The short version
- To give you a house, we record your TikTok username, the zone you picked and the date we added you.
- Those details are public on the map and leaderboards. That’s the whole point of the game.
- We don’t connect to your TikTok account, don’t ask for passwords and don’t collect your email address, followers, photos or location to run the game.
- The website has no ads, no analytics and no tracking cookies.
- You can have your house removed at any time, free of charge, through the Delete my house page.
1. Who is responsible for your data
The data controller is [FULL LEGAL NAME], Tax ID [NIF / NIE / CIF], [POSTAL ADDRESS, SPAIN]. For anything related to privacy, write to [PRIVACY EMAIL ADDRESS].
Confirm A Data Protection Officer is usually not required for a small project like this. If you appoint one, add their contact details here.
2. What we collect
a) If you join the game
| Data | Where it comes from |
|---|---|
| Your TikTok username (handle) | The public comment you post on one of our own TikTok videos, or what you write in the chat of one of our TikTok LIVE streams |
| The zone you want to represent | The same comment or message |
| The date your house was added and how you joined (comment, LIVE or added by the team) | Recorded by us |
| Your house number and plot in that zone | Assigned automatically (order of arrival, first free plot) |
| The ID of the comment that created your house | Kept for up to 120 days so the same comment can’t create a second house. We don’t keep the comment’s text. |
| Your house’s level (starter house, family house, villa, mansion, apartment building or skyscraper) | The upgrades you buy with points |
Your house’s look is generated automatically from an internal identifier and its level. It doesn’t reveal anything else about you.
Automatic houses. Comments on our own videos are processed automatically: if a comment is just a zone (or our join keyword plus a zone), a house is created for its author on the first free plot of that zone, without anyone reviewing it first. Comments reach our system through [DESCRIBE THE SOURCE: e.g. “an official TikTok integration authorised for our account” and/or “comments we copy from our own videos and LIVE chats into our admin tool”]. We don’t store the comment’s text, your profile picture, your followers or any other information from your TikTok profile. A word filter blocks some offensive usernames.
Confirm Only describe the comment source you actually use, and check it is permitted by TikTok’s terms for your account.
a1) If you create your house by typing your @ on the website
We receive the TikTok username you type, the zone and area you choose, and the time. To check that the account exists, our server sends the profile address (tiktok.com/@username) to TikTok’s public embed service (oEmbed); TikTok answers whether a public profile exists. We keep only the username, not the profile details TikTok returns. We can’t confirm that the person typing is the owner of the account, so you must only create a house for your own account, and an account owner can ask us to remove a house at any time. To prevent abuse, a one-way hash of your IP address (not the address itself) is stored in our database for up to 24 hours to limit how many houses can be created from one connection.
a1b) Points and upgrades
There are no accounts or passwords: to upgrade a house you just type its TikTok @. Your daily-visit points and whether you pressed “Follow us on TikTok” are counted only in your browser (nw_points) and never sent to us; we can’t see whether you really follow us. Our server records only your house’s level and any points we award you in events; the rest of your points are calculated from public game data (how long you’ve had your house, how many people joined your zone after you). When you upgrade, your browser sends us the username and the new level.
Invite links. Your invite link contains your TikTok username (?ref=username). When someone opens it, their browser remembers that username (nw_ref) until they create a house, and then sends it to us with their new house. We add one to the number of friends you invited (shown publicly as a count, so your points can be calculated) and keep no other record of who invited whom.
Confirm Because no proof of ownership is needed, anyone who types a username could upgrade that house (upgrades only make a house bigger). Decide whether that is acceptable for your game.
b) If you contact us or send a removal request
Your email address, the username and zone of the house concerned, and whatever you choose to write in your message. If we need to confirm that a TikTok account is yours, we may also keep a record of that check (for example, that you posted a short code we gave you).
c) If you simply visit the website
Our pages, fonts and map files are all served from our hosting (Netlify). The website does not load analytics, advertising or social media scripts. Like any website, our hosting provider’s servers receive technical data needed to deliver pages (such as your IP address, browser type, requested page and time) and may record it in server logs.
Confirm Check in Netlify’s documentation and data processing agreement what it logs, for how long and where. Update this section if anything differs.
3. What is public
If you join, anyone visiting the website can see your TikTok username, chosen zone, house number and plot, house level and join date, together with your zone’s ranking. Each house has a shareable link. Because the site is public, search engines and other people may also copy or index this information, which we can’t fully control.
Please don’t ask to join using a username that contains your full real name, phone number or other personal details you don’t want to be public.
4. Why we use your data, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating your house when you type your @ (or from your comment), checking with TikTok that the account exists, building and showing it, keeping your points and house level, counting it towards your zone and showing it in rankings | Performance of the Terms of Participation you accept when you ask to join (Art. 6(1)(b)). Confirm Your adviser may prefer consent (Art. 6(1)(a)); either way you can leave at any time. |
| Moderating names, preventing duplicate or fake entries and keeping rankings fair | Our legitimate interest in running a fair, safe game (Art. 6(1)(f)) |
| Answering questions and removal or privacy requests | Compliance with our legal obligations under the GDPR (Art. 6(1)(c)) and our legitimate interest in answering messages (Art. 6(1)(f)) |
| Limiting how many houses one connection can create (a one-way hash of the IP address, kept up to 24 hours) | Our legitimate interest in preventing spam and impersonation (Art. 6(1)(f)) |
| Server logs for security and keeping the site running | Our legitimate interest in keeping the website secure and available (Art. 6(1)(f)) |
Where we rely on legitimate interests, you have the right to object (see section 9). We don’t use your data for advertising, sell it or make automated decisions that have legal or similarly significant effects on you.
5. How TikTok fits in
- Your @ is checked with TikTok. When you create a house on the website, we ask TikTok’s public embed service whether the account exists. It doesn’t tell us who you are or let us see your account.
- Comments can create houses too. We only use comments on our own videos and LIVE streams, and only to read your @ and the zone you wrote (see section 2).
- We can’t see who follows us. Following our account is appreciated but optional; we have no way to check it.
- TikTok’s own rules apply on TikTok. When you comment on TikTok, TikTok processes your data as an independent controller under its own terms and privacy policy. We have no control over that.
- We never ask for your password. Anyone claiming to be us and asking for your login details is not us.
If we add any other TikTok integration, we’ll update this policy before it goes live and explain exactly what data it uses.
6. Who receives your data
We don’t sell or rent personal data. We only share it with service providers that help us run the project, acting on our instructions under a data processing agreement (Art. 28 GDPR):
- Website hosting and server functions: Netlify, Inc. (United States). Netlify delivers the pages and runs the small programs that create houses and save upgrades.
- Database: Supabase, Inc. (United States). It stores the houses (username, zone, plot, join date, building level, event points and number of friends invited), the IDs of processed comments and short-lived rate-limit records. The database is hosted in [SUPABASE REGION, e.g. “Frankfurt, Germany (eu-central-1)”].
- Email: [EMAIL PROVIDER NAME, COUNTRY]
We may also disclose data where the law requires it, for example to courts or public authorities.
Confirm List every provider you actually use and make sure a data processing agreement is in place with each of them.
7. Transfers outside the European Economic Area
Data you make public on the map can be viewed from anywhere in the world. Apart from that, [EITHER: “we keep your data within the EEA” OR: “some of our providers may process data outside the EEA. Where they do, we rely on an adequacy decision (such as the EU-US Data Privacy Framework for certified companies) or the European Commission’s Standard Contractual Clauses”].
Confirm Choose the right statement after checking your hosting and email providers. Netlify and Supabase are US companies: check that both offer a data processing agreement with Standard Contractual Clauses or are certified under the EU-US Data Privacy Framework, and pick an EU region for your Supabase project.
8. How long we keep your data
- House data: for as long as your house is on the map. If you ask for removal, we take it off the live map and delete the record within [e.g. 30] days. If the game closes permanently, we delete all house data within [e.g. 90] days.
- Requests and emails: for [e.g. 12 months] after we close your request, so we can show that we handled it properly, unless the law requires a longer period.
- Comment IDs: 120 days, then deleted automatically.
- House level and event points: as long as your house exists. Removing your house deletes them automatically.
- Server logs: as set by our hosting provider, currently [PERIOD].
Confirm Backups: if you keep backups of the resident list, state how long they are kept and make sure removed players are not restored from them.
9. Your rights
You can ask us to:
- access the data we hold about you;
- correct it (for example, move your house to another zone);
- erase it (remove your house);
- restrict how we use it;
- object to uses based on legitimate interests;
- receive it in a portable format;
- withdraw consent at any time, where we rely on consent.
Use the request page or write to [PRIVACY EMAIL ADDRESS]. It’s free. We’ll reply within one month, or tell you within that month if we need more time, as the GDPR allows. We may ask you to confirm that the TikTok account is yours so nobody can remove or change someone else’s house.
If you’re unhappy with how we handled your data, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or to the data protection authority in the EU country where you live or work.
10. Age limit
You must be at least 14 to join. In Spain, 14 is the age at which you can consent to the processing of your own personal data (Article 7 LOPDGDD). TikTok also sets its own minimum age. Because houses are created automatically, we can’t check ages beforehand; if we learn that a house belongs to someone under the age limit, we will remove it. Parents or guardians can ask us to do so through the request page.
Confirm If you expect players from other countries with a higher age of digital consent, consider setting a higher minimum age (up to 16) for everyone.
11. Cookies and local storage
The website doesn’t set any cookies. Confirm Check that your hosting provider doesn’t add its own.
The site saves four things in your browser’s local storage: nw_onboarded remembers that you’ve already seen the tutorial, nw_my_house remembers which house is yours, nw_points counts your daily visits and follow bonus, and nw_ref remembers who invited you until you create your house. They stay on your device and can be cleared in your browser settings (you would lose the daily-visit points counted on that device).
12. Security
We hold very little personal data, and most of it is public by design. We protect the rest with [DESCRIBE THE MEASURES YOU ACTUALLY USE, e.g. “HTTPS on the whole site, two-factor authentication on our hosting, email and TikTok accounts, and access to the resident files limited to the people who run the game”].
Confirm Only describe measures you really have in place.
13. Changes to this policy
If we change how we use personal data, we’ll update this page and the date at the top. If the change is significant, we’ll also post a notice on the website [and/or on our TikTok account] before it takes effect.