Privacy Policy

1. Overview

This Privacy Policy describes how PublyFlow (“the App”), a content scheduling and publishing tool for TikTok creators and social media managers developed by Stephanie Losert, handles information when it interacts with the TikTok platform on behalf of authorized users. PublyFlow enables creators and social media managers to connect their own TikTok account and publish video content to it, either directly or as a draft for manual review.

2. Who This Policy Applies To

This policy applies to any TikTok content creator or social media manager who authorizes PublyFlow to access their TikTok account via TikTok's OAuth 2.0 Login Kit. Each user authorizes the app independently with their own TikTok credentials and can only manage their own connected account(s).

3. Data Collected via TikTok API

PublyFlow uses the following TikTok API scopes:

4. How Data Is Used

• The open_id and access/refresh tokens are used exclusively to make authorized API calls to TikTok on the creator's behalf (publishing or uploading content they explicitly submitted through the App).
• The display_name is shown in the App's dashboard so the user can confirm which account is connected.
• Video files you upload through the App's content library are stored in the App's own database and file storage (Supabase) so they can be organized and scheduled. They are transmitted to TikTok only when you explicitly publish or schedule that specific video through the App — never automatically and never to any other third party.
• No analytics, advertising, or behavioral tracking is performed.

5. Data Storage and Security

OAuth tokens and the connected account's display name are stored in encrypted, HTTP-only session cookies in the user's own browser session and are not persisted in a database.

Video files you upload through the App's content library are stored server-side in PublyFlow's own database and file storage (Supabase), so they remain available to you between sessions for organizing, scheduling, and publishing. This storage is operated by Stephanie Losert and is not accessible to any third party other than TikTok, and only for the specific video and only at the moment you choose to publish or schedule it.

6. Data Sharing

PublyFlow does not share, sell, rent, or otherwise disclose any data obtained via TikTok's API to any third party. The App does not use advertising networks, analytics platforms, or external data processors beyond what is required to operate the App itself (e.g. hosting infrastructure).

7. Data Retention

OAuth tokens are retained only for the lifetime of the browser session cookie (per TikTok's token expiry) and are deleted when the session expires or the user disconnects their account. Uploaded video files remain in the App's storage until the user deletes them directly in the content library, or until the user requests deletion by contacting us.

8. Your Rights

As the owner of the connected TikTok account, you have full control over your data. You may revoke the App's access at any time through TikTok's connected apps settings at tiktok.com/setting/connected-apps. Revoking access immediately invalidates all tokens. You can delete any uploaded video directly in the App's content library at any time; this permanently removes the file from our storage.

9. Children's Privacy

PublyFlow is not intended for use by individuals under the age of 18. The application is a tool for adult creators and social media professionals only.

10. Changes to This Policy

This Privacy Policy may be updated from time to time. Changes will be reflected in the “Last updated” date at the top of this page.

11. Contact