnam-gu, Seoul, Republic of Korea (서울특별시 강남구 강남대로112길 47, 2층-641에이호(논현동))

Phone

+82 2 6084 5005

Privacy contact

sean@notique.co

Privacy disputes and infringements can be taken to the Personal Information Dispute Mediation Committee or the Privacy Infringement Report Centre — including when you are not satisfied with how we handled your request.

• Privacy Infringement Report Centre — privacy.kr / 118 (from within Korea)
• Personal Information Dispute Mediation Committee — kopico.go.kr / 1833-6972
• Personal Information Protection Commission — pipc.go.kr