Privacy Policy

Overview

lyyvideo is operated by lyyvideo ("we", "us"). This document applies to the website at lyyvideo.com and to the workspace behind it, and it covers every video you upload and every account you bind.

Who is responsible for your data

lyyvideo is the controller of the workspace data described in this policy. Support requests and privacy questions go to [email protected].

What we collect

We collect the minimum needed to publish a video to TikTok and to show you what happened to it afterwards.

• Account identifiers returned by TikTok: open id, display name, avatar URL and the granted scopes.
• OAuth access and refresh tokens for the accounts you bind.
• The video files you upload, together with the caption, privacy level and interaction settings you choose.
• Publish results per attempt: task id, status, timestamps and the error message when TikTok rejects a post.
• Basic workspace data: your email address, the language you selected and the accounts in your team.
• Operational logs, which contain request metadata and never the content of a credential.

TikTok tokens and how they are stored

The TikTok authorization flow returns an access token and a refresh token instead of a password. Both are encrypted with AES-256-GCM before they are written to storage, using a key that lives only on the server. A token is decrypted in memory for the moment it is needed to call TikTok, then discarded. Because no password is ever involved, revoking access is a single action: unbind the account here, or remove the app in your TikTok settings.

Video files and temporary storage

Uploaded videos are written to a temporary upload folder so the publishing task can read them while the post is being created. That folder is not a permanent archive: the rules below say exactly how long each file stays.

• As soon as a publish succeeds, the video file and its cover image are deleted from our storage immediately. Only the publish record remains on our side.
• A temporary upload that is not referenced by any publish task is deleted automatically after 24 hours; drafts sent to your TikTok inbox use the same temporary folder and the same rule.
• Files in the media library are the same temporary uploads: once no publish task references one, it is removed by the same 24-hour cleanup.
• Publish records keep the task id, status and timestamps for 12 months; the video and the cover image are never kept with them.
• Deleting a video removes its stored file. Unbinding an account deletes the encrypted access and refresh tokens for that account. Posts already published on TikTok stay on TikTok and are managed there.

Your right to disconnect at any time

Binding a TikTok account is optional and reversible. You can unbind from the accounts page without asking us and without explaining why.

• Unbinding deletes the encrypted access and refresh tokens stored for that account immediately.
• You can also revoke the application from your TikTok account settings; the workspace then stops being able to publish.
• You may ask us to delete your workspace data, and we act on that request within one month.
• Videos that TikTok has already published stay on TikTok until you delete them there.

Who we share data with

We do not sell personal data and we do not share it for advertising. Data leaves the workspace only in these cases:

• TikTok, when a video is published or an account is queried, through the official API and only for the account you bound.
• The platform that brokers the TikTok API connection, which relays the request on our behalf.
• Infrastructure providers that host the workspace storage, bound by a processing agreement.
• A public authority, when the law requires it and only for the scope that is required.

Your rights

You can exercise the following rights from the workspace, or by writing to [email protected]:

• See what is stored for your workspace, including the bound accounts and their publish history.
• Correct account details that are wrong.
• Export your publishing history as a file.
• Delete a video, an account connection or the whole workspace.
• Withdraw consent by unbinding an account, which stops future publishing immediately.

How long data is kept

Retention follows the storage section above, item for item: unbinding an account deletes its encrypted tokens immediately; a publish record is kept for 12 months without the video or the cover image; a temporary upload that no publish task references is deleted after 24 hours; and the video file plus its cover image are deleted as soon as the publish succeeds. Nothing is kept indefinitely because it might be useful later.

Security

Tokens are encrypted with AES-256-GCM and the key never leaves the server. Secrets are read from server-side environment variables only and are never sent to a browser, embedded in a page or written to a log. The publishing interface runs in mock mode until real credentials are configured, so a review can happen without live credentials existing at all.

Cookies and local storage

The public site uses local storage for one thing only: remembering whether you chose English or Chinese. There is no advertising tracker and no third-party analytics script on these pages.

Children

The service is not intended for children, and it must not be used to publish content featuring minors in a way that breaks TikTok policy or local law.

Changes to this policy

Material changes to this policy are announced to the email address on the workspace account, and the date at the top of the page is updated at the same time.

Contact

Questions about this document, or a data request? Write to [email protected] and we answer within one month.

Canonical URLs registered with TikTok

The two URLs below are registered character for character in the TikTok developer portal, and they are the pages a reviewer will open.