Privacy Policy

• We ask for your email and your public creator handle so we can send you a brief.
• We do not sell personal data, and we do not share it with ad networks or data brokers.
• We never store raw IP addresses — only an irreversible hash.
• We collect public short-form video metadata from TikTok, Instagram Reels and YouTube Shorts to build aggregate trend signals. We do not touch private accounts or private posts.
• Ask us to delete your data and we will. Deleting your account cascades to the data attached to it.

Billing is currently switched off and Bitna is free to use. If we turn it on, payment details are handled directly by Polar as merchant of record — card numbers never reach Bitna's servers.

We do not collect anything outside that table. In particular, no government identifiers, biometrics or health data are requested anywhere in the product.

The sign-up form and the feedback widget need to stop the same person from submitting repeatedly in a short window. To do that we take your IP address, combine it with a secret salt, hash it with SHA-256 and store the first 32 characters. The raw address is written nowhere, and the stored value cannot be reversed back into an IP. It is used solely to compare whether two requests came from the same place.

Our hosting provider (Vercel) keeps ordinary server access logs of web requests under its own retention policy.

• Session cookie — set by Supabase Auth. It only keeps you signed in and is cleared when you sign out.
• Analytics identifiers — set by the Google Analytics 4 and PostHog scripts. PostHog is configured to create person profiles for identified users only.

We run no advertising or retargeting pixels. The analytics scripts load only when their keys are configured in the deployment. Bitna does not show a cookie consent banner, so if you would rather not be measured, block the scripts with your browser settings or a tracker blocker. Briefs and sign-in keep working either way.

Bitna's briefs and Radar are built from metadata about short-form videos posted publicly on TikTok, Instagram Reels and YouTube Shorts. We obtain it through the TikHub API.

What we collect:

• Video — platform video id, public URL, caption, hashtags, audio id, duration, posting time, cover image
• Metrics — point-in-time snapshots of view, like, comment, share and save counts
• Creator — public handle, display name, profile image, follower count, verified badge
• Comments — the text and like count of publicly visible comments

The legal basis is our legitimate interest (GDPR Art. 6(1)(f); Article 15(1)(6) of the Korean Personal Information Protection Act). The interest is producing aggregate signals about which creative formats are breaking out this week, and coaching briefs based on those signals — not monitoring or rating individual creators.

What we do not do:

• We do not sell this data or redistribute it as a data product.
• We do not collect private accounts, private posts, or anything that requires being logged in to see.
• We do not build profiles or identity databases about private individuals. What we process is public posts from accounts that publish publicly.
• We do not run face recognition, location tracking, or inference of sensitive characteristics.
• We do not collect contact details such as emails or phone numbers.

If you want your videos or account data removed, write to sean@notique.co. We delete that creator and their videos along with the attached snapshots, comments and derived signals, and exclude them from future collection.

Brief copy, signal explanations and the automatic triage of support messages are generated with DeepSeek models. What we send is the text and metrics of collected public videos, your own channel's public handle and aggregate metrics (post count, median views, hook mix, posting slots), and the body of a support message.

We do not send email addresses, IP hashes, billing data or account identifiers to the model. Support messages go out with the body, category, page path and language only — never the sender's email.

The following providers help run the service and process data only within the scope we give them.

Several of these operate outside your country, so using Bitna involves an international transfer of the data listed in section 2. If you do not want that transfer, stop using the service and ask us to delete your data. GitHub is used only when the support integration is configured, and issue bodies carry the message and page context but never the sender's email address.

• Account, profile, briefs, diagnosis — kept until you ask for deletion. Deleting the account removes the profile and every row that references it (subscriptions, saved signals, templates, briefs, sign-in tokens) through database-level cascade rules.
• Sign-up records — a submission made before you signed in is stored as a separate row, and the same deletion request covers it.
• Support messages — kept as support history. Deleting your account detaches the ticket from the account (the author field is cleared); deleting the ticket body itself can be requested separately.
• Public video data — only videos discovered in the last 30 days feed the signals. Older data drops out of the product surface. There is currently no scheduled job that purges older raw rows; we delete data on request.
• Billing records — once billing is enabled, transaction records are kept for the period required by applicable commerce and tax law.

Deletion means the database rows are removed; copies inside backups age out with the backup cycle.

You can exercise the following at any time:

• Access — ask for a copy of what we hold about you.
• Correction — have wrong values (handle, niche, market) fixed.
• Deletion — have your account and the data attached to it removed.
• Restriction and objection — ask us to stop sending briefs or to stop analytics processing. Use the same channels if you only want the emails to stop; the unsubscribe link in the brief email is not wired up yet.

Send requests to sean@notique.co or leave them in the feedback widget at the bottom right of the site. Requests sent from the email address on the account are actioned without further identity checks; requests from another address may require one. We respond within 10 days of receipt.

If you are in the EEA or the UK and are unhappy with how we handled a request, you may lodge a complaint with your local supervisory authority. In Korea, the Personal Information Protection Commission (pipc.go.kr) and the Privacy Infringement Report Centre (privacy.kr, 118) handle such complaints.

• All traffic runs over HTTPS.
• Every database table has row level security enabled with no public policy, so the publishable key exposed to browsers can neither read nor write any row — only server code holding the server-only key can.
• API keys and secrets live in deployment environment variables, never in the repository.
• IP addresses are stored only as hashes (section 3).
• Sign-up submissions are rate limited; support submissions are rate limited and screened by a honeypot against bots.
• The internal operations console is password protected and is hidden entirely when no password is configured.

Bitna is not directed at children under 14, and we do not knowingly collect their personal data. If we learn that we have, we delete it without delay.

When this policy changes we update the “Last updated” date on this page. If the purposes or the categories of data change materially, we notify you at the email address on your account first.

Questions, complaints and requests about privacy go to sean@notique.co or the in-app feedback widget. The same address serves as our privacy contact of record.