Privacy Policy

What we collect

• Your account: your email address and a password (stored only as a secure hash by our authentication provider), or a sign-in link sent to your email.
• TikTok account information, when you connect TikTok and approve it on TikTok's screen: your TikTok user ID (open_id), username, display name, profile picture, follower and video counts, the permissions you granted, and the posting settings TikTok reports for your account (such as which privacy levels are available and whether comments are turned off).
• TikTok access tokens that let the Service act for you within the permissions you granted. These are encrypted before they are stored.
• Content you create: automations and their settings, writing instructions, hooks, photos you upload, the slide text the AI writes, the rendered slide images, titles, captions, hashtags and posting schedules.
• Post information: TikTok post and publish IDs, publishing status, and each post's view, like, comment and share counts.
• Technical logs such as error messages and request times, used to keep the Service running.

How we use it

• To sign you in and keep your data separate from other users.
• To show which TikTok account a post will go to and the post settings TikTok allows for it.
• To generate slides, and to publish them to your connected TikTok accounts when you approve a post or have explicitly agreed to scheduled posting.
• To show you whether a post was published and how it is performing.
• To fix problems and prevent abuse.

We do not sell your information, use it for advertising, or use your TikTok data for anything other than providing the Service to you. We only post to TikTok accounts you have connected, and only content you set up.

Who processes it

• Supabase hosts our database, file storage and sign-in system. Your data is stored there.
• An AI model provider (currently Anthropic) receives the writing instructions and hooks needed to write slide text. It does not receive your TikTok tokens.
• TikTok receives the photos, title, caption and post settings of each post you publish, and we receive your profile information and post statistics from TikTok through its official API.
• Our web hosting provider, which runs the application.

How we protect it

All traffic uses HTTPS. TikTok access and refresh tokens are encrypted with AES-256-GCM before storage and are never sent to your browser. Database rules restrict each user to their own rows.

Rendered slide images are stored at long, unguessable web addresses that are publicly reachable, because TikTok has to download them from our domain to create your post. Don't include anything in your slides that you would not want to be public.

Keeping and deleting your data

• We keep your data while your account is open.
• Disconnecting a TikTok account in the Service revokes our access with TikTok and deletes the stored tokens. You can also remove the Service from TikTok's app settings at any time.
• To delete your account and all associated data, email ae2200@nyu.edu from the address you signed up with. We will delete it within 30 days, apart from anything we are required by law to keep.
• Posts already published to TikTok stay on TikTok until you delete them there.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, or object to how we use it, by emailing ae2200@nyu.edu. Depending on where you live you may also have the right to complain to a data protection authority.

Children

The Service is not intended for anyone under 18, and we do not knowingly collect data from children.

Changes

If we change this policy we will update the date above, and tell you by email or in the app if the change is significant.

Contact

Questions about this policy: ae2200@nyu.edu.