Cielo Clash Privacy Policy

Effective date: October 21, 2026

Cielo Clash ("Cielo Clash", "we", "us") is a web tool for running TikTok LIVE battle tournaments. It is published by Cielo Hermosa, LLC, a Colorado limited liability company. This policy explains what Cielo Clash collects, why, who it is shared with and the choices you have.

Contact for privacy questions or requests: hello@cielohermosa.com

Who this covers

• Account users: agency owners and staff, referees and admins who sign in to Cielo Clash.
• Creators in a tournament: TikTok creators whose public @username an agency adds to a tournament. Creators usually don't sign in. They see results through a share link.
• Visitors to share links: anyone who opens a tournament's public share link.

What we collect

• Account details: your email address, your role (admin, agency, referee or creator) and the agency you belong to. We use passwordless sign-in. We email you a one-time 6-digit code, and we store only a scrambled (hashed) version of it, for 10 minutes.
• Sign-in sessions: a random session token kept in a secure, HttpOnly cookie, for up to 30 days or until you sign out. We store only a hashed version of it.
• Tournament data entered by an agency: tournament names, rules, creator @usernames, divisions, schedules, referee notes and decisions.
• Public TikTok LIVE battle data: while a tournament night is being tracked, Cielo Clash reads public LIVE battle events from the creators' rooms: battle start and end, round scores (diamonds), winners, power-up or Enigma events, and gift totals where a format uses them. This is used only to score the tournament. We remove viewer-level details (viewer names, IDs, pictures) before we store any raw event logs, and we don't build viewer profiles.
• Attendance frames: if the agency turns it on, one still image of each creator's public LIVE at the start of a battle and 10 minutes in. This is used as no-show evidence for the referee.
• Audit log: a record of sign-ins and changes made in the app (who, what, when and the IP address), used for security and to settle disputes.
• Payments: if your agency buys a plan, Stripe processes the payment. We receive your plan, payment status and Stripe customer ID. Card details go to Stripe, not to us.
• Server and security logs: IP address, browser type, time and page requested, used to keep the service secure and running.

We don't sell personal information, show ads or use advertising cookies. The only cookie is the sign-in cookie.

Why we use it (legal bases)

• To provide the service you or your agency signed up for: running tournaments, scoring, share links and referee review (contract).
• To keep the service secure, prevent abuse, and keep audit records (legitimate interests).
• To take payments and keep tax and accounting records (legal obligation and contract).

Who we share it with

• TikTok: Cielo Clash connects to public LIVE rooms through an unofficial connection (see the TikTok Disclaimer). TikTok receives normal connection data from our servers.
• Euler Stream: a signing service used by the open-source TikTok connector. It receives the room or @username being connected to.
• Render (hosting, United States): stores the app and its database.
• Resend (email delivery): sends sign-in codes. It receives your email address.
• Stripe (payment processor): processes payments and subscriptions under its own privacy policy (https://stripe.com/privacy). Cielo Hermosa, LLC never sees full card numbers.
• Your agency: tournament data is visible to the agency that created it, and the parts shown on a share link are visible to anyone who has that link.
• Authorities, when the law requires it.

How long we keep it

• Sign-in codes: 10 minutes, then deleted within a day. Sessions: up to 30 days.
• Tournament data and attendance frames: as long as the agency's account is active, and deleted within 90 days after the account is closed or the agency asks.
• Audit log: up to 2 years.
• Backups: rolling copies kept for up to about a week, then overwritten.
• Payment records: as long as tax law requires (usually up to 7 years).

Your choices and rights

You can ask us to access, correct, export or delete your personal information by emailing hello@cielohermosa.com. If you are a creator listed in a tournament, you can ask the agency, or us, to remove you. Depending on where you live (for example California, the EU or the UK), you may have additional rights, including the right to complain to a data-protection authority. We will respond within 30 days.

Children

Cielo Clash is for adults running or taking part in TikTok LIVE tournaments. It is not directed to anyone under 18, and agencies must not add creators who are under TikTok's minimum age for LIVE.

Security

We use HTTPS, hashed sign-in codes and sessions, role-based access, rate limits, security headers and regular database backups. No system is perfectly secure. If a breach affects your information, we will tell you as the law requires.

Changes

We will post changes here and update the date above. For material changes, we will notify account users by email.