Privacy Policy

This Privacy Policy governs the practices of Sihirli.tv (“Studio”, “Application”, or “we”) regarding the collection, use, storage, and protection of information obtained through our website and our official TikTok Content Posting API integration.

1. Data Collected via TikTok OAuth & Purpose of Use

When you authorize our Application using the official TikTok Login Kit / OAuth 2.0 flow, we request the following specific scopes and access the following data:

Scope	Data Accessed	Exact Purpose
user.info.basic	open_id, union_id, display_name, avatar_url	Identifying the authorized creator profile in the control panel to ensure content is dispatched to the intended account.
video.upload	Binary upload authorization	Uploading vertical 9:16 video chunks to TikTok ingestion endpoints upon operator approval.
video.publish	Publishing session authorization	Delivering approved video packages to the creator's private mobile Creator Inbox as drafts or direct posts.

2. Data We Strictly DO NOT Collect

• We do not collect, request, or store your TikTok password or payment information.
• We do not access or collect private messages (DMs), friends lists, or followers.
• We do not track browsing history, video views, or personal consumption habits.
• Under user.info.basic, TikTok does not share email addresses or phone numbers with our integration.

3. Token Storage & Security Architecture (Honest Technical Disclosure)

• Local Server Storage: Tokens are stored in structured JSON files on the local filesystem (data/secrets/tiktok_tokens_production.json).
• POSIX Access Restrictions: Files are strictly protected with chmod 0600 permissions (readable and writable exclusively by the executing OS process).
• Encryption Status Disclosure: Tokens are stored on disk in structured plaintext protected by operating system access controls; they are not encrypted with an external Key Management Service (KMS) or AES envelope at rest.
• Log Redaction: All tokens and client secrets are masked in system logs (sbaw...1111).

4. Data Retention & Local Deletion

Tokens are retained only as long as your account remains connected. Clicking the “Disconnect” button in the studio panel permanently deletes cached tokens from disk and marks the account disconnected in the local database.

5. Revoking Access Directly in TikTok

You can revoke access at any time directly through the TikTok mobile app:

1. Open the TikTok app and navigate to your Profile.
2. Go to Settings and privacy > Security & permissions.
3. Select Apps and web services.
4. Locate AI Content Factory and tap Remove access.

6. Contact & Inquiries