Privacy Policy

Effective and last updated: August 5, 2026

This Policy explains how Spark Short Drama handles information when you use the Service as a TikTok Mini.

1. Who controls your information

Hainan Xinghuo Zhihua Culture Technology Co., Ltd. (“Sparkart,” “we,” “us,” or “our”) operates the Service and controls the information described in this Policy, except where TikTok, BytePlus, or another provider independently determines its own processing.

2. Information we process

• TikTok authentication information: a one-time login code, a TikTok Open ID that we store only as a cryptographic hash, encrypted access and refresh credentials, authorization timestamps, and a random authorization-generation identifier.
• Service session information: a random session token held in Mini memory and stored on our server only as a hash, together with creation and expiry times.
• Viewing information: the episode requested for playback. Continue-watching position is stored on your device and is not associated with a server-side viewing-history profile.
• Purchase and entitlement information: internal and TikTok order identifiers, episode and drama identifiers, Bean amount, payment/fulfillment/refund status, sandbox status, timestamps, and the resulting episode entitlement. We do not receive your card or bank credentials.
• Technical and security information: network address used briefly for rate limiting, request identifier, method, path, timestamps, error class, and security or delivery logs generated by infrastructure providers. We configure application logs not to record request bodies, tokens, Open IDs, or payment credentials.
• Communications and reports: your email address, message, attachments, content link, order reference, and other information you choose to provide when requesting support, exercising privacy rights, or reporting content.

3. Sources

We receive information from you, your device, TikTok, payment callbacks, and the infrastructure and media providers used to operate the Service. We do not require a separate Spark profile containing your name, phone number, or email address for ordinary viewing.

4. How and why we use information

• Authenticate users and maintain secure sessions.
• Provide approved video playback and device-local continue watching.
• Create orders, confirm payment, deliver episode access, prevent duplicate fulfillment, and handle refunds.
• Protect the Service, enforce rate limits, investigate abuse, and diagnose outages.
• Respond to support, privacy, safety, and intellectual-property requests.
• Comply with legal, accounting, platform, and rights-holder obligations.

Depending on applicable law, these activities rely on performance of our agreement with you, our legitimate interests in operating and securing the Service, compliance with law, or consent where required.

5. When information is shared

We share only what is reasonably necessary with:

• TikTok, which hosts the Mini environment and provides authentication, reporting, playback authorization, Beans, payment, and related platform services.
• BytePlus and content-delivery providers, which store, transcode, authorize, and deliver approved drama media.
• Alibaba Cloud and infrastructure providers, which host our U.S. application server, database, network, backups, security, and email services.
• Professional advisers, rights holders, authorities, or other parties where reasonably necessary to investigate a claim, protect rights and safety, complete a corporate transaction, or comply with law.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising, and the first release does not use in-app advertising.

6. Storage and international processing

Our primary Spark application API and database for this U.S. release are hosted in Virginia, United States. TikTok, BytePlus, Alibaba Cloud, and their approved subprocessors may process information in locations governed by their service configuration and agreements. Authorized personnel may process requests from locations where we operate, subject to applicable law and TikTok U.S. launch restrictions. We use contractual, access-control, encryption, and minimization measures appropriate to the processing.

7. Retention

• The one-time TikTok login code is not persisted.
• Viewer sessions expire after no more than two hours and are removed on disconnect or by the next successful hourly cleanup after expiry.
• Encrypted TikTok credentials and the hashed Open ID are removed on disconnect, authorization removal, or expiry cleanup when no longer usable.
• Device-local continue-watching progress expires after 30 days of inactivity and is cleared when you remove it or complete disconnection.
• Routine application and gateway security logs are kept for no more than 14 days unless a specific security incident or legal obligation requires isolation and longer preservation.
• Routine encrypted database backups are kept for up to 14 days. A minimal hashed deletion record may be retained separately long enough to prevent a restored backup from recreating deleted authorization data.
• Order, entitlement, refund, fraud-prevention, support, report, and rights records are kept only as long as reasonably needed for service delivery, accounting, dispute handling, rights protection, and legal obligations.

8. Your rights and choices

Depending on where you live, you may request access, correction, deletion, restriction, objection, or portability of covered information, and may appeal a denied privacy request where applicable. You may also disconnect the Service from TikTok Manage apps. We may verify your request and may retain limited records where required by law, needed to complete transactions, protect security and rights, or prevent deleted data from reappearing in a backup.

California residents may have rights to know, access, correct, or delete covered personal information and to receive equal service when exercising those rights. Because we do not sell personal information or share it for cross-context behavioral advertising, there is no sale/sharing opt-out needed for the current Service.

Instructions are available on our Account Disconnection and Data Deletion page.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from a child under 13. If you believe a child has provided information contrary to this Policy, contact us so we can investigate and delete it as appropriate.

10. Security

We use measures including encryption in transit, encrypted platform credentials at rest, hashed identifiers and sessions, access restrictions, separated deletion records, request-size limits, signed webhooks, and backup controls. No method of transmission or storage is completely secure.

11. Changes

We may update this Policy to reflect changes in the Service, law, or platform requirements. We will update the date above and provide additional notice when required.

12. Contact