Privacy Policy

Effective and last updated: August 10, 2026

This Policy explains how Spark Short Drama collects, uses, discloses, and retains information when you use the Service as a TikTok Mini in the United States.

1. Scope and controller

Hainan Xinghuo Zhihua Culture Technology Co., Ltd. (“Sparkart,” “we,” “us,” or “our”) operates the Service and is responsible for the information described in this Policy. This Policy does not govern information for which TikTok, BytePlus, or another provider acts independently. Their privacy notices apply to that independent processing.

1A. Key terms

“Personal information” or “personal data” means information linked or reasonably linkable to an identified or identifiable person or household, as defined by applicable law. It does not include lawfully public information, aggregate information, or information maintained in a form that cannot reasonably be linked to a person where we maintain required de-identification safeguards. “Process” includes collecting, using, storing, disclosing, analyzing, deleting, or otherwise handling information. “Service provider” or “processor” means a party that handles information for our documented business purposes under contract.

2. Notice at collection: information we process

We process the following categories of personal information for the stated purposes. We do not collect a separate Spark profile containing your name, phone number, email address, precise location, contacts, or advertising identifier for ordinary viewing.

• Identifiers and authentication data: a one-time TikTok login code; a TikTok Open ID that is stored only as a cryptographic hash; encrypted access and refresh credentials and their expiry times; authorization timestamps; a random authorization-generation identifier; and a random Spark session token stored on our server only as a hash. We use these items to authenticate you, refresh an authorized connection, maintain secure sessions, authorize playback, and process disconnection.
• Viewing and device-local data: the episode requested for playback and one continue-watching record stored only on your device, including drama and episode identifiers, playback position, duration, media version, and update time. We use these items to deliver the requested video and resume it on that device. Spark does not build or store a server-side viewing-history profile.
• Commercial information: internal and TikTok order identifiers, drama and episode identifiers, Bean amount, payment, fulfillment and refund status, sandbox status, timestamps, and resulting episode entitlement. We use these items to process and reconcile an unlock, prevent duplicate fulfillment, provide access, handle refunds and disputes, and meet accounting obligations. We do not receive your card or bank credentials.
• Internet, technical, and security information: network address used briefly for rate limiting; request identifier, method, route, timestamp, status, latency, safe error class, and infrastructure security or delivery logs. We use these items to operate, secure, troubleshoot, and prevent abuse of the Service. Application logs are configured not to record request bodies, tokens, Open IDs, or payment credentials.
• Communications and report information: email address, message, attachments, content link, order reference, and other information you choose to provide. We use these items to answer support and privacy requests, investigate safety or intellectual-property reports, protect rights, and comply with law.
• Inferences: we do not create profiles or infer interests or characteristics for advertising or automated decision-making.

3. Sources of information

We receive information directly from you; automatically from your device and network when you use the Service; and from TikTok, payment callbacks, BytePlus, and the infrastructure and media providers used to operate the Service.

3A. Local storage, cookies, and similar technology

The Mini uses local storage for one continue-watching record and runtime state needed to operate the experience. The Spark viewer session is held in Mini memory rather than persistent browser storage. We do not place third-party advertising cookies or use third-party analytics SDKs. TikTok's host application, VePlayer, BytePlus, and infrastructure providers may use their own storage or network technologies under their respective notices and service configurations. Clearing Mini storage removes the local progress record but does not by itself delete server records or TikTok-controlled information.

4. How we use information

• Provide authentication, secure sessions, catalog access, approved video playback, device-local continue watching, purchases, entitlements, refunds, and customer support.
• Protect the Service, enforce rate limits and our terms, detect fraud or abuse, investigate incidents, and diagnose outages.
• Respond to privacy, safety, legal, and intellectual-property requests.
• Maintain transaction, rights, audit, and compliance records required by law or reasonably necessary to establish, exercise, or defend legal claims.

We do not use personal information for targeted advertising, profiling in furtherance of decisions producing legal or similarly significant effects, or training a general-purpose artificial-intelligence model.

5. How we disclose information

We disclose only the categories reasonably necessary for the following purposes:

• TikTok: identifiers, authentication, playback-request, order, entitlement, report, and technical information needed to host the Mini and provide authentication, reporting, playback authorization, Beans, payment, and related platform services.
• BytePlus and approved content-delivery providers: playback-request and ordinary network information needed to store, transcode, authorize, and deliver approved drama media.
• Alibaba Cloud and other contracted service providers: identifiers, commercial, technical, security, and communication information needed to host the U.S. application server, database, network, backups, security, and email or support services.
• Professional advisers, rights holders, transaction parties, and authorities: relevant information where reasonably necessary to investigate a claim, protect rights or safety, comply with valid legal process, or complete a merger, financing, reorganization, or sale subject to appropriate safeguards.

We require service providers that process personal information for us to use it only for contracted purposes and to protect it consistently with applicable law and this Policy.

5A. Legal requests, safety, and corporate events

We may preserve or disclose information when we reasonably believe it is necessary to comply with applicable law, a valid subpoena, warrant, court order, or other binding process; protect the rights, property, or safety of users, Sparkart, TikTok, rights holders, or the public; detect or address fraud, security, or technical issues; or establish, exercise, or defend legal claims. We review requests for facial validity, scope, authority, and jurisdiction and seek to disclose only what is legally required. We may notify an affected person unless prohibited by law or unsafe to do so.

If Sparkart is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be reviewed or transferred subject to confidentiality and applicable notice requirements. A successor may use covered information only consistently with this Policy unless it provides required notice and obtains required consent for a material change.

6. No sale, sharing, or targeted advertising

We do not sell personal information for money or other valuable consideration. We do not share personal information for cross-context behavioral advertising or process it for targeted advertising. The current Service contains no third-party advertising or analytics SDK. We therefore do not offer a “Do Not Sell or Share” link. If these practices change, we will update this Policy and provide any required notice and opt-out before the change applies.

7. Video-viewing privacy

We do not disclose personally identifiable viewing history for advertising. Spark does not maintain a server-side history of episodes you watch. To fulfill your request, TikTok, BytePlus, and their delivery providers may process the requested episode together with account, device, or network information as described above. We disclose personally identifiable video-request information only in the ordinary course of providing the Service, with informed consent that satisfies applicable law, to you, under qualifying legal process, or as otherwise permitted by law.

Where the U.S. Video Privacy Protection Act applies, personally identifiable video records are destroyed as soon as practicable and no later than one year after they are no longer necessary for the purpose collected, unless a pending lawful request, order, or other statutory basis requires preservation. This does not require deletion of a transaction record that is not personally identifiable viewing information or that another law requires us to retain.

8. Storage and international processing

Our primary Spark application API and database for the U.S. release are hosted in Virginia, United States. TikTok, BytePlus, Alibaba Cloud, and their approved subprocessors may process information in other locations governed by their service configuration and agreements. Authorized Sparkart personnel may access information from countries where we operate, subject to applicable law and TikTok U.S. launch restrictions. We use contracts, access controls, encryption, minimization, and vendor review to protect information transferred or accessed across borders.

8A. Data minimization and purpose changes

We seek to collect only information reasonably necessary and proportionate for the disclosed purposes. Hashing, encryption, short retention, and device-local storage reduce risk but do not automatically remove information from privacy-law protection. Before using personal information for a materially different purpose, we will evaluate compatibility, update this notice, and obtain consent where required. Adding advertising, personalized recommendations, profile data, cross-device history, or a new analytics provider would require a new review before launch.

9. Retention

We retain each category only for as long as reasonably necessary for the purpose described above, then delete or de-identify it unless law requires longer retention:

• The one-time TikTok login code is not persisted.
• Viewer sessions expire after no more than two hours and are removed on disconnect or by the next successful hourly cleanup after expiry.
• Encrypted TikTok credentials and the hashed Open ID are removed on disconnect, authorization removal, or the first successful cleanup after the credential expires.
• Device-local continue-watching progress expires after 30 days of inactivity and is cleared when you remove it or complete disconnection.
• Routine application and gateway security logs and routine encrypted database backups are kept for up to 14 days. Incident evidence may be isolated for longer when reasonably necessary to investigate or meet a legal obligation.
• A minimal hashed deletion record is retained separately for the backup-restoration window solely to prevent deleted authorization data from being restored, then deleted under the approved backup schedule.
• Order, entitlement, refund, fraud-prevention, support, report, and rights records are retained for the applicable transaction, accounting, dispute, legal, and rights-enforcement period. The exact period depends on record type and legal obligations; we consider the amount, nature, sensitivity, risk, purpose, and required limitation period when setting it.

10. Your privacy rights

Depending on your state, you may have the right to know or access personal information; obtain a portable copy; correct inaccuracies; delete information; opt out of sale, sharing, targeted advertising, or certain profiling; limit certain uses of sensitive personal information; appeal a denied request; and receive equal service and pricing without retaliation for exercising a right.

To submit a request, email contact@sparkart.hk with the subject “Spark Short Drama Privacy Request,” or use the steps on our Account Disconnection and Data Deletion page. State the right you wish to exercise and your U.S. state. You may use an authorized agent where applicable. We will verify requests proportionately, respond within the period required by applicable law, explain any denial, and provide appeal instructions where required. Do not send a TikTok password, verification code, payment credential, or identity document unless we specifically provide a protected verification method.

We do not use or disclose sensitive personal information to infer characteristics or for purposes that trigger a right to limit under current California law. Because we do not sell, share, or use personal information for targeted advertising, an opt-out signal such as Global Privacy Control does not change our current processing. We will honor legally recognized signals if our practices change in a way that requires an opt-out.

10A. Request handling, verification, and appeals

• Access and portability: after verification, we provide responsive information in a reasonably usable format. We do not disclose token ciphertext, session hashes, security secrets, information about another person, or material protected by law.
• Correction: Spark does not ordinarily hold profile fields such as name or email for viewing. We can correct support-case information and qualifying inaccurate records; TikTok-controlled account data must be corrected through TikTok.
• Deletion: we delete qualifying information and direct applicable processors to do so, subject to legal exceptions described on the deletion page. Device-local data must be cleared on each device.
• Opt-out rights: the current Service does not sell or share personal information, conduct targeted advertising, or perform covered profiling. A verified request address remains available in case our practices change.
• Verification: we match only information reasonably necessary to protect the account and request. We prefer authentication in the Mini and do not require a government ID unless a higher-risk request cannot reasonably be verified another way.
• Authorized agents: we may require signed permission, evidence of registration where state law requires it, and direct confirmation from the consumer. A valid power of attorney is handled as required by law.
• Appeals: reply to the decision within the period stated in it, use “Privacy Appeal” in the subject, identify the case, and explain the requested reconsideration. We will respond within the applicable statutory period and, when required, explain how to contact the state attorney general.

11. California privacy disclosures

The categories collected during the preceding 12 months, their sources, business purposes, and recipient categories are described in Sections 2 through 5. We have not sold or shared any category of personal information during that period. We do not knowingly sell or share personal information of consumers under 16. California residents may exercise the rights described in Section 10 and may request the categories and specific pieces of personal information collected about them. We will not discriminate against you for exercising a California privacy right.

• California categories collected: identifiers; commercial information; internet or other electronic-network activity; limited approximate location inherent in ordinary network information; and communication content you choose to send. We do not create advertising inferences, collect biometric templates, precise geolocation, protected-class characteristics, health data, or contents of private communications other than messages you deliberately send to us.
• Categories disclosed for business purposes: identifiers, commercial information, internet/network activity, viewing-request information, and communications are disclosed to the recipient categories in Section 5 for hosting, authentication, payment, order fulfillment, media delivery, security, support, legal compliance, and rights protection.
• Sensitive personal information: encrypted access credentials are used only for authentication and requested playback. We do not use sensitive personal information to infer characteristics or disclose it for non-exempt purposes.
• Financial incentives: we do not offer a price or service difference in exchange for collecting, selling, or sharing personal information.
• California “Shine the Light”: we do not disclose personal information to third parties for their own direct-marketing purposes as contemplated by California Civil Code § 1798.83.

11A. Other U.S. state disclosures

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Indiana, Tennessee, New Jersey, New Hampshire, Nebraska, Kentucky, Maryland, Minnesota, Rhode Island, and other states with applicable comprehensive privacy laws may have some or all of the rights described in Section 10, subject to each law's scope, effective date, exceptions, and appeal procedure. We apply legally required recognized opt-out signals. We do not process personal data for targeted advertising, sale, or covered profiling, and do not collect known sensitive data requiring opt-in consent under these laws for the current Service.

Nevada residents may submit a verified direction not to make a covered “sale” through the email in Section 10. We do not currently sell covered information as defined by Nevada law. State-law coverage often depends on revenue, processing volume, business model, or other thresholds; describing a right here does not concede that a particular statute applies where its threshold or jurisdictional requirements are not met.

12. Do Not Track and third-party collection

Some browsers provide a “Do Not Track” setting. Because Spark does not track your activity over time across unaffiliated websites or services for behavioral advertising, the Service does not separately respond to that setting. TikTok, BytePlus, and other providers may independently receive ordinary device and network information when their services load; their own privacy notices and controls govern that independent activity.

12A. Third-party services and external links

The Service may link to TikTok controls, support resources, or other external services. Following a link or using a third party may allow that party to collect information under its own notice. We do not control an independent third party's privacy practices, but we remain responsible for our own disclosures and for service-provider oversight required by law.

13. Children

The Service is a general-audience service, is not directed to children under 13, and may not be used by them. We do not knowingly collect personal information from a child under 13. Persistent identifiers and IP addresses can be personal information under the Children's Online Privacy Protection Act even when a child does not provide a name. If we learn that we collected covered information from a child under 13 without a lawful exception and required parental consent, we will stop processing and delete it as required by law.

A parent or guardian who believes a child under 13 has used the Service should contact us immediately with enough non-sensitive detail to investigate. We may verify the adult's identity and relationship proportionately. Users under the age of legal majority may use paid features only with parent or guardian authorization where required. We do not knowingly sell or share the personal information of anyone under 16.

14. Security

We use administrative, technical, and physical measures designed to protect information, including encryption in transit, encrypted platform credentials at rest, hashed identifiers and sessions, access restrictions, separated deletion records, request-size limits, signed webhooks, and backup controls. No method of transmission or storage is completely secure.

14A. Incident response

We maintain procedures to assess suspected unauthorized access, contain harm, preserve appropriate evidence, correct vulnerabilities, and notify TikTok, processors, authorities, or affected individuals when required by applicable law or contract. Required notice duties and timing vary by state and by the type and risk of information involved. Do not email suspected credentials or exploit details to the ordinary support mailbox; send a concise description and request a protected channel.

15. Changes to this Policy

We may update this Policy to reflect changes in the Service, law, or platform requirements. We will post the revised Policy, update the date above, and provide additional notice before a material change when required by law. Prior versions may be requested using the contact below.

15A. Contacting regulators

You may contact the attorney general or privacy regulator for your state if you believe a concern has not been resolved. California residents can find information from the California Privacy Protection Agency and California Attorney General; Virginia residents may contact the Virginia Attorney General. Contacting us first may allow faster resolution but is not required where law provides otherwise.

16. Contact