Privacy Policy

Last updated: 1 July 2026  ·  Effective: 1 July 2026

1. Who We Are

TrueCrimeCodex is a global true crime intelligence platform operated by TrueCrimeCodex Inc. ("TrueCrimeCodex", "we", "us", "our"). Our platform is accessible at truecrimecodex.com.

For data protection purposes, TrueCrimeCodex is the data controller for information collected through the platform. For questions about this policy or your rights, contact us at privacy@truecrimecodex.com.

2. Information We Collect

2.1 Information you provide directly

• Account registration: email address, display name (optional), password (hashed, never stored plaintext)
• Google Sign-In: name, email, and profile photo provided by Google (we store only what is needed)
• Subscription: payment information is processed directly by Stripe — we store only your Stripe Customer ID, subscription status, and plan tier
• Community posts: theories, comments, and evidence board content you create on the platform
• Crime tips: content you submit via the tip form is routed directly to law enforcement — we do not store tips
• Contact form: name, email, and message when you contact us
• Language preference: stored to serve content in your preferred language

2.2 Information collected automatically

• Usage data: pages visited, search queries, case pages viewed, features used — collected via PostHog and Firebase Analytics
• Device information: browser type, operating system, screen resolution, device type
• IP address: anonymised before storage (we never store full IP addresses)
• Session data: authentication session stored in an httpOnly cookie (not accessible to JavaScript)
• Push notification token: Firebase Cloud Messaging token stored if you opt in to notifications
• Referral source: how you arrived at TrueCrimeCodex (search engine, direct, referral link)

2.3 Information we do not collect

• We do not collect your full credit card number — Stripe handles all payment data
• We do not store crime tips submitted through the platform
• We do not collect biometric data
• We do not purchase third-party data lists

3. How We Use Your Information

3.1 To provide and operate the platform

• Authenticate you and maintain your session
• Deliver personalised content in your preferred language
• Process your subscription and manage billing via Stripe
• Send case alerts and push notifications you have opted into
• Enable community features (theory posting, evidence boards) for Pro subscribers
• Generate AI-powered case analysis using your queries (not stored after the session)

3.2 To improve the platform

• Analyse usage patterns to identify popular features and areas for improvement
• Debug errors and monitor platform stability via Firebase Crashlytics
• Run A/B tests and measure feature adoption

3.3 To communicate with you

• Transactional emails: subscription confirmations, payment receipts, password resets (via Resend)
• Case alert digests and "Cold Case Solved" notifications (only if opted in)
• Weekly crime digest (only if opted in, unsubscribe at any time)
• Trial check-ins at Day 3 and Day 7 of your free trial

3.4 Legal basis for processing (GDPR)

For users in the European Economic Area, United Kingdom, and Switzerland, we process your data under the following legal bases:

• Contract performance: operating your account, delivering subscription features, processing payments
• Legitimate interests: platform analytics, fraud prevention, abuse detection, improving the service
• Consent: marketing emails, push notifications, analytics cookies (you can withdraw consent at any time)
• Legal obligation: complying with applicable law, responding to valid legal requests

4. How We Share Your Information

We do not sell your personal data to third parties. We share data only in the following circumstances:

• Service providers: the third-party services listed in Section 5, who process data on our behalf under data processing agreements
• Law enforcement: where required by valid legal process (court order, warrant, or equivalent), we may disclose account information. We will notify affected users where legally permitted
• Business transfers: if TrueCrimeCodex is acquired or merges with another entity, your data may be transferred as part of that transaction, subject to the same privacy protections
• With your consent: in any other circumstance not described here, we will ask first

5. Third-Party Services

We use the following sub-processors to operate the platform. Each is bound by data processing agreements and complies with applicable data protection law.

International transfers from the EEA to the USA are covered by Standard Contractual Clauses (SCCs) or an equivalent adequacy mechanism under GDPR Article 46.

6. TikTok API Integration — Specific Disclosures

TrueCrimeCodex uses TikTok's Content Posting API to publish video content to TikTok accounts that have been explicitly authorised by their account holders. This section provides specific disclosures required by TikTok's Developer Terms of Service and applicable privacy law.

6.1 Scopes requested

• video.publish: post videos directly to TikTok as public content on behalf of an authorised account
• video.upload: upload video files to TikTok's servers before publishing
• We do not request access to TikTok user profile data, follower lists, inbox messages, comments, analytics, or any other user information

6.2 Data received from TikTok API

When a TikTok account is authorised via OAuth, TikTok's token exchange returns two identifiers:

• open_id: an anonymous, app-scoped identifier for the TikTok account that granted authorisation — used solely to associate stored tokens with the correct account. This is not a persistent user ID and changes if the app authorisation is revoked and re-granted
• Post identifier: a unique ID returned when a video is successfully published — used to confirm the post was accepted

We do not receive, access, process, or store any TikTok user profile data (display name, avatar, follower count), follower lists, inbox messages, engagement metrics, comments, or any other personal data of TikTok users or their audiences via the API.

6.3 TikTok OAuth access tokens

To post content on behalf of an authorised TikTok account, we store a TikTok OAuth access token and refresh token. These tokens are:

• Stored securely in encrypted server-side configuration — never in plaintext, client-side code, or version control
• Used exclusively to post pre-approved content to the specific TikTok account that granted authorisation
• Not shared with, sold to, or transferred to any third party under any circumstances
• Not used for any purpose beyond publishing authorised content
• Automatically invalidated when you revoke access through TikTok's settings
• Retention period: retained only for as long as the TikTok account authorisation remains active. Deleted within 30 days if authorisation is revoked, the account is disconnected, or upon a deletion request to privacy@truecrimecodex.com

6.4 What we do not do with TikTok data

In compliance with TikTok's Developer Terms of Service, we explicitly confirm:

• We do not build profiles, databases, or records on TikTok users or their behaviour
• We do not associate TikTok user behaviour, content, or identifiers with any profile or record we maintain
• We do not use TikTok API data for advertising, targeting, profiling, or any unauthorised purpose
• We do not sell, license, sublicense, or transfer TikTok API data to any third party
• We do not collect personal data from TikTok users for any purpose beyond what is explicitly described in this section
• We do not use TikTok API data to train, improve, or develop any machine learning model
• We do not sell, share for cross-context behavioural advertising, or otherwise transfer TikTok-derived data in any manner — in compliance with TikTok's Developer Data Sharing Agreement (including provisions effective January 22, 2026)
• We do not process any sensitive data or special categories of data obtained via the TikTok API

6.5 How to revoke TikTok authorisation

You can revoke TrueCrimeCodex's access to your TikTok account at any time, without affecting your TikTok account itself:

• In the TikTok app: Profile → ☰ → Settings and privacy → Security → Apps and websites → find TrueCrimeCodex → Remove access
• Once revoked, we will immediately lose the ability to post to your TikTok account and all stored access tokens become permanently invalid
• To request deletion of any TikTok-related data we hold, email privacy@truecrimecodex.com — we will respond within 30 days

6.6 TikTok's privacy policy and developer compliance

TikTok's handling of your data on their platform is governed entirely by TikTok's Privacy Policy. TrueCrimeCodex operates in full compliance with:

• TikTok Developer Terms of Service
• TikTok Developer Data Sharing Agreement
• TikTok Developer Guidelines

All applicable TikTok platform policies are observed, including those governing data handling, prohibited practices, and end-user disclosure obligations.

7. Cookies and Tracking

6.1 Essential cookies (no consent required)

• session / __session: httpOnly, Secure — authentication session, expires on browser close or 5-day inactivity
• cv_cookie_consent: localStorage — stores your cookie consent choice
• pwa-install-dismissed: localStorage — remembers if you dismissed the app install prompt

6.2 Analytics cookies (consent required)

• PostHog: product analytics, session recording (all inputs masked). Opt-out available at any time via our cookie settings
• Google Analytics 4: anonymised web analytics (IP anonymisation enabled)
• Firebase Analytics: in-app event tracking (device identifiers only, no cross-site tracking)

8. Data Retention

• Account data: retained for as long as your account is active, plus 30 days after deletion to allow for recovery
• Community posts: retained while your account is active; anonymised (not deleted) after account deletion to preserve discussion integrity
• Payment records: retained for 7 years as required by financial regulations (processed and stored by Stripe)
• Analytics data: aggregated after 90 days; individual event data deleted after 12 months
• Support emails: retained for 2 years
• Session tokens: expire after 5 days of inactivity

9. Your Rights

Depending on your location, you have the following rights regarding your personal data. To exercise any right, email privacy@truecrimecodex.com. We respond within 30 days.

8.1 Rights under GDPR (EEA, UK, Switzerland)

• Access (Art. 15): obtain a copy of the personal data we hold about you
• Rectification (Art. 16): correct inaccurate or incomplete data
• Erasure (Art. 17): request deletion of your data ("right to be forgotten")
• Portability (Art. 20): receive your data in a structured, machine-readable format
• Restriction (Art. 18): limit how we process your data while a dispute is resolved
• Objection (Art. 21): object to processing based on legitimate interests
• Withdraw consent: revoke consent for analytics or marketing at any time
• Lodge a complaint: with your national data protection authority (e.g., ICO in the UK, CNIL in France, Datatilsynet in Norway)

8.2 Rights under LGPD (Brazil)

• Confirmation of processing, access to data, correction, anonymisation, portability, deletion
• Information about third parties with whom data has been shared
• Revocation of consent at any time
• Complaints to the ANPD (Autoridade Nacional de Proteção de Dados)

8.3 Rights under CCPA / CPRA (California, USA)

• Right to know: categories and specific pieces of personal information collected
• Right to delete: request deletion of personal information we hold
• Right to opt-out of sale: we do not sell personal information — this right is therefore not applicable but honoured by default
• Non-discrimination: we will not discriminate against you for exercising these rights

8.4 In-platform controls

You can exercise many rights directly from your account:

• Data export: Account → Data & Privacy → Export my data (ZIP file, within 24 hours)
• Account deletion: Account → Data & Privacy → Delete my account (permanent, 30-day grace period)
• Notification preferences: Account → Notifications
• Language preference: Account → Language

10. Security

We implement industry-standard security measures including:

• All data in transit encrypted with TLS 1.2+
• Authentication session stored in httpOnly, Secure, SameSite=Strict cookies
• Firebase App Check to protect against bot abuse and API exploitation
• Rate limiting on all authentication and mutation endpoints via Upstash Redis
• Content Security Policy (CSP) headers on all responses
• Passwords are never stored — Firebase Auth handles credential storage
• Community content sanitised with DOMPurify on both write and render

No transmission over the internet is 100% secure. If you discover a security vulnerability, please report it responsibly to security@truecrimecodex.com.

11. Children's Privacy

TrueCrimeCodex is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has created an account, please contact us at privacy@truecrimecodex.com and we will delete the account and associated data promptly.

12. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Send an email notice to registered users (for significant changes)
• Show a notice in the app for 30 days after the change takes effect

Continued use of TrueCrimeCodex after the effective date constitutes acceptance of the updated policy. If you disagree with any change, you may delete your account before the effective date.

13. Contact Us

For any privacy-related enquiries, requests, or complaints: