What we collect, and what we don't

F1rmav is an independent fan channel run by one person, who is the data controller for everything described on this page.

Controller

Rares Mavromati

Country

Sweden

Contact

contact@f1rmav.com

That address is the one to use for anything on this page: a question, a correction, or a request to be deleted. It reaches a person, not a ticketing system.

If you join the merch list

The signup form on the shop page stores exactly three things:

• Your email address. Nothing else from the form: there is no name field, no phone number, no address.
• Which page you signed up from, as a short label like shop-page, so we know which part of the site actually works.
• The date and time you signed up.

The form also carries a hidden field that only automated bots fill in. If it has anything in it the submission is discarded and nothing is saved.

Your IP address

When you submit the form, your IP address is held in the server's memory just long enough to stop the same address submitting more than five times in ten minutes. It is never written to the database, never logged, and disappears when the server process recycles.

What we never collect

No account, no password, no payment details, no location, no contact list. Nothing you do on this site builds a profile of you.

The figures on this site (followers, likes, clips posted, and the view count under each clip) are read from TikTok automatically so they stay current instead of being typed in by hand and quietly going out of date. That is done by an application registered with TikTok under the name F1RMAV Site, operated by the person named above and used for this website and nothing else.

App name

F1RMAV Site

Operated by

Rares Mavromati, for https://f1rmav.com

Connected account

@f1rmav (this channel’s own, and no other)

How

TikTok’s official Display API, authorised once through TikTok Login Kit

It reads nothing about you

There is no “log in with TikTok” anywhere on this site, and no TikTok account is needed for any part of it. F1RMAV Site never requests, receives or stores data about visitors. It is connected to exactly one account, this channel’s own, authorised by its owner. Loading a page here sends nothing to TikTok either: no TikTok script, pixel or embedded player runs on these pages, the clip pictures are files served from this site’s own storage, and the links to TikTok are ordinary links that do nothing until you click one.

What it reads from TikTok, and what for

• user.info.basic: The connected account’s own identifier, display name and avatar. Confirms which channel the website is connected to, so it can never publish another account’s figures.
• user.info.stats: The channel’s follower count, total likes and number of published clips. The figures in the panel at the top of the home page.
• video.list: For the channel’s own published clips: the clip’s id, its cover image and its view count. The view count and cover picture on each clip card.

Every one of those is something anyone can already read on the public TikTok profile. Nothing private is asked for: not comments, not direct messages, not who follows the channel, not drafts or unpublished clips, and no data belonging to any other TikTok user, ever.

What is kept, and for how long

The counts and cover pictures are saved in this site’s own database (the one described under “Who else handles it” below) so the pages can be built without calling TikTok on every visit. Each daily run overwrites the previous values, so nothing accumulates and no history is kept. If a figure is more than 48 hours old, the site stops showing it and falls back to a number typed in by hand.

One credential is stored: the token that lets the site ask TikTok for those figures again tomorrow. It is encrypted before it is written down, is never sent to a browser, and cannot be read through the admin panel or any public address on this site. The short-lived access token is never stored at all.

Ending it

The channel’s owner can disconnect F1RMAV Site at any time from TikTok itself, under Settings and privacy → Security and permissions, and TikTok’s authorisation expires by itself after a year unless it is renewed. Either way the site simply stops updating and goes back to hand-typed figures. The stored counts and covers are deleted on request to the contact address above.

The email address is used for one purpose: to tell you when merch goes on sale, ahead of the public announcement. That is the whole reason the list exists.

The legal basis is your consent (Article 6(1)(a) of the GDPR), given when you submit the form. You can withdraw it at any time, and withdrawing is as easy as giving it: one email to the address above. Withdrawing does not affect anything done before you withdrew.

We will not sell the list, rent it, share it with other channels, or use it to send you anything that isn't about an F1rmav merch drop.

You have an absolute right to object to your data being used for direct marketing. If you object, we stop. No reason needed, no questions asked.

This site sets no cookies for visitors. Not for analytics, not for preferences, not for advertising. There is no consent banner because there is nothing on your device for you to consent to.

We do measure which pages get read, using Vercel Web Analytics. It records the page address, the referring site when you arrive from somewhere else, a timestamp, and one of a handful of named events: a follow-button click, a feed filter, a contact-card download, a share, or a signup. Vercel tells apart one visit from another using a value it derives from the incoming request rather than anything stored on your device, and discards it after 24 hours.

The signup event records only which page the signup came from. Your email address is never sent to analytics.

The fonts, images and video on this site are served from this domain and its own storage, so your browser is not asked to fetch anything from Google, a font service, an ad network or a social network while a page loads. The links to TikTok, Instagram, YouTube and Facebook are ordinary links: nothing is sent to those companies unless you click one.

Two companies process data on our behalf, both under contract and neither permitted to use it for their own purposes:

Vercel

Hosting, media storage and the analytics described above. Pages are served from, and functions run in, Vercel’s European infrastructure.

Neon

The database holding the merch list. The database itself is located in Frankfurt, Germany.

Both are US-incorporated companies operating EU infrastructure. Where that arrangement means personal data is transferred outside the EEA, it is covered by the European Commission's Standard Contractual Clauses. You can ask us for details of those safeguards using the contact address above.

Nobody else receives the list. There is no mailing platform, no CRM, and no advertising partner.

Honestly: until you ask us to delete it, or until the merch list is no longer needed. There is no automatic expiry, and we would rather say that plainly than quote a retention period nothing actually enforces.

If you want out, email the address above and the record is deleted. If you would prefer we keep a note that you don't want to be contacted again, say so and we will keep only what is needed for that.

Under the GDPR you can ask us to:

• Show you what we hold about you, and give you a copy.
• Correctanything that's wrong.
• Delete it.
• Restrict what we do with it, or object to it.
• Hand it over in a portable format.
• Withdraw your consent, at any time.

Email the contact address above and we'll act on it. There is no charge, and we aim to respond well inside the one month the law allows.

If you're not satisfied with how we handle it, you can complain to the Swedish privacy regulator, Integritetsskyddsmyndigheten (IMY), by post to Box 8114, 104 20 Stockholm, by email to imy@imy.se, or via imy.se. You can also complain to the authority where you live or work.

In Sweden a child can consent to this kind of service from the age of 13. If you are younger than that, please don't submit your email address. If you already have, ask a parent or guardian to email us and we'll remove it.

If what we collect changes, this page changes with it and the date below moves. We won't start using your email address for something new without asking you first.

See also the terms of use.