Privacy policy

1. Who we are

Topaz Studios LLC (“Topaz Studios”, “we”, “us”) is a Utah limited liability company at 882 W 700 N, Provo, UT 84601, United States. We run this website and build and operate Boomkit, an iPhone app that pays creators to post short videos for brand campaigns. Test versions of the app show the name Topaz on the home screen.

We decide how the information described here is used. Send privacy questions and requests to zack@topazstudiosllc.com.

2. This website

• topazstudiosllc.com uses no cookies, analytics, advertising trackers, third-party scripts or third-party fonts.
• Our hosting provider keeps standard server logs (IP address, browser type, the page requested and the time) to deliver the site and protect it from abuse.
• When you email us, we receive your address and your message and use them to reply. Our domain’s email forwarding runs through Namecheap and arrives in a Google Gmail inbox.
• When you apply on our creators page, we receive what you enter: your name, email, phone number if you give one, TikTok and Instagram usernames, niche, the phone you use, a sample video link if you give one, city and state, how many days a week you can post, how you heard about us and any referral code. We use it to review your application and to email you about Boomkit campaigns. We don’t ask for passwords or ID numbers on that form. Our website host, Netlify, stores applications for us and can email each one to our inbox.

3. What the Boomkit app collects

Account and sign-in

• Your email address. You sign in with a 6-digit code we email to you. The code works for 10 minutes, and we store only a scrambled (hashed) form of it.
• Sign-in sessions. We store a hashed form of your session token and the IP address the session came from. A session ends 30 days after you last use it. The app keeps the token in your iPhone’s Keychain.
• Your acceptance of the creator terms: which version, when, and the IP address and app version at that moment.

Profile

• Required: your first name and your confirmation that you are 18 or older.
• Optional: last initial, time zone, birth year (we keep the year only), creator type, school, graduation year, up to 5 content niches and a profile photo for your creator page.
• Optional shipping address (United States or Canada). We use it only to send you products for a campaign, and only our team sees it.
• We don’t ask for your gender.

Posting accounts

• The TikTok or Instagram usernames you register for each campaign.
• To confirm a TikTok account is yours, you add a short code to its bio, and we read the public profile once.
• We never ask for, collect or store your social media passwords. The app doesn’t sign in to your social accounts.

Your posts and their public numbers

• The links to the posts you paste into the app.
• From public TikTok pages, read without signing in: each post’s views, likes, comments, shares, saves, caption, posting time, sound, hashtags, ad or paid-partnership label and public auto-captions (we keep the first 10 seconds of the transcript), plus your profile’s follower count, video count, total likes and bio.
• We read a post every 15 minutes for its first 72 hours, hourly until day 7, then daily, and we stop 48 hours after its counting window closes. We read your profile once a day.
• We can’t read Instagram posts automatically.

Numbers you add

• Instagram Insights screenshots: the app reads the numbers on your phone and sends us only those numbers, a fingerprint (hash) of the image and its file size. The screenshot stays on your phone.
• Country view numbers you type in for a campaign.

Video coach

• If you allow Photos access, the app finds the video you posted and measures it on your phone: length, cuts, motion, when a face and on-screen text first appear, the on-screen text, the spoken words (using on-device speech recognition), loudness and brightness.
• Only the measurements, short pieces of on-screen text, the spoken words and up to 5 small still images (40 KB or less each) leave your phone, with the app version, iOS version and phone model. We keep the first 10 seconds of the spoken transcript and a word count, not the full transcript.
• The video and its audio never leave your phone. You can delete what the coach measured at any time in the app.

Money

• Your earnings, wallet, cash-out requests and payout history.
• Whether a payout method and a tax form are on file. The app doesn’t store bank or card details. Our team sends payouts today, and we collect tax forms such as a W-9 separately when the law requires them.

Referrals

• Your referral code (built from your first name) and the people you refer.
• To stop people from referring themselves, the app sends the identifier Apple assigns to our app on your phone. We store only a hashed form and use it for nothing else. It is not an advertising identifier.

Help, safety and settings

• Support messages you send us, and reports and blocks you make.
• Your notification settings. The app’s notifications come from your phone itself.
• Questions you ask Ask Topa, the in-app helper. Built-in answers come from your own numbers, and we don’t store the question text.

Logs

• Server logs with the IP address, the page or API address requested and your account number.
• A security log of account events, such as sign-in code requests (which include the email address) and refused age checks.

What we don’t collect

Social media passwords, precise location, contacts, your advertising identifier, or activity in other apps and websites. The app contains no third-party analytics or advertising code.

4. How we use it

• To create your account, sign you in and keep your session.
• To check each post you submit: that it is public, went up after you joined the campaign, came from your registered account, carries the ad disclosure and hasn’t been submitted before.
• To count views and pay you by the campaign’s rules shown in the app.
• To keep fake views out of pay. Our systems compare each post’s public numbers with its own history and with other posts. They can pause pay on a post while unusual views are checked, leave out views that fail and take back money paid on them from your future earnings. We never send you a bill. Repeated flags can limit cash-outs, and a person on our team makes any bigger decision. You can appeal a flagged post once by email.
• To review campaign posts. Our team may look at your public posts to confirm the ad disclosure and the brand’s guidelines.
• To give you coach tips and estimates, and to ship you products for a campaign.
• To answer support requests, prevent fraud and abuse, keep pay and tax records, and meet legal obligations.

We don’t sell personal information, share it for targeted advertising or use it to build advertising profiles.

5. Who receives it

Brands running a campaign

Brands see campaign totals (views, videos and engagement) and links to the public posts. They see your display name only if you turn that on; otherwise you appear as a creator without a name. Brands never see your email address, account number or earnings.

The public

If you keep your creator page public, anyone can see it at its web address, and search engines can index it. It shows your display name, username, photo, creator type, niches, total views, number of live posts, the brands you posted for, and your top posts with links, caption excerpts and view counts. It never shows your earnings, address, email, birth year, school or last name. You can hide the page at any time.

Service providers

• Google (Gmail) sends your sign-in codes and handles email between you and us.
• Anthropic provides optional AI features. While they are on: coach tips and the still images go to Anthropic to reword the tips; for an AI answer in Ask Topa, your question, the chat, your first name, time zone, balance, streak, campaigns, registered usernames and the numbers on your recent posts go to Anthropic; for AI hook ideas, which run only when you tap for them, your hook, script and the campaign brief go to Anthropic.
• Netlify, our website host, serves this website and stores creator applications. Namecheap forwards email for our domain.

If we add a payment provider for payouts, it will collect your payout details directly, and we will update this policy before it starts.

Other cases

We share information when the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of our business, in which case this policy keeps applying to your information.

6. How long we keep it

• Account and profile data: until you delete your account.
• Creator applications from this website: while we fill campaign spots, or until you ask us to delete yours.
• Sign-in codes: we delete the record 24 hours after the code expires.
• Server logs: overwritten automatically as new logs fill them.
• Backups: 1 copy a day, kept for 14 days. Deleted data can stay in a backup until that backup expires.
• Pay and tax records: kept after you delete your account, for as long as tax and accounting law requires.
• The security log: kept to protect accounts and the service.

7. Deleting your account

You can delete your account in the app at any time, or email us from the address you sign in with. The app shows what it deletes and what it keeps before you confirm.

• We delete your sign-in sessions, profile, shipping address, photo, registered usernames, notification settings, progress and rewards data, coach measurements, phone fingerprints, support messages, reports and blocks. Your username becomes free.
• We keep your posts and their public view counts, the earnings ledger, wallet, cash-out requests and the security log, because they are pay and tax records. We link them to a payee record with the name and email used for payment, not to an account. We still pay any pending cash-out.
• Your referral code stays reserved so nobody else can reuse it.

8. Your choices and rights

• Edit your profile, hide your creator page and turn off any of the 3 notification types (new campaigns, earnings and streak, account updates) in the app. Sign-in codes always send.
• Turn off Photos access in iOS Settings, and delete what the video coach measured.
• Ask us for a copy of your information, a correction or deletion by emailing zack@topazstudiosllc.com. Write from the email you sign in with so we can confirm it is you.

We aim to answer within 30 days. Residents of California and some other states have specific privacy rights; we honor these requests for everyone and never treat you differently for making one.

9. Security

We store sign-in codes and session tokens only in hashed form, keep the session token in your phone’s Keychain and limit access to our team. No storage or transfer method is perfectly secure, so we can’t promise that information will never be exposed. If a breach affects you, we will tell you as the law requires.

10. Age limit

Boomkit is for people 18 and older. The app refuses sign-up when someone says they are under 18 and keeps none of that profile; the security log records the refusal. If we learn that someone under 18 has an account, we delete it.

11. Where we store it

We store app data in the United States on computers we operate, and our service providers process it in the United States. If you use the app from Canada or elsewhere, your information moves to the United States.

12. Changes to this policy

We will post any change here with a new effective date. If a change matters to how we use your information, we will tell creators in the app or by email before it takes effect.

13. Contact

Topaz Studios LLC
882 W 700 N
Provo, UT 84601
United States
zack@topazstudiosllc.com