Privacy Policy

WaveGameStream ("we") is a Windows app for streamers who go live on TikTok LIVE: viewer gifts trigger our mini-games or key presses in other games. Using the app requires signing in with a TikTok account, and a paid membership can be bought with PromptPay. This page explains what our server stores, why, for how long, and how to have it deleted.

1. Data we receive from TikTok when you sign in

You sign in on TikTok's own page; we never see or store your TikTok password. With your permission TikTok gives us, per scope:

• user.info.basic: the user IDs TikTok issues for our app (open_id and union_id), your display name and a link to your avatar.
• user.info.profile: your @username, used to fill in your LIVE channel in the app.

We do not ask to post, or to read your videos, messages, followers or earnings. The TikTok access token is used once at sign-in to read the fields above and is then discarded; we store neither access nor refresh tokens.

2. What our server stores

• Account: open_id, union_id, display name, avatar link and @username (refreshed at each sign-in); first-use, last sign-in and last-seen times; number of sign-ins; whether the account is suspended, and an internal admin note if any. Kept until you ask us to delete it.
• Sessions: a random session token (stored only as a hash), the IP address at sign-in, the operating system name (e.g. "Windows 11"), the app version, and start / last-used times. A session expires 60 days after sign-in, or at once when you sign out, and is then deleted.
• Event log: time, type (sign-in, sign-out, failed sign-in, suspension, slip sent, slip reviewed), IP address, app version and TikTok error text. Kept for at most 90 days.
• Payment slips: the transfer slip image you upload, which usually shows the payer's and payee's names, bank, part of the account numbers, amount, time and reference number. Used only to verify your membership payment; only the signed-in administrator can open it; it is never shown on the website or shared. The image is deleted automatically one year after upload.
• Payment records: amount, membership days, status (pending, approved, rejected), the reason for a rejection, upload and review times, and your membership end date. Used to grant and renew membership, show you its status and keep income records. Kept until you ask us to delete it, unless accounting or tax law requires us to keep it longer.
• Chat with the admin: the messages you and the administrator write on the "ติดต่อเรา" (Contact) page, when they were sent and whether they were read. Only you and the administrator can read them. Deleted automatically one year after they were sent.
• Website sign-in cookie: a random token linked to your account (stored only as a hash), created when you sign in with TikTok on the website or press "สมัครสมาชิก" (Subscribe) in the app, so the website knows it is you. Lasts 30 days after a website sign-in (one day when opened from the app), or until you sign out.
• Sign-in check cookie: a one-time random value kept while you are on TikTok's sign-in page, so nobody can sign you in to their account. Lasts 10 minutes, or until you come back from TikTok.

The app keeps its session token on your PC, encrypted by Windows, and checks with the server from time to time that you are still signed in. You pay with PromptPay in your own banking app: we never see your banking password, card or account details beyond what is on the slip you choose to send us.

3. Data that stays on your PC

Settings, gift rules, key-press rules, the WIN counter, game settings and any pictures or sounds you import stay on your computer. During a LIVE the app reads viewer names, avatars, gifts, chat and likes from your LIVE to show them in the game; this is processed on your PC and is not sent to our server. The LIVE connection uses the open-source TikTokLive library, which calls a third-party signing service (Euler Stream) with what it needs to connect, such as the channel or LIVE room you connect to and your Sign API key if you set one. That service has its own privacy policy.

4. How we use the data

To confirm you own the TikTok account, to show your name and avatar in the app and fill in your LIVE channel, to verify membership payments and grant or renew membership, to tell you about updates, to prevent abuse and keep the service secure, and to count users and overall usage. We do not sell your data, use it for advertising, or share it with anyone unless the law requires it. This website uses no tracking cookies, ads or analytics; the only cookies are the ones website sign-in and the admin page need to work.

5. Deletion and your rights

You can ask to see, correct or delete all of your account data at any time by email (see Contact below); we will delete your account, sessions, slip images and related log entries (except payment records the law requires us to keep). Signing out in the app ends that session at once. You can also revoke the app in your TikTok account settings (app and service permissions); this stops future sign-ins but does not delete what we already hold, so please email us as well.

6. Security

Sign-in uses TikTok's OAuth with PKCE. The TikTok client secret lives only on our server, never in the app. Session tokens are stored as one-way hashes, and the admin page is password protected. Slip images are stored outside the public website and can only be opened by the signed-in administrator.

7. Age

The app is for people who may use TikTok and TikTok LIVE under TikTok's terms. We do not knowingly collect data from anyone below that age.

8. Changes

If we change what we collect or how we use it, we will update this page and the date at the top.