In short
- arcx is developed and offered by Ahmet Koçak, an individual based in Türkiye, who is the data controller.
- The launcher runs on your computer. Settings, logs, game data and clips stay on your computer and are not sent to us.
- Live stream events (comments, likes, gifts, viewer names) are processed only on your computer. No viewer data is sent to arcx servers.
- If you connect your TikTok account, we receive only your open_id, display name and avatar through the official TikTok Login Kit. Upload permission is used only for clips you choose and send.
- TikTok account connection is not active yet. When enabled, access tokens will be stored only on your computer, encrypted with Windows DPAPI, and you will be able to disconnect at any time.
- We do not sell your data or use it for advertising. The website has no tracking cookies and no analytics.
1. Scope and controller
This policy explains how personal data is processed in connection with the arcx.store website (the “site”), the arcx desktop application for Windows (the “launcher”) and the games that run with it (together, “arcx”). It also serves as the information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”).
- Controller: Ahmet Koçak (an individual trading as “arcx”)
- Address: Kentkoop Mah. 1820. Cad., Yenimahalle/Ankara
- Email: iletisim@arcx.store
“We” means the controller; “you” means anyone who visits the site or uses arcx.
2. Website
- Server logs. The site is hosted by Cloudflare. When you open a page, technical data such as your IP address, date and time, requested URL, browser information (user agent) and referrer are processed by Cloudflare for security, attack prevention and delivery of the service. We do not use these logs for visitor analytics or profiling. The site has no analytics tools, advertising pixels or third-party scripts.
- Cookies. The site does not use cookies. Cloudflare may set a short-lived, strictly necessary security cookie when needed. Details: Cookie policy (Turkish).
- Email. When you write to us we process your email address, your name (if given) and the content of your message. Mail sent to iletisim@arcx.store is forwarded by Cloudflare Email Routing to the controller’s Google (Gmail) mailbox.
- Waitlist. The waitlist is not accepting sign-ups at the moment. When it opens, it will process only your email address, optional TikTok username, plan of interest, language and a record of the separate consent you give for commercial emails, solely to send the launch and beta announcement. Retention: Deleted within 30 days after the launch and beta announcements end, or when you withdraw consent.
3. The arcx launcher (desktop app)
The launcher runs on your Windows computer; you do not need an account with us to use it. The following data is stored on your computer (in %APPDATA%\arcx and Videos\arcx-klipler) and is not sent to us:
- Settings: the TikTok username you enter so the app can read your stream chat, your chosen mode and preferences, and an optional connection (signing) service key.
- Logs: the app’s operation and error logs. They never leave your computer unless you send them to us for support.
- Game data: in-game leaderboards, session records and a game profile for every viewer who takes part in your stream (
profiles.db). A profile holds: the viewer’s TikTok user ID and nickname; the character gender the viewer chose with a chat command; the total coin value of gifts they sent; in-game experience points (xp) and cosmetics; first and last seen time; and, if the viewer said they are under 18, a flag used to keep them off on-screen roles (see section 10). These profiles have no expiry and stay on your computer until you delete the data folder. - Clips: videos you record with Clip Studio.
The launcher connects to GitHub (GitHub, Inc., USA) to check for and download updates; your IP address reaches GitHub in the process. The launcher currently sends no usage statistics (telemetry) and no automatic crash reports. If licence checks or aggregate usage counts are added for paid plans, they will contain no viewer data and this policy will be updated first.
4. Live stream events (viewer data)
When you connect a game to your live stream, the launcher reads public events from your stream and shows them in the game: comments, likes, joins, follow and gift notifications, together with the username, nickname and avatar link of the viewers involved.
- Local processing. These events are processed only on your computer. No viewer names, IDs or comments are sent to arcx servers.
- Unofficial connection. This connection is not an official TikTok API. It uses an unofficial open-source library and a third-party service (Euler Stream, located outside Türkiye) that signs the request needed to join the stream room. Events reach your computer through this infrastructure; the streaming account’s username is passed to that service to connect. We do not send viewer data to it.
- Your role. As the streamer, you decide how viewer data from your stream is used on your own computer and you are the controller of that data. arcx is a tool that runs on your computer.
- Text-to-speech. The current games have no text-to-speech. If a game with text-to-speech is added, we will update this policy first to say whether text is spoken on your computer or through a service.
The risks of this connection are explained in the Terms of Service: This is not the official TikTok API; your account may be restricted.
5. TikTok account connection and clip upload
So that you can send clips recorded in Clip Studio to your own TikTok account, the launcher uses TikTok’s official Login Kit for Desktop and Content Posting API. This feature is optional. It is not active yet; when it is enabled after TikTok’s app review it works as described in this section. Before enabling it we will check this section against the app again and update it if anything differs. The permissions we request and how they are used:
| Scope | What we receive or do | When |
|---|---|---|
user.info.basic | Your TikTok open_id, display name and avatar. Only to show you which account is connected and to keep records separate per account. | When you connect your account |
video.upload | Uploads the clip you chose to your TikTok inbox as a draft. You finish posting in the TikTok app. | Only when you press “Send to TikTok” for a clip |
video.publish | Posts the clip you chose to your account with the caption, privacy and interaction settings you set on the posting screen. That screen reads the privacy options and maximum duration your account allows from TikTok. | Only when you confirm on the posting screen (after TikTok approval) |
- You sign in on TikTok’s own page in your computer’s browser. We never see or ask for your TikTok password.
- You choose which permissions to grant on TikTok’s consent screen. If you decline one, only the related feature will not work.
- The access and refresh tokens issued by TikTok are stored only on your computer, encrypted with Windows DPAPI. They are never written to logs and never shared with the live stream connection.
- TikTok does not allow an app’s client secret to be stored on user devices. Exchanging the login code for tokens, refreshing and revoking them therefore go through our token server (hosted on Cloudflare). The server only relays the code and tokens to TikTok and returns the response to the launcher; it does not store tokens or video content. To prevent abuse, technical logs such as IP address, time and error code are kept for at most 30 days.
- Videos are uploaded directly from your computer to TikTok; they do not pass through our servers.
- A clip is never uploaded unless you confirm sending that clip. arcx does not post in the background, comment, follow anyone or send messages on your behalf.
- We do not sell data received from TikTok, use it for advertising, share it with third parties or process it for any purpose other than those above.
- Disconnecting: in the launcher go to Settings → TikTok account → “Disconnect”. This deletes the tokens on your computer and revokes access at TikTok. You can also remove arcx’s access at any time from the app permissions section of TikTok’s Settings and privacy menu, or write to us to request deletion.
Content you upload to TikTok is processed under TikTok’s own Privacy Policy and Terms of Service.
6. Purposes and legal bases
| Purpose | Legal basis (KVKK Art. 5(2) / GDPR Art. 6(1)) |
|---|---|
| Delivering the site securely (server and security logs) | Legitimate interests (KVKK (f) / GDPR (f)) |
| Answering your emails and providing support | Performance of a contract (KVKK (c) / GDPR (b)); legitimate interests |
| Running TikTok account connection and clip upload at your request; securing the token server | Performance of a contract; legitimate interests for security logs |
| Launch and beta announcement (once the waitlist opens) | Contract / legitimate interests, plus separate consent for commercial emails (Law No. 6563 / GDPR (a)) |
| Legal obligations (e.g. invoices and tax records once sales start) | Legal obligation (KVKK (ç) / GDPR (c)) |
| Establishing, exercising or defending legal claims | KVKK (e) / GDPR (f) |
Personal data is collected electronically through the site and email, through information you enter in the launcher and, if you connect your account, through the TikTok API. We do not currently rely on consent for any other processing; if we do, we will ask for it separately and in advance.
7. Recipients and international transfers
- Cloudflare, Inc. (USA): website hosting, security, email routing and (once TikTok connection is enabled) the token server. As our service provider; transfer basis: standard contract under Art. 9(4) KVKK.
- Google (Gmail): the mailbox where our email is kept. As our service provider; transfer basis: standard contract under Art. 9(4) KVKK.
- GitHub, Inc. (USA): launcher downloads and update checks. As our service provider; transfer basis: standard contract under Art. 9(4) KVKK.
- TikTok: when you connect your account and send clips, only at your request. Transfer basis: Art. 9(6)(b) KVKK (necessary to perform our contract with you) and Art. 9(6)(c).
- Euler Stream: setting up the live stream connection (the streaming account’s username), only when you start that connection. Transfer basis: Art. 9(6)(b) KVKK.
- Payment providers: only once paid sales open. We never see your card details; providers will be listed here before sales start.
- Competent authorities: only where legally required.
Because these parties may have servers outside Türkiye and outside your country, your personal data may be transferred abroad. Türkiye has issued no adequacy decision for these countries. Transfers to the service providers we use on a regular basis (Cloudflare, Google, GitHub) therefore rely on the standard contract published by the Turkish Data Protection Board, notified to the Authority within 5 business days of signature. Transfers to TikTok and Euler Stream happen only in operations you start, under the incidental-transfer conditions in Article 9(6) KVKK. For users in the EEA or UK, we rely on the corresponding safeguards or derogations under Chapter V GDPR.
8. Retention
- Launcher data (including viewer game profiles): on your computer until you delete it; there is currently no automatic deletion period. Uninstalling does not delete
%APPDATA%\arcx; to remove everything, delete that folder andVideos\arcx-klipler. - TikTok tokens (once the feature is enabled): until you disconnect or until they expire as set by TikTok.
- Token server technical logs (once the feature is enabled): at most 30 days.
- Email correspondence: up to 2 years after the matter is closed, or longer where a legal obligation or dispute requires it.
- Waitlist records: Deleted within 30 days after the launch and beta announcements end, or when you withdraw consent.
- Logs held by Cloudflare and other providers: according to their own policies.
When a period ends, the data is deleted, destroyed or anonymised.
9. Your rights
Under Article 11 KVKK you may ask whether your data is processed and request information about it; learn the purpose of processing and whether it is used accordingly; know the third parties it is transferred to in Türkiye or abroad; request correction of incomplete or inaccurate data; request deletion or destruction under Article 7; request that third parties be notified of such corrections or deletions; object to an adverse outcome resulting exclusively from automated analysis; and claim compensation for damage caused by unlawful processing.
If you are in the European Economic Area or the United Kingdom, you also have the rights of access, rectification, erasure, restriction of processing, data portability and objection, the right to withdraw consent at any time without affecting earlier processing, and the right to lodge a complaint with your local supervisory authority.
Send your request to iletisim@arcx.store (preferably from the email address you used with us) or in writing to Kentkoop Mah. 1820. Cad., Yenimahalle/Ankara, with enough information for us to verify your identity. We respond free of charge within 30 days. If you are not satisfied with our answer, you may complain to the Turkish Personal Data Protection Board (Article 14 KVKK) or to your local supervisory authority.
10. Children
arcx is not intended for anyone under 18. TikTok also requires you to be at least 18 to go LIVE and receive gifts. We do not knowingly process data of anyone under 18; if you become aware of such a case, write to us and we will delete the data.
Viewers under 18 may still join a streamer’s stream. If a viewer says in chat that they are under 18, the game adds only a flag to that viewer’s game profile on the streamer’s computer to keep them off on-screen roles; the flag is not removed and is never sent anywhere. This data stays on the streamer’s computer and can be deleted only by the streamer.
11. Security
- The site is served only over HTTPS with security headers.
- Once TikTok account connection is enabled: tokens are stored on your computer with operating-system encryption (Windows DPAPI); the app’s client secret is never shipped in the launcher and lives only on the token server.
- We process the minimum data needed: we never ask for your account password or TikTok session data.
- In the event of a personal data breach we will notify the authority and affected people as required by law.
12. Changes
If we change this policy we will publish the new version on this page and update the effective date. We will announce material changes on the site and in the launcher before they take effect. You can ask us for earlier versions by email.
13. Contact
For any privacy question or request: iletisim@arcx.store · Ahmet Koçak, Kentkoop Mah. 1820. Cad., Yenimahalle/Ankara
This English version is provided for convenience. The Turkish version also serves as the statutory KVKK notice; if the two differ, the version more favourable to you applies.