Privacy Policy

1. Information You Provide Directly

• Account Information: your email address and display name, plus an avatar if you upload one. We do not ask for a password unless you are given one for a corporate or reviewer account — normal sign-in uses a one-time code, a magic link, or a social login.
• Content You Upload: the images, video clips, audio and text prompts you submit to generate or publish content, together with the captions, hashtags and disclosure settings you attach to them.
• Payment Information: if you purchase credits or a paid plan, our payment processors (Stripe, Creem and PayPal) collect and store your card or wallet details. We receive only the resulting transaction metadata — amount, currency, status, the last four digits and the billing country. We never see or store a full card number.
• Support Correspondence: what you send us by email, in-product feedback or a form, including any attachments.
• Marketing Preferences: your email address and subscription choices when you opt in to product updates.

2. Information From Connected Platform Accounts

If you connect a TikTok or YouTube channel, we receive an OAuth token and basic profile and publishing data for that channel. Section 4 lists exactly what is received and what is not.

3. Information Collected Automatically

• Device and Connection Data: IP address, browser and operating system, device type, and the language your browser reports.
• Usage Data: pages viewed, features used, generation runs, credit consumption, error events and access times. This is what lets us meter credits and debug failures.
• Cookies and Similar Technologies: a session cookie for sign-in, a consent cookie, and — only with your consent — analytics cookies. See the Cookie Policy below.

1. What We Receive

From TikTok (TikTok API Services):

• your TikTok user identifier (open ID), display name and avatar;
• the privacy levels your account is allowed to post with, and the interaction settings (comments, duet, stitch) the platform permits;
• the result of each upload you ask us to perform: the publish ID, the post ID once published, and any error the platform returns;
• if you switch on performance read-back, public statistics for posts TikForge published — views, likes, comments and shares.

From YouTube (YouTube API Services):

• your channel ID, channel title and channel avatar;
• the result of each upload: the video ID, upload status and processing status, and any error the API returns;
• if you switch on performance read-back, public statistics for videos TikForge uploaded.

Tokens: an access token and a refresh token issued by the platform. They are stored encrypted with AES-256-GCM; the encryption key lives in our server environment and is never written to the database or to logs.

What we never access: your private messages, your watch or search history, your followers' or subscribers' personal data, your advertising accounts, your Google Account profile beyond the channel identity above, or any TikTok content you did not ask us to publish. The YouTube scopes we request are https://www.googleapis.com/auth/youtube.upload and https://www.googleapis.com/auth/youtube.readonly, for the purposes set out under YouTube API Services below. We do not request TikTok scopes beyond the profile and posting scopes shown on the consent screen.

2. Why We Receive It

Solely to do what you asked: show which channels are connected, upload the specific video you selected with the caption you wrote, tell you whether it succeeded, and — only if you opt in — show how the post performed. Nothing else.

We do not use TikTok or Google user data for advertising, for re-targeting, for credit or eligibility decisions, or to develop, improve or train any machine-learning or AI model. We do not sell it, and we do not transfer it to anyone except as described in Section 5.

3. Google API Services — Limited Use

TikForge's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. YouTube API Services

TikForge uses YouTube API Services. By connecting a channel you confirm that you have read and agree to the YouTube Terms of Service, and you acknowledge the Google Privacy Policy. Google's handling of your data is governed by those documents; ours is governed by this one.

Connecting a channel requests exactly these two scopes:

• https://www.googleapis.com/auth/youtube.upload — to publish finished videos to your own YouTube channel after you explicitly confirm the upload.
• https://www.googleapis.com/auth/youtube.readonly — after you connect, to read your channel ID and title so we can bind the account and display which channel is connected.

Content published to YouTube is subject to YouTube's own policies regardless of what our compliance engine allows. Until our API client completes Google's compliance audit, uploads may be restricted by YouTube to private visibility — we tell you before you publish rather than after.

5. TikTok API Services

TikForge uses TikTok API Services, including the Content Posting API. TikTok's handling of your data is described in the TikTok Privacy Policy. Before you publish, we show the nickname and privacy options the platform returned for your account, and we require you to confirm that your post complies with TikTok's branded-content and music-licensing rules.

TikForge is an independent product. It is not affiliated with, endorsed by, or sponsored by TikTok, ByteDance, Google or YouTube.

6. Disconnecting and Revoking Access

• In TikForge: open Dashboard → Channels and disconnect the channel. We delete the stored tokens immediately and ask the platform to revoke them, so no further API call can be made with them.
• On Google: revoke TikForge's access at myaccount.google.com/permissions. Revocation stops all further API calls immediately; disconnecting inside TikForge afterwards cleans up our side.
• On TikTok: review or remove TikForge under Settings → Security and login → Manage app permissions (tiktok.com/setting/apps).

Revoking access does not remove content already published to your channel. Delete it on the platform, or through TikForge where the platform allows deletion.

7. Retention and Deletion

• Tokens: deleted the moment you disconnect, and invalidated by the platform in any case when they expire or are revoked.
• Publish records (post ID, caption, timestamps, status, statistics snapshots): kept while your account is open so your history and reporting stay intact. Deleting a record in TikForge removes it from our database; deleting it on the platform does not require our copy to stay.
• Your account: on request we delete your account and everything attached to it — connected channels, tokens, generation history, publish records and statistics — within 30 days, except records we are required to keep for tax, accounting, fraud-prevention or legal reasons, which are retained for the period the law requires and then deleted.

To request deletion, email support@tikforge.ai with the subject "Data deletion request" from the address on the account, or use the account controls in Dashboard → Settings. We confirm receipt within 7 days and complete the deletion within 30 days.