Privacy Policy
Last updated: 1 August 2026
Applies to: trytoky.com
1. Who we are
trytoky.com is operated by TOURINGTUNES Sp. z o.o., a company registered in Poland. You can reach us at privacy@trytoky.com.
We are the controller of the personal data described below, within the meaning of the GDPR (Regulation (EU) 2016/679).
We have not appointed a Data Protection Officer. We are not required to — we do not carry out large-scale monitoring or process special categories of data.
2. What we collect, and why
Right now this site does one thing: it takes waitlist sign-ups. We collect only what you type into one of the two forms.
If you join the creator waitlist
| Data | Why we ask |
|---|---|
| Email address | To tell you when toky opens in your country. This is the only thing we will email you about. |
| TikTok handle | To recognise you when you sign up later, and to sanity-check that the account exists. |
| Country | We open country by country, because payout methods differ. This decides your position in the queue. |
| Follower range | To understand the mix of creators interested, so we build the right thing. |
| How you currently get paid | To decide which payout methods to build first. This is the single most useful answer you give us. |
If you request early access as a label or artist
| Data | Why we ask |
|---|---|
| Name | So we can address you when we reply. |
| Label / artist / company | To understand who we'd be working with. |
| Work email | To reply to you. |
| Releases per month, typical promotion budget | To judge whether toky fits you before we take your time. |
| What you use today | To understand what we're being compared against. |
Recorded alongside your answers
Two things are stored with your entry that you don't type in:
| Data | Why |
|---|---|
| The date you signed up | So we can honour the retention period in section 6, and invite people in the order they joined. |
| Where the link came from | If you arrived through a link that carried campaign tags (utm_source, utm_campaign) or a referral code, we store those tags. They tell us which channel or which person sent you, so we know where to spend effort. If you arrived by typing the address, nothing is stored here. |
These tags come from the link you clicked, not from watching you. We do not follow you across sites and we cannot see where you went afterwards.
What we do not collect
We do not build profiles of you as a person. We do not make automated decisions about you. We do not fingerprint your device or record your session. Apart from the items above and the measurement described in section 3, we do not collect anything beyond the form fields listed.
3. Cookies and advertising measurement
We advertise toky on TikTok and on Meta's platforms (Facebook and Instagram). To find out whether those ads actually bring people who join the waitlist, we can load measurement tools from those two companies.
Nothing loads until you say yes. On your first visit you get a banner with two equally weighted choices, Accept and Reject. Until you choose, no measurement tool runs and no advertising cookie is written. If you reject, none ever runs — and we don't ask again on every page.
If you accept, these load:
| Tool | What it does | Cookies it sets |
|---|---|---|
| TikTok Pixel | Tells TikTok that someone who saw our ad reached the site or joined the list | _ttp and related |
| Meta Pixel | The same for Facebook and Instagram ads | _fbp, and _fbc if you arrived from a Meta ad |
We also send the same events from our server rather than only from your browser, so that ad blockers and browser restrictions don't leave us guessing. When we do that for someone who has joined the waitlist, the email address is hashed before it leaves us — TikTok and Meta receive an irreversible fingerprint of it, not the address itself. This happens only if you accepted the banner.
What this means honestly. TikTok and Meta are large advertising companies and they use what they receive for their own purposes as well as ours. For that part they are not merely working on our instructions — we are joint controllers with them, and their own terms govern what they do next: [Meta](https://www.facebook.com/legal/controller_addendum) · [TikTok](https://ads.tiktok.com/i18n/official/policy/business-products-terms). If that is not something you want, reject the banner. Nothing on this site stops working.
Changing your mind. There is a Cookie settings link in the footer of every page. It reopens the banner and your new choice takes effect immediately — withdrawing is exactly as easy as accepting. We re-ask everyone after six months rather than treating one click as permanent.
This site uses no other cookies. There is no Google Analytics, no session recording, no A/B testing tool, no chat widget.
4. Legal basis
| What | Basis |
|---|---|
| Your waitlist entry | Consent — GDPR Art. 6(1)(a). You give it by submitting the form. |
| Advertising cookies and measurement | Consent — GDPR Art. 6(1)(a) together with art. 393 of the Polish Prawo komunikacji elektronicznej, given through the banner. |
Neither is required of you. Don't want to be on the list — don't fill in the form. Don't want the measurement — press Reject.
You can withdraw either consent at any time (sections 3 and 8). Withdrawing does not make anything we did beforehand unlawful, and it does not undo data already received by TikTok or Meta — that is why the banner comes first.
5. Who else sees your data
We use two service providers, both acting as processors on our instructions:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Hosts the database your form entry is stored in | Frankfurt, Germany |
| Vercel | Hosts this website, serves the pages, and runs the code that receives your form | Frankfurt, Germany |
If you accepted the banner in section 3, Meta Platforms Ireland and TikTok Technology Limited (both Dublin) also receive measurement events. They are not processors — see section 3.
We do not sell your data. We do not share it with advertisers, data brokers, or other platforms. We do not pass it to labels or marketers.
Transfers outside the EEA. Both the code that handles your submission and the database it is written to run in Frankfurt. Your form entry is not processed outside the EU in the ordinary course.
Vercel and Supabase are both US companies, so their staff can in principle access systems for support and maintenance from outside the EEA. Where that happens, it rests on the EU Standard Contractual Clauses and — for Vercel — the EU–US Data Privacy Framework.
6. How long we keep it
- Until launch, plus 12 months. If we email you and you don't take up the invitation, we delete your entry after 12 months.
- If you ask us to delete it, we delete it — normally within 30 days.
- If we abandon the project, we delete the whole list. We won't sell it or pass it on.
7. Security
Data sits in a Postgres database with row-level security enabled and no public read access — the table cannot be read through the public API at all. Writes go through a single restricted function that only accepts new sign-ups and returns nothing. Access to the underlying database is limited to the company's own administrators.
No system is perfect, and we won't claim otherwise. If there is a breach affecting your rights, we will notify the Polish supervisory authority within 72 hours and tell you directly where the law requires it.
8. Your rights
Under the GDPR you can ask us to:
- See what we hold about you (Art. 15)
- Correct it if it's wrong (Art. 16)
- Delete it (Art. 17)
- Restrict what we do with it (Art. 18)
- Give you a copy in a portable format (Art. 20)
- Stop processing based on legitimate interests (Art. 21) — not applicable here, since we rely on consent
- Withdraw your consent (Art. 7(3))
Write to privacy@trytoky.com and we reply within one month. There's no form and no hoops: "delete me" is enough.
For the advertising cookies specifically you don't need to write to anyone — use the Cookie settings link in the footer. That is the fastest route, and it takes effect the moment you press it.
You can also complain to the Polish supervisory authority:
Prezes Urzędu Ochrony Danych Osobowych (UODO) ul. Stawki 2, 00-193 Warszawa uodo.gov.pl
If you live in another EU country you can complain to your own authority instead.
9. Children
toky is not for people under 16. We don't knowingly collect data from anyone under 16. If you believe a child has signed up, tell us and we'll delete it.
10. Changes
If we change this policy we'll update the date at the top. If the change is significant and we hold your email, we'll tell you before it takes effect.