Get the app

distribot · Privacy Policy

Privacy Policy

Last updated: 6 October 2026. This is the only privacy policy for distribot. It covers the distribot iPhone app (section 1) and the website distribot.de (sections 4 to 9) in one document, and sections 2, 3 and 10 to 17 apply to both. There is no separate app policy: the app links to this page from your profile.

1. The distribot app

The short version: you sign in to distribot with your own TikTok account. The app then reads which videos you have published on TikTok — it does not publish anything itself. You set a weekly goal of 3, 5 or 7 posting days, every calendar day on which you published at least one public video counts towards it, and Pip the penguin shows you an idea for your next post. For that we process the data described below — no more than the app needs, never for advertising, and never sold.

  • We process your account, which is created from your TikTok account, the settings you choose (your topic, your weekly goal, your penguin's name and your reminders), your weeks and, from TikTok, information about your own videos.
  • The app contains no advertising, no analytics or tracking tool and no crash reporting service, and it does not use the Advertising Identifier (IDFA).
  • You can delete your account inside the app at any time (tap your picture, then “Delete account”). That removes your account and everything connected to it from our systems.

1.1 Signing in with TikTok, and your account

The app only works with an account, because your weeks, your settings and your TikTok connection have to be stored somewhere that survives a new phone. There is one way to sign in: “Continue with TikTok”. You sign in on TikTok's own page or in the TikTok app — we never see your TikTok password — and you decide there which permissions you grant. The app asks for exactly two: reading your basic profile information and reading the list of your own videos. It does not ask for permission to publish, change or delete anything on your account, and it does not ask to read your followers or your messages.

When you sign in, TikTok gives us:

  • an account identifier, your display name and the address of your profile picture,
  • the permissions you granted,
  • an access token and a refresh token, which let our servers make the requests described in section 1.4 within those permissions.

Your distribot account is created from this account identifier. Together with it we store when your account was created and when you last signed in, and our backend records sign-in events (such as the time, the type of event and the IP address) in order to keep the service secure and to detect abuse. We do not receive your email address or your phone number from TikTok.

The tokens never reach your phone. They are kept on our servers in an area the app itself cannot read; the long-lived refresh token is stored in an encrypted secret store. We use them for one thing only: to ask TikTok for your basic profile information and for the list of your recent videos, so that the app can show your profile and count your weeks.

When you sign in, the app also sends us your device's time zone. We store it with your account, because days are counted by the calendar where you are and end at midnight in that time zone.

TikTok processes the sign-in on its side as a controller in its own right, under its own terms and its own privacy policy: TikTok Privacy Policy.

Legal basis: Art. 6(1)(b) GDPR — the account and the TikTok connection are necessary to provide the app to you. The sign-in logs are processed under Art. 6(1)(f) GDPR; our legitimate interest is the security of the service.

1.2 Your topic, your goal, your penguin and your weeks

With your account we store:

  • the topic you post about, which you choose when you set up the app and can change later — we use it only inside the app, to tailor what Pip shows you, such as ideas (section 1.3),
  • your weekly goal: how many days a week you want to post (3, 5 or 7),
  • the name you gave your penguin (the default is “Pip”),
  • your time zone (section 1.1),
  • whether reminders are switched on (section 1.5),
  • your weeks: the start and end of the current week, the days in it that counted, how many weeks in a row you have reached your goal, your best run so far, and whether the app still has to show you a finished week.

Your weeks are calculated on our servers, not on your phone, by fixed rules: a week is a block of seven days that starts on the day of your first counted video; a calendar day counts once TikTok lists at least one public video of yours that was published on that day, wherever you published it; and a day counts at most once, however many videos you publish on it. A day that has counted stays counted, even if you later delete the video or make it private. Legal basis: Art. 6(1)(b) GDPR.

1.3 Post ideas

Pip shows you one idea for a post at a time, and you can ask for another one. The ideas come from a fixed collection of ideas; where the app takes your topic into account, it does so only to choose among them. They are not generated from your videos, from what you write, or from any other data about you, and choosing them involves no profiling. Whether you use an idea is up to you. Legal basis: Art. 6(1)(b) GDPR.

1.4 Reading your videos

The app only reads. It does not publish, change or delete anything on your TikTok account, and it does not access your camera, your microphone or your photo library.

When you open the app and whenever it refreshes your weeks, our servers ask TikTok for the list of your recent public videos. TikTok answers with information about each video. We process:

  • its reference number and the time it was published — to count your days, so that no video is counted twice and your weeks can be recalculated;
  • its title or description, the address of its cover image and its link on TikTok — so that the app can show your last 30 days with a small card for each video, and open it on TikTok when you tap it.

We keep this information for each of your videos as long as your account exists. Where TikTok's answer also contains public figures such as the number of views or likes, the app does not show them and we do not use them for anything; the app judges posting, not performance. We never request or store the video file itself.

  • What counts. A video counts whether you made it in the TikTok app or elsewhere, as long as TikTok lists it as a public video of the connected account. Videos that TikTok does not list for your account, such as private ones, do not count.
  • Cover images. The cover images are loaded by your iPhone directly from TikTok's servers when the app shows them. In doing so your iPhone transmits its IP address to TikTok, as with any image loaded from the internet.

TikTok processes our requests as a controller in its own right under its own terms and its own privacy policy. We have no influence over what happens on TikTok's side and cannot delete anything there.

You can disconnect TikTok at any time in the app (tap your picture, then the TikTok card, then “Disconnect”). That deletes both tokens straight away. The account identifier, display name, profile picture address and granted permissions stay stored, marked as disconnected, until you connect again or delete your account. You can also remove distribot from the list of connected apps in your TikTok settings. Legal basis: Art. 6(1)(b) GDPR — you ask us to count your TikTok videos, and we cannot do that without the connection.

1.5 Reminders

Reminders have one switch in your profile. If you switch them on and allow notifications, Pip reminds you at most once a day, at the hour you usually post (worked out from the publication times of your past videos; 18:00 until there are any), and only on days on which nothing has counted yet. After a counted video he may confirm that a week has started or that you reached your goal, and three days after a week that got away he sends one “Missing you” — then nothing until your next post. A reminder contains your penguin's name, where your week stands and the current idea. To know whether you have already posted, the app refreshes your weeks from our servers, also in the background where iOS allows it. What we store is only whether reminders are switched on. iOS asks you once whether the app may show notifications, and you can withdraw that permission at any time in the iOS settings. Signing out removes all scheduled reminders from the device. Legal basis: Art. 6(1)(b) GDPR.

1.6 What stays on your iPhone

The app keeps your sign-in session in the iOS keychain, remembers whether you have already been through the introduction, and holds the reminders it has scheduled. It sets no cookies. Nothing of this is used to track you. Storing this information on your iPhone is strictly necessary to provide the app you asked for (§ 25(2) no. 2 TDDDG); the processing is based on Art. 6(1)(b) GDPR.

1.7 Tracking and advertising

The app contains no advertising network, no analytics or measurement tool, no crash reporting service and no third-party tracking SDK. It does not use the Advertising Identifier (IDFA) and does not ask for App Tracking Transparency permission, because it does not track you. We do not use your data for advertising, we do not build profiles for advertising or for any purpose outside the app — the only value we derive is the hour you usually post (section 1.5) — and we do not sell or rent your data to anybody.

1.8 Where the app's data is hosted

The app's backend — the account system, the database and the functions that talk to TikTok — is operated for us by Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, as our processor under Art. 28 GDPR. The database is located in Frankfurt am Main, Germany. Our contract with Supabase includes a data processing agreement and the EU Standard Contractual Clauses (section 11).

1.9 Crash reports prepared by Apple

For completeness, there is one more path by which information about the app can reach us, and it runs through Apple, not through the app. If you have switched on Settings → Privacy & Security → Analytics & Improvements → Share With App Developers on your iPhone, Apple may make crash reports and coarse usage statistics about the app available to us through App Store Connect.

That switch belongs to your iPhone, not to us: we cannot turn it on, we are not told whether it is on, and we can turn it off for nobody. What arrives is prepared by Apple, is not linked to a name, an account or a device we could identify, and we use it for one thing — finding out that the app crashed and why. If you would rather we never see even that, turn the switch off; the app works exactly the same either way.

Legal basis. In so far as these reports, as prepared by Apple, have any personal reference at all, we rely on Art. 6(1)(f) GDPR; our legitimate interest is finding and fixing crashes of the app. You may object under Art. 21 GDPR — although the switch on your iPhone works faster, because with it off nothing is made available to us in the first place.

1.10 Deleting your account

In the app, tap your picture, then “Delete account”. After you confirm, we disconnect TikTok and delete both tokens, and delete your account together with your topic, your settings, your weeks and your video records. Nothing on your TikTok account is changed or removed. Details are on our Data deletion page.

1.11 Do you have to provide this data?

You are not legally obliged to. Without signing in with TikTok, however, the app cannot be used, and without a connected TikTok account no video can be read and no day can count. Your topic, your goal and your penguin's name are up to you, and reminders are optional.

2. Controller

The controller responsible for the processing described in this policy within the meaning of Art. 4(7) GDPR is:

Aron Taner
Burgfriedstr. 15
83024 Rosenheim
Germany

Email: hello@distribot.de
Phone: +49 160 98123994

A data protection officer does not have to be appointed: under Art. 37 GDPR in conjunction with § 38 BDSG (German Federal Data Protection Act), the obligation begins at 20 people permanently engaged in the automated processing of personal data, and we are far below that. You can address all data protection matters directly to the contact details above.

3. Scope of this policy

There is one privacy policy for everything we run, and this is it. Section 1 covers the distribot iPhone app, sections 4 to 9 cover the pages served under distribot.de, and the remaining sections apply to both. The app links to this page rather than carrying a policy of its own, so that there is never a second version that can drift out of date. This policy does not cover websites or services we link to or that you connect, such as TikTok; those are the responsibility of their own operators. It also does not cover Apple's own processing when you download the app from the App Store — that is described in Apple's own privacy policy.

4. What this website does — and what it does not do

This website is an information page about the distribot app. It has no user account, no login, no payment, no sign-up of any kind and no form at all. There is nothing here for you to fill in and send to us.

It makes no connection to any account of yours, and it embeds no content from third-party services — no external fonts, no video players, no social plugins, no advertising network. When you open a page, your browser talks to our hosting provider and to nobody else, unless you have consented to analytics (section 8). The penguin and the small week demo on the home page run entirely in your browser and send nothing anywhere.

Consequently the only data that can arise about you here is: the technical connection data your browser has to transmit for the page to load at all (section 5), the record of your own cookie decision on your device (section 7), optional analytics data if you consented (section 8), and whatever you choose to write to us by email (section 9).

5. Hosting and server log files

This website is hosted and delivered by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (Cloudflare Pages and CDN). Cloudflare processes data on our behalf as a processor under Art. 28 GDPR; a data processing agreement is in place.

Every time a page is retrieved, your browser necessarily transmits data that is recorded in server log files:

  • your IP address,
  • date and time of the request,
  • the page or file requested and the amount of data transferred,
  • the HTTP status code (whether the request succeeded),
  • the referring URL, if your browser sent one,
  • browser type and version, and operating system.

This data is technically unavoidable: without your IP address the response cannot reach your device. We use it to deliver the website, to keep it available and secure (in particular to detect and fend off attacks and abuse) and to diagnose faults. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure, stable and error-free operation of the website. We do not merge this data with other data sources, we do not use it to identify you, and we do not build profiles from it.

Further information from Cloudflare: cloudflare.com/privacypolicy.

6. Fonts

The fonts “Fredoka” and “Nunito Sans” are stored on our own hosting and delivered together with the website. No connection is made to Google Fonts or to any other font service, and no data is transmitted to a third party in order to display type.

7. Cookies and storage on your device (§ 25 TDDDG)

Storing information on your device, or reading information already stored there, requires your consent under § 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act, formerly TTDSG) — unless it is strictly necessary to provide a service you expressly requested.

Strictly necessary — no consent required

Your cookie decision itself is stored in your browser's local storage under the key db_cookie_consent_v1. It records only whether you allowed analytics and when you decided, and it never leaves your device. This is strictly necessary under § 25(2) no. 2 TDDDG, because its sole purpose is to remember your decision so that you are not asked again on every visit. Clearing it via the “Cookie Settings” button, or clearing your browser storage, removes it.

Optional — only with your consent

Website analytics (section 8) sets cookies and reads storage on your device. It is loaded only after you have actively agreed. If you decline, or simply ignore the banner, no analytics script is loaded at all.

Marketing

We run no advertising ourselves: no advertising network, no retargeting and no cross-site tracking of our own on this website. Microsoft Clarity is a qualification to that. If you consent to analytics (section 8), Clarity sets its own measurement cookies (_clck, _clsk) and, in addition, third-party cookies on Microsoft domains — among them MUID, which Microsoft's own documentation describes as being used “for advertising, site analytics, and other operational purposes”, ANONCHK and SM, which synchronises that identifier across Microsoft domains. We have no influence over them and draw no benefit from them. If you would rather not have that, decline analytics in the banner or withdraw it later with “Cookie Settings” — then none of it is loaded.

On your first visit you are shown a banner where you can accept, decline, or open the settings and decide per category. You can change your decision at any time with effect for the future using the “Cookie Settings” button at the bottom left of every page. Withdrawing is exactly as easy as consenting.

None of this applies to the app. The app sets no cookies and shows no cookie banner; what it stores on your iPhone is described in section 1.6.

8. Website analytics: Microsoft Clarity

Only if you have consented, we use Microsoft Clarity, a web analytics service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, and its parent Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA.

Clarity records how the website is used — page views, clicks, mouse movement, scroll depth, and from these it builds session recordings and heatmaps — together with coarse technical information such as browser, operating system, approximate region and screen size. Text entered into input fields is masked automatically. We use it for one purpose: to see where the page is confusing or broken and to fix it. We do not use it to identify individual visitors, and we do not try to link the recordings to a named person.

Legal basis: your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. You may withdraw your consent at any time with effect for the future via the “Cookie Settings” button; the lawfulness of processing carried out before the withdrawal is unaffected.

Microsoft states in its own documentation that it operates Clarity as a data controller, not as our processor. It therefore decides for itself about the purposes and means of what happens on its side and processes the data under its own privacy statement, which we cannot bind to this one. That is precisely why Clarity is loaded only after you have actively agreed, and why declining costs you nothing. Further information: Microsoft Privacy Statement and Microsoft Clarity documentation.

9. Contact by email

If you write to us at hello@distribot.de, we process your email address, your message and any information you choose to include, in order to handle your enquiry. Legal basis: Art. 6(1)(b) GDPR where your message concerns a (prospective) contract, otherwise Art. 6(1)(f) GDPR on the basis of our legitimate interest in answering enquiries addressed to us.

Please note that ordinary email is transported unencrypted between mail servers and can, in principle, be read along the way. Do not send us sensitive information by email; if something is sensitive, say so and we will agree a different channel.

10. Recipients of your data

We do not sell your data, we do not rent it out, and we do not pass it to advertising networks or data brokers. Data is disclosed only to:

  • Supabase as the operator of the app's backend (processor, Art. 28 GDPR; section 1.8);
  • Cloudflare as our hosting provider for the website (processor, Art. 28 GDPR);
  • TikTok, for the sign-in, with our requests for your profile information and your video list, and when your iPhone loads cover images (controller in its own right; sections 1.1 and 1.4);
  • Microsoft for website analytics, and only if you consented (section 8);
  • our email provider, to the extent you write to us;
  • public authorities and courts, where we are legally obliged to disclose, or where disclosure is necessary to establish, exercise or defend legal claims.

Processors are bound by contract and by the GDPR to process the data only on our instructions, to protect it to at least the standard described in this policy, and not to use it for their own purposes.

TikTok and Microsoft are not our processors. Each of them decides for itself what happens to data on its side and processes it under its own privacy policy, which we cannot bind to this one. That is why each of them only receives something when you take the step that requires it: signing in with TikTok, or accepting analytics. For loading Clarity on this website and transmitting the data to Microsoft, we and Microsoft may be jointly responsible within the meaning of Art. 26 GDPR; Microsoft alone is responsible for everything that happens to the data afterwards, and you can exercise your rights against either of us.

11. Transfers to countries outside the EU/EEA

Supabase is based in Singapore, for which the European Commission has not adopted an adequacy decision. The app's database is located in Frankfurt, but access from outside the EU — for example for support and maintenance, or by Supabase's own sub-processors — cannot be ruled out. Such transfers are safeguarded by the EU Standard Contractual Clauses under Art. 46(2)(c) GDPR, which are part of our contract with Supabase.

Cloudflare and Microsoft are US groups, so a transfer of personal data to the USA cannot be ruled out. Such transfers are safeguarded by the EU Standard Contractual Clauses under Art. 46(2)(c) GDPR together with additional technical and organisational measures, and, where the recipient is certified under the EU–U.S. Data Privacy Framework, by the European Commission's adequacy decision of 10 July 2023 under Art. 45 GDPR.

TikTok is an international group that may process data outside the EU/EEA, including in countries whose data protection level is not equivalent to the EU's. Those transfers are its own and are governed by its own privacy policy.

A residual risk remains: despite these safeguards, it cannot be entirely excluded that authorities in those countries gain access to data, and your enforcement options there are weaker than in the EU.

12. Storage periods

We delete personal data as soon as the purpose for which it was collected no longer applies and no statutory retention period requires us to keep it.

  • Your account, topic, settings, weeks and video records: for as long as your account exists. They are deleted when you delete your account in the app.
  • TikTok tokens: until you disconnect TikTok or delete your account. TikTok account details (identifier, display name, profile picture address, permissions): until you delete your account.
  • Server logs of the app's backend: kept only for a short time according to Supabase's standard log retention, and then deleted automatically.
  • Records of sign-in events (time, type of event, IP address): kept only for as long as they are needed to detect and investigate misuse, and then deleted. For that purpose they can remain for a limited time after you have deleted your account.
  • Backups: where our backend provider keeps backups, deleted data disappears from them in the provider's regular cycle and is not used in the meantime.
  • What is on your iPhone (session, reminders, introduction flag): until you sign out, delete your account or delete the app.
  • Crash reports via Apple (only if you enabled “Share With App Developers”): held in App Store Connect under Apple's own retention rules, which we cannot shorten. We stop looking at a report once the fault is understood and keep no copy of our own.
  • Server log files of the website at Cloudflare: deleted according to Cloudflare's standard retention, typically within a few days.
  • Your cookie decision: stays on your device until you clear it; it is never transmitted to us.
  • Analytics data: Microsoft's own documentation states that session playback data is deleted after 30 days, and that labelled or favourited sessions and heatmap data are deleted after 9 months, at which point they are removed from its backups as well and cannot be recovered. Withdrawing consent stops any further collection immediately.
  • Email correspondence: kept for as long as needed to deal with your enquiry and any follow-up questions, then deleted — unless commercial or tax law requires longer retention (generally 6 or 10 years under § 257 HGB, § 147 AO).

13. Your rights

You have the following rights in relation to the personal data we hold about you, free of charge:

  • Access (Art. 15 GDPR) — what we process about you, and why.
  • Rectification (Art. 16 GDPR) — correction of inaccurate data.
  • Erasure (Art. 17 GDPR) — see Data Deletion.
  • Restriction of processing (Art. 18 GDPR).
  • Data portability (Art. 20 GDPR) — your data in a structured, commonly used, machine-readable format.
  • Withdrawal of consent (Art. 7(3) GDPR) — at any time, with effect for the future, without affecting the lawfulness of what happened before.
  • Complaint to a supervisory authority (Art. 77 GDPR) — see section 14.

Right to object (Art. 21 GDPR)

Where we process your data on the basis of a legitimate interest (Art. 6(1)(f) GDPR — the sign-in logs described in section 1.1, the crash reports prepared by Apple described in section 1.9, and the hosting and server logs of the website described in section 5), you have the right to object at any time on grounds relating to your particular situation. We will then stop processing that data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing serves to establish, exercise or defend legal claims. An objection to direct marketing is always effective and needs no reason; we do not currently carry out any direct marketing.

To exercise any of these rights, an informal email to hello@distribot.de is enough. We reply without undue delay and in any event within one month of receipt (Art. 12(3) GDPR); if a request is exceptionally complex we may extend that period by up to two further months and will tell you why within the first month. We may ask one question to verify your identity, so that nobody can obtain or delete another person's data. Please tell us the TikTok username of the account you signed in with.

Several of these rights you can exercise yourself in the app, immediately: change your topic, your goal, your penguin's name and your reminders in your profile, disconnect TikTok, and delete your account.

14. Right to lodge a complaint

If you believe that our processing of your data infringes data protection law, you can lodge a complaint with a supervisory authority — in the Member State of your residence, place of work, or of the alleged infringement. The authority competent for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach, Germany
lda.bayern.de

15. Data security, minors, automated decisions

Security

This website is delivered exclusively over an encrypted TLS connection (HTTPS), which you can recognise by the lock symbol in your browser. We apply a strict content security policy: by default no content from any third-party server can be loaded into the page. The only exceptions are the hosts Microsoft Clarity needs (section 8) — www.clarity.ms, c.clarity.ms and scripts.clarity.ms for the script, *.clarity.ms for sending data, and c.bing.com for the cookie synchronisation on Microsoft's side. None of those hosts is contacted at all until you have consented. Beyond that we take appropriate technical and organisational measures under Art. 32 GDPR to protect data against loss, manipulation and unauthorised access, and we review them as our systems change.

The app communicates with our backend only over encrypted connections. Access to your data is restricted at database level to your own account; the TikTok tokens are kept in an area that the app cannot read at all.

No automated decision-making

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR). Counting your weeks follows fixed rules (section 1.2) and choosing ideas by your topic (section 1.3) has no legal or similarly significant effect.

Minors

You must be at least 16 years old to use the app. The app is not directed at children, and we do not knowingly process data of people under 16. If you believe that someone under 16 has created an account, please write to us and we will delete it. TikTok applies its own minimum age as well.

Is providing data required?

For the app, see section 1.11. For the website, you are neither legally nor contractually obliged to provide us with any data. Apart from the technical connection data that is unavoidable for any website to load, everything on the website is voluntary, and declining has no consequence for you.

16. Changes to this policy

We will update this policy when the app or the website changes, or when the legal situation changes. The current version always applies and is always available at this address; the date at the top tells you which version you are reading. If a change means that we would process your data for a new purpose, we will tell you in the app before it takes effect, and where consent is needed we will ask for it rather than rely on an old one.

17. Contact

Questions about this policy, or about your data in general: hello@distribot.de. How to reach us for anything else is on our Support page; postal address and further details are in the Imprint (Legal notice).