Privacy Policy

Repostless: Repost Remover (“Repostless”) is an app for iOS and Android published by The Metaverse Apps OÜ (“we”, “us”), the developer of record on the App Store and Google Play. We are the data controller for the limited processing described in this policy.

We are established in Estonia, so the EU General Data Protection Regulation applies to us directly. Given the very small scope of processing described below, we are not required to appoint a data protection officer; write to the email above and you reach the people who built the app.

Repostless is an independent tool. It is not affiliated with, endorsed by or sponsored by TikTok, ByteDance Ltd. or any of their affiliates. Your use of tiktok.com through the app remains subject to TikTok’s own terms and privacy policy.

Repostless has no user accounts of its own. You never create a Repostless login, and there is nothing for you to register with an email address.

Everything in the right-hand column lives in Repostless’s own sandboxed storage on your iPhone. We cannot read it, and it is not backed up to any server of ours. If your device backs up to iCloud, Apple’s backup may include it, under Apple’s privacy policy rather than ours.

When you tap Connect, Repostless opens a standard system web view pointed at tiktok.com - the same site you would reach in Safari - and you log in directly with TikTok. TikTok’s login page, including any CAPTCHA or two-factor step, is served by TikTok and handled between you and TikTok. The app does not intercept, store or forward what you type there.

After you are signed in, the app reads what is shown on your profile to identify which items are reposts. When you choose to remove reposts, the app carries out the removals on your behalf from inside that web view, using the session already present on your device. None of this is proxied through a Repostless server, because no such server exists on that path.

The app requests the desktop version of tiktok.com in its web view, because the mobile site does not expose a Reposts tab at all. That request pattern is visible to TikTok, as any browser request would be.

The app spaces removals out to reduce the chance that TikTok’s own anti-abuse systems flag your account for moving unusually fast, and may apply usage limits. These are safety measures for you, not data-collection mechanisms.

This is the complete list. If it is not in this table, the app does not send it anywhere.

So that the app can show a relevant offer instead of the same screen to everyone, it attaches a small number of coarse, non-identifying attributes to its Adapty install record:

• a coarse size band for your repost list, never the exact number, and only after your first scan;
• a coarse band for recent activity;
• how many TikTok accounts you have connected - a number;
• how many times you have reached the free removal limit;
• how many cleanup runs you have completed.

These carry no @handle, no video IDs, no captions and no thumbnails - nothing that identifies your TikTok account or reveals what you removed. We have also explicitly disabled Adapty’s collection of the advertising identifier (IDFA) and of IP addresses in our configuration, because we have no advertising or attribution use for either. Adapty’s own practices are described at adapty.io/privacy.

Before a diagnostic snapshot or crash report leaves your device, we strip anything shaped like a TikTok @handle, a cookie, or a session token - the same category of data our architecture already keeps off our own servers (section 2). We also configure Sentry not to collect your IP address. We selected Sentry’s European Union data storage region, so crash and error report content is stored on servers in the EU (Frankfurt). Sentry’s own practices are described at sentry.io/privacy.

Repostless contains no advertising network and no attribution or install-tracking SDK. The two third-party services that receive limited technical data about how the app runs - a crash/error reporter and a product-analytics tool - are described in section 4. We use the analytics only to improve the app: never for advertising, never to build a profile of you, and never combined with data from other companies. The app does not use the advertising identifier, does not fingerprint your device, and does not combine information about you with data from other companies’ apps or websites. Because the app never accesses the advertising identifier, it never shows you Apple’s App Tracking Transparency prompt - there is nothing to ask permission for.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

For users in the European Economic Area, the United Kingdom and Switzerland, the GDPR requires us to name a legal basis for each purpose:

The strongest security property of this app is structural: the credential most worth stealing - your TikTok session - is never in our possession, so it cannot be leaked by us, subpoenaed from us, or exposed by a breach of ours.

On your device, that session is held by the operating system’s own web storage inside the app’s sandbox, which iOS protects with the device’s file-system encryption and keeps separate from other apps. Each connected account is kept in its own isolated store. All network connections the app makes use HTTPS. No method of storage or transmission is perfectly secure, and we do not claim otherwise.

• Preview before removing. A scan shows you what it found and what will be removed before anything is changed on TikTok.
• Sign out. In Settings, signing out of an account deletes its session, scan results and cleanup history from your device. Nothing on TikTok changes.
• Delete the app. This removes everything Repostless stored locally, including its web storage.
• Usage data. Turn off Settings → Share usage data. From then on the app sends no analytics events to Amplitude, including sessions.
• Notifications. Turn them off in the app’s Settings, or in iOS Settings → Notifications.
• Your subscription. View, change or cancel it any time in iOS Settings → your name → Subscriptions. It is managed by your Apple ID, not by us.

Depending on where you live, you may have the right to access, correct, delete or export the personal data a company holds about you, to object to or restrict certain processing, to withdraw consent, and not to be discriminated against for exercising any of these rights.

In practice, for Repostless: the on-device data described in section 2 is already exclusively yours - we hold no copy, so there is nothing for us to produce or erase, and you can delete all of it yourself with the controls in section 9. The only records connected to you that sit outside your device are the Adapty subscription records and counters, the Amplitude usage analytics and the Sentry crash reports in section 4.

To access or delete those: email support@repostless.app from the device in question and say what you want done. We will verify only as much as is needed to locate the right record and will respond within 30 days. Please note that deleting your Adapty record removes the link between your device and your purchase, which can prevent an active subscription from being restored automatically; we will tell you before doing it.

If you are in the EEA, the UK or Switzerland you may also lodge a complaint with a supervisory authority. Because we are established in Estonia, our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee); you may equally complain to the authority in the country where you live or work. We would rather hear from you first.

Apple and Adapty operate globally and may process the limited data described in section 4 on servers outside your country, including in the United States. Where we transfer personal data out of the EEA, the UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable) in our agreement with the processor concerned. No data about your TikTok account is part of any such transfer, because it never leaves your device.

We selected the European Union data region of both Sentry and Amplitude, so crash reports and usage analytics are stored on servers in the EU. Sentry, Inc. and Amplitude, Inc. are nonetheless US companies, so where any transfer outside the EEA/UK/Switzerland occurs (for example, for customer support), we rely on Standard Contractual Clauses in our agreements with them, the same mechanism described above for Apple and Adapty.

Under the CCPA as amended by the CPRA, the categories of personal information the app causes to be collected are limited to commercial information (your purchase and subscription transactions), internet or other electronic network activity (app and OS version, the coarse usage counters and the in-app analytics events in section 4), and identifiers (random install and analytics identifiers). These come from you and from your interaction with the app, and are used only for the purposes in section 6. They are disclosed only to Apple, Adapty, Amplitude and Sentry as service providers.

We do not sell personal information and do not share it for cross-context behavioural advertising - and have not in the preceding 12 months, including for anyone under 16. We do not use or disclose sensitive personal information beyond what is necessary to provide the app. To exercise a right to know, delete, correct or opt out, use the contact address in section 17; we will not discriminate against you for asking. You may use an authorised agent.

Repostless is not directed to children. You must be at least 13 years old to use it - the same minimum age TikTok itself requires - and at least 16 in countries where that is the minimum age for consent to data processing. We do not knowingly collect personal information from children under those ages. If you believe a child has used the app, write to us and we will delete any record we hold.

On the App Store product page, we declare as Data Linked to You: Identifiers (a user ID, used for App Functionality, and a device ID, used for App Functionality and Analytics), Purchases (used for App Functionality) and Product Interaction usage data (used for Analytics). We declare Diagnostics (crash data, used for App Functionality) as Data Not Linked to You. None of it is used to track you, and we declare no Data Used to Track You of any kind.

“Linked” is Apple’s term, and we chose it deliberately. The user ID and device ID are the random Adapty and Amplitude identifiers in section 4, not your name, email or Apple ID. But your purchases follow your Apple ID across reinstalls and devices, and your in-app events are matched to those purchases, so we treat all of it as connected to you rather than claim otherwise. Crash reports are not matched to anything. These entries correspond to the Apple, Adapty, Amplitude and Sentry rows in section 4, and we declare no other data types.

If this policy changes, we will update the dates at the top of the page. If a change affects what leaves your device, we will say so in the app’s release notes for that version, and where the law requires it we will ask for your consent before the change applies to you. We will never change this policy in a way that lets a Repostless server receive your TikTok session - that guarantee is the product.

This section covers the repostless.app website only. The app does not contain Google Analytics; its own usage analytics are described in section 4.

You choose first. The first time you visit, a banner asks whether to allow analytics. Until you click Accept, the site loads nothing from Google and sets no analytics cookies. If you click Decline, that stays the case. Both buttons are equally easy to use, and the site works the same either way.

If you accept, we use Google Analytics 4 (provided to us by Google Ireland Limited) to count visits and see which pages and links are used. Google acts as our processor. What it receives:

• the pages you view, and the page or site that referred you;
• clicks on our download, Pro, demo, navigation and guide links, and use of the reposts-time estimator (the number you type into it);
• your browser and device type, language, and an approximate location derived from your IP address (Google states that Google Analytics 4 does not log or store individual IP addresses);
• two first-party cookies, _ga and _ga_EQ4NLL4LC6, that hold a random identifier and a session counter. They expire after up to two years.

We do not use Google Analytics for advertising. We do not enable Google’s advertising features or audience personalisation, and we do not send this data to advertising networks. Analytics events are kept for at most 14 months. Google may process this data on servers outside your country, including in the United States, under the European Commission’s Standard Contractual Clauses or the EU–U.S. Data Privacy Framework.

Our legal basis is your consent (GDPR Art. 6(1)(a), and the ePrivacy rules on cookies). You can withdraw it at any time, as easily as you gave it. Withdrawing stops the tracking and deletes the two cookies above from this browser.

Change my cookie choice

Your rights over this data are in section 10. Because the cookie identifier is random and we hold no name or email with it, we may not be able to tell which records are yours; if you have a request, email us and include the _ga cookie value so we can find them.

This section covers the “Email me when it’s out” form on the repostless.app website, for versions of Repostless that aren’t released yet: today, a browser extension. Until the Android app was released on Google Play on 2 November 2026, the form also offered it; addresses given for it are handled as described below. The iPhone and Android apps never ask for your email.

What we collect. The email address you type and which versions you picked (Android, browser extension or both), and only if you tick the consent box, which is unticked until you tick it. We then send one confirmation email; nothing else is ever sent to an address until its owner clicks the link in it. The form does not store your IP address, browser details or anything else about you.

What we send. The confirmation email, then one email when each version you picked is released. No newsletter, no offers. Every email has a one-click unsubscribe link, and unsubscribing takes effect immediately.

Who handles it. The list is kept and the emails are sent by EmailOctopus (Three Hearts Digital Ltd, trading as EmailOctopus, United Kingdom), acting as our processor. EmailOctopus stores list data on Amazon Web Services servers in the EU, and keeps your confirmation as the record of your consent. The United Kingdom has an EU adequacy decision, so no further transfer mechanism is needed. The form itself is handled on our website’s host, Cloudflare, which passes your address to EmailOctopus and does not keep it. EmailOctopus’s practices are described at emailoctopus.com/legal/privacy.

How long. See section 7: until the versions you picked are released and you have had that email, and at most 24 months. To have your address removed sooner, use the unsubscribe link or email us.

This section covers Repostless for Android, distributed on Google Play. Sections 1–17 apply to it in the same way, with the differences below. Where those sections mention your iPhone, iOS or Apple, read your Android device, Android or Google.

On your device. You sign in to TikTok in Android’s system web view, and your TikTok session, scan cache, cleanup history, @handle and preferences stay in the app’s private storage on your device, as in section 2. They are never sent to us. Settings → Erase All Local Data deletes all of it; so does uninstalling the app.

Purchases. Purchases and subscriptions go through Google Play Billing instead of Apple. We never see your payment details. Adapty receives an app-generated random install identifier; your Google Play purchase tokens and purchase history; device model, Android version, app version and language; and which offer screens were shown and what was bought. On Android the app sends Adapty none of the counters described in section 4. We have disabled Adapty’s collection of the advertising ID and of IP addresses, and the app does not request Android’s advertising ID permission.

Analytics. The Android app uses Amplitude for product analytics in the same way as the iPhone app (section 4): the same events, a random identifier created by the Amplitude SDK (not the advertising ID), and app sessions, stored in Amplitude’s EU data region, without your IP address, city or mobile carrier. Turn it off in Settings → Share usage data; after that the app sends no analytics events. We also look at the offer-screen and purchase events in Adapty, in aggregate, to see which offers work. None of it is used for advertising.

Crash and error reports. Sentry works as described in section 4: a report is sent when the app crashes, when Android’s web view stops unexpectedly, or when you tap Report a Bug, with handles, cookies and tokens removed first. Sentry does not collect your IP address, and the reports are stored in its EU region.

Backup. Android backup and Google’s Block Store keep a copy of one thing: the counter of free removals you have used, so that reinstalling the app does not reset it. It is stored in your Google account, under Google’s privacy policy, and we cannot read it. Nothing else from the app is included in backups.

Notifications. While a removal runs, Android shows a notification with its progress and a Cancel button. It is created on your device and nothing about it is sent to us.

Your subscription. View, change or cancel it in the Google Play app → your profile → Payments & subscriptions. It is managed by your Google account, not by us.

Deleting your data. Email support@repostless.app, as in section 10, and we will delete your Adapty record and Sentry reports within 30 days. Google keeps its own purchase records under its own retention policy.

What we declared on Google Play. In the Data safety section of the Google Play listing we declare purchase history, app interactions and device or other IDs, used for app functionality and analytics, and crash logs and diagnostics, used for app functionality. None of it is shared with third parties for their own purposes, all of it is encrypted in transit, and you can ask us to delete it.