Privacy Policy

TikTok authorization

When the account owner authorizes the service through TikTok Login Kit, it requests the user.info.basic and video.list permissions. TikTok returns an access token, a refresh token, their expiry times, the granted permissions and the account's open_id identifier. These are stored on the service's server, in its database, so the service can keep reading the public video list; the access token is renewed automatically when it expires.

Tokens stay server-side. They are never shown on any page, never included in a notification, never returned by the service's interfaces and never written to its logs.

The service does not read the account's profile (such as display name or avatar), its followers, messages, private videos or drafts.

Public video information

For each public video in the authorized account's video list, the service reads:

• the video's identifier, title and description, and its publication time;
• its share link, duration, width and height;
• its cover image address.

It stores the identifier, a short title (the video's title or the first line of its description), the video link without tracking parameters, the publication time, the duration and dimensions, and the times the video was first and last seen. The full description is not stored. The cover image address is fetched fresh from TikTok when a notification is sent or when an operator views the video in the restricted operator area; it is kept only briefly in memory, and neither the image nor its address is stored.

Notifications and operational records

A notification is posted to the creator's Discord community through a Discord webhook. It contains the video's title, link, cover image and publication time.

To avoid duplicates, the service records which videos were notified and when, which videos already existed when the account was first connected (those are never notified), and a history of what it observed about each video. The same kind of records are kept for the creator's own YouTube channel, which the service also monitors.

Operator access

The restricted operator area is protected by GitHub sign-in and limited to specific accounts. A sign-in stores a session identifier (as a one-way hash), the operator's GitHub user id, login and avatar address, and the session's times. Notification-text changes and manual notification requests are recorded with the operator's GitHub user id and login.

Where data is kept

Data is stored in a database on the server the service runs on. For backups, a copy of that database is sent over an encrypted connection to a temporary GitHub Actions job, encrypted there (AES-256-GCM) and kept off-host with an S3-compatible storage provider; the unencrypted copy is removed when the job ends. Backups therefore also contain the stored tokens, in encrypted form.

Data is shared only with the services needed to do the job: TikTok (to read the video list), Discord (to deliver notifications), GitHub (operator sign-in and the backup job) and the backup storage provider (encrypted backups). It is not sold and not used for advertising.

Your choices

The account owner can withdraw the service's access at any time from the TikTok account settings; the service then can no longer read the account. Questions or requests about this data can be sent to the creator Dique Plays at contato@diqueplays.com.br.

Terms

Use of the service is covered by the Terms of Service.