Last updated: 2026-10-07.
This page explains what data ssstiktok.live processes, why and for how long. The service is designed to process as little as possible: no advertising, and no audience measurement or marketing trackers without your consent.
Data controller
Adil Bladi, Twin Center, Casablanca, Morocco. Contact for any question about your data: adilveobladi@gmail.com.
Submitted links and generated files
The TikTok links you submit and the files generated (videos, clips, live recordings, ZIP archives) are used only to carry out your request. A ready file stays available for 10 minutes; this is extended while the editor is open, but never beyond 30 minutes after processing ends. After a complete download, the file is deleted after 5 minutes. These files are never backed up.
The technical information about an operation (submitted link, owner identifier, progress) is erased at the latest one hour after the files are deleted. To fetch content, our servers contact TikTok: TikTok sees our servers’ address, not yours.
Legal basis: providing the service you request.
“ssstik_anon” browser cookie
When you use the tool, a “ssstik_anon” cookie containing a signed random identifier is set. It keeps access to your files limited to your browser and applies the usage limit. It expires 1 day after it is set, cannot be read by the page’s scripts (HttpOnly), is only sent over HTTPS (Secure) and is not shared with anyone.
This cookie is strictly necessary for the service you request (access to your own files, usage limit): it does not require your consent.
Usage limit (anti-abuse)
The service is open to everyone, without an account. To prevent abuse, it is limited to 20 operations per browser and 50 operations per IP address over a period of 1 day. To do this, the server computes a fingerprint from your IP address, your browser identifier (User-Agent) and the “ssstik_anon” cookie identifier. Only a one-way fingerprint (HMAC-SHA256 with a secret key) is stored, never the IP address or the User-Agent in clear. It is deleted automatically at the end of that period, which starts with your first operation.
Legal basis: the operator’s legitimate interest in preventing abuse and keeping the service free.
Member accounts
Member accounts are disabled: no sign-up or sign-in is possible, and no email or notification is sent to you. Accounts created earlier, if any, are deleted 12 months after their last sign-in, or sooner on request.
Technical logs
Like any web server, our servers log each request: IP address, date, requested address, response code and browser (User-Agent). These logs are used for security and troubleshooting; they are kept for 14 days at most. Download and access tokens are masked in them.
Legal basis: the operator’s legitimate interest in securing the service.
Firewall and security logs
The site is protected by a web application firewall, Wordfence, published by Defiant, Inc. (United States). It inspects every incoming request to block known attacks and intrusion attempts, and limits password attempts on the administration login page.
It keeps security logs in our database: login attempts to the administration (IP address, username entered, date, success or failure, browser) and blocked or suspicious requests (IP address, date, requested address, browser, reason for the block). These logs are kept for 30 days at most. A blocked IP address is blocked only temporarily (a few hours at most for repeated password attempts). Ordinary visits are not logged by the firewall.
To stay up to date with threats, the firewall communicates with the servers of Defiant, Inc. in the United States: it receives protection rules and the list of malicious IP addresses from them, and sends them the IP address and technical details of blocked attacks. For administration accounts, it also checks that the password has not been leaked, using a partial fingerprint of the password from which the password cannot be reconstructed. This transfer outside the European Union is governed by the European Commission’s standard contractual clauses.
Legal basis: the operator’s legitimate interest in protecting the site, its visitors and their data against attacks.
Cookies and consent
On your first visit, a banner asks for your choice about cookies that are not essential. “Accept all”, “Reject all” and “Customize” are presented the same way; closing the banner with the Escape key counts as a refusal. Until you accept a category, no script from that category is loaded.
Your choice is kept for 6 months in the “ssstik_consent” cookie, then you are asked again. You are also asked earlier if the list of cookies changes. You can change it or withdraw your consent at any time with the “Manage cookies” link at the bottom of every page: the cookies of the withdrawn category are then deleted.
Necessary cookies (always on)
- ssstik_anon: access to your own files and usage limit, 1 day (see above);
- ssstik_consent: remembers your cookie choices, 6 months;
- WordPress sign-in cookies (wordpress_logged_in_…, wordpress_sec_…): site administration only, 14 days at most;
- Wordfence firewall security cookies (wfwaf-authcookie-…, wf_loginalerted_…, wfls-remembered-…): only for people signed in to the administration, never for visitors; 12 hours for the first, 1 year for the second (alert on sign-in from a new device), 30 days for the third (trusted device for two-factor authentication);
- browser session storage: identifier of the current operation, erased when the tab is closed.
They are essential to the service you request or remember a choice you made: they do not require your consent. Fonts are hosted on our servers: no request is sent to Google Fonts.
Audience measurement (with your consent)
No tool of this kind is installed today: no cookie of this category is set, even if you accept it.
Marketing (with your consent)
No tool of this kind is installed today: no cookie of this category is set, even if you accept it.
Legal basis: your consent, which you can withdraw at any time as easily as you gave it.
Content loaded from TikTok
To display a TikTok profile, thumbnails and profile pictures are loaded directly from TikTok’s servers: your browser then sends them your IP address.
Recipients and processors
Your data is never sold or rented. Only the operator and the following providers, each for its own part, can access it:
- server hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; data hosted in Helsinki (Finland) (European Union);
- email delivery: Brevo (Sendinblue SAS), Paris, France;
- site security (Wordfence firewall): Defiant, Inc., United States (European Commission standard contractual clauses);
Your rights
You can access, correct and erase your data, restrict its processing, object to processing based on legitimate interest and ask for its portability. Write to adilveobladi@gmail.com; we reply within one month.
You can also lodge a complaint with a data protection authority, for example the CNIL in France (cnil.fr) or the authority of your country of residence.
Minimum age
The service is not intended for people under 16 and does not knowingly collect their data.