Privacy Policy

The console is operated by PT Triasta Solusi Informatika. This policy covers the console itself — the account you sign in with, the channels you connect, and the content you schedule. It does not cover what TikTok, Meta, Google or any other platform does with data on its own side, which is governed by that platform’s own privacy policy.

• Your operator account — the email address and display name you sign up with, and a salted hash of your password. The password itself is never stored, and never leaves the server as plain text.
• Sessions — a cookie holding a random token. The session itself is a record on the server, so signing out genuinely ends it rather than only clearing the browser.
• Connected channels — for each account you connect, the platform’s identifier for it, its handle and display name, the avatar the platform returns, and the OAuth access and refresh tokens needed to publish on your behalf.
• Content you create — captions, image descriptions, scheduled times, the media files you upload, and the record of what happened when a post was attempted.
• Operational records — recent sign-in attempts, kept so that repeated failures can be rate-limited, and publish attempts with whatever the platform answered.

There is no tracking, no advertising identifier, no analytics script and no third-party cookie. Nothing here is used to build a profile of anybody.

When you connect a TikTok account, the console asks TikTok for two scopes and no others:

• user.info.basic — your TikTok open id, display name and avatar, used only to show which account is connected on the Connectors screen so you can confirm it is the right one.
• video.upload — permission to upload the video you scheduled into the drafts of your own TikTok account. TikTok then asks you, inside the app, to add the caption and choose who can see it, and the video becomes a post only when you finish it there.

• We never receive your TikTok password, and the console cannot act on your account outside the permissions above.
• Nothing is published that you did not schedule. For TikTok, nothing is published by the console at all: the video is delivered to your drafts and you finish it in the app. There is no automatic re-posting and no content sourced from anywhere but your own uploads.
• Data received from TikTok is used only to provide the features above. It is not sold, not used for advertising, and not shared with anybody except the service providers named in the next section.
• Disconnecting the account, or asking us to delete it, removes the stored tokens and the profile information we received from TikTok.

The console runs on infrastructure it does not own. Each of these receives only what its job requires:

• Hosting — the application is served from a managed hosting platform, which necessarily processes requests.
• Database and object storage — a managed PostgreSQL database holds the console’s records, and S3-compatible object storage holds uploaded media.
• The platforms you connect — Meta (Instagram, Facebook, Threads), TikTok and Google (YouTube) receive the content you scheduled, because publishing it is the point. A platform also fetches your media from a signed, expiring link, so the file is not left publicly readable.
• AI providers — if you use generated presenters or suggested captions, the text or media involved is sent to the provider that produces them. A generated video is published already labelled as AI-generated wherever this console’s own upload path can set that label — TikTok’s inbox upload cannot, so a TikTok post is labelled by you in the app.

We do not sell personal data, and we do not share it for advertising.

• Channel credentials are sealed with AES-256-GCM under a key held in the deployment's environment, so a database copy alone does not yield a usable token.
• Sealed credentials are never sent to the browser. Publishing uses them on the server only.
• Your session cookie is httpOnly, so a script on the page cannot read it.
• Media is served from a signed, expiring URL rather than a permanently public address.

No system is perfectly secure. What is described here is what is actually implemented, not a claim that a breach is impossible.

• Account, channel and post records are kept while your account exists, because the console cannot publish without them.
• Media is deleted when the last post referencing it is removed and nothing else still needs it.
• Sign-in attempt records are kept only long enough to rate-limit repeated failures.

To have your account, its connected credentials and its content deleted, write to sis88ai@gmail.com from the address you signed up with. Deletion removes the account, the stored channel credentials, and the posts and media belonging to it. You can also disconnect any channel yourself at any time from the Connectors screen, which withdraws the console’s credentials for it immediately.

The console is a tool for businesses and their operators. It is not intended for children, and we do not knowingly collect data from anybody below the minimum age at which they can consent to data processing in their country.

If this policy changes, the date at the top of the page will change with it. Material changes will be visible as a change to the sections above rather than to a paragraph about changes.

Questions about this policy, or a request for access to or deletion of your data: sis88ai@gmail.com.