Privacy Policy

TIKFLOW OS · Effective 9 September 2026

TIKFLOW OS is self-hosted software. It runs on a computer controlled by the person using it, and it stores everything locally on that computer. There is no TIKFLOW OS server, no hosted account, and no central database. The author of the Software receives no data from your instance.

Data obtained from TikTok

When you authorize your TikTok account, TikTok returns the following, which is stored locally:

Data	Why it is needed
Access token and refresh token	To call TikTok's API on your behalf until you disconnect
TikTok user identifier (`open_id`)	To bind tokens and uploads to the correct account
Display name, username, avatar URL	To show which account an upload will use, as TikTok requires
Creator settings (allowed privacy options, whether comment / duet / stitch are disabled, maximum video duration)	To present only the posting options your account actually permits
Upload identifiers and status	To track whether an upload succeeded, and to show the status TikTok reports

Only the scopes needed for these purposes are requested. No other TikTok data — no follower lists, no analytics, no messages, no other users' content — is requested or stored.

Data you provide

The video files you choose, the captions you write, the schedule times you set, and the posting settings you select. Video files are copied into a local library folder and are never modified: no watermark, logo or other alteration is added.

Where it is stored, and how it is protected

Everything is stored in a local database file and a local media folder on your own machine.
Access and refresh tokens are encrypted at rest with AES-256-GCM. The encryption key is held in a separate key file outside the database, so a copy of the database alone does not expose tokens.
Each token is cryptographically bound to the TikTok account it belongs to, so a token cannot be reused under a different account.
Tokens, client secrets and similar values are filtered out of logs, stored events, error messages and API responses.

Who it is shared with

Nobody. Your data is sent only to TikTok's official API endpoints, and only to carry out actions you requested. The Software contains no analytics, no telemetry, no crash reporting, no advertising identifiers and no third-party integrations. By default it refuses network calls to any host other than TikTok's documented endpoints.

Retention and deletion

Data is kept locally until you delete it. Nothing expires on a server, because there is no server.
Disconnecting an account asks TikTok to revoke the tokens and then destroys the stored tokens locally. The account entry remains, marked as disconnected, so past upload history stays readable.
To remove everything, delete the local database file, the media folder and the encryption key file from your machine. Uninstalling the Software and deleting its storage folder erases all data it held.
You can also revoke the Software's access at any time from your TikTok account settings, without involving the Software at all.

Content already posted to TikTok

Once a video has been delivered to TikTok, it is governed by TikTok's own privacy policy and your TikTok account settings. Deleting local data in the Software does not remove content from TikTok; remove that in the TikTok app.

Children

The Software is not intended for anyone below the minimum age required to hold a TikTok account in their jurisdiction.

Changes to this policy

This policy may be updated; the effective date above indicates the current version.

Contact

Operator: Dave · karyasetan26@gmail.com
For questions about how your data is handled by this instance, contact the operator above.

This document describes the actual behaviour of the Software as built. It is not legal advice. Review it, and adapt it to your jurisdiction, before relying on it.