1. Scope
This Privacy Policy applies to the Media Uploader desktop creator application, its TikTok publishing integration, and this official informational website at tiktok-media.maxxi.org. “Media Uploader,” “we,” “us,” and “our” refer to the operator of the Media Uploader service.
2. Information we process
TikTok account information
When a creator chooses to connect TikTok through Login Kit, the application may process the creator’s TikTok Open ID, display name, avatar URL, exact creator username, authorized scopes, and token lifecycle metadata. Display names are not treated as unique identity. The application uses Open ID and exact creator username checks to protect account binding.
Authorization credentials
The application receives an access token and refresh token after authorization. These credentials are stored in the operator-controlled local runtime and are used to verify the account, refresh authorization, query creator capabilities, and perform a creator-confirmed post. Tokens, authorization codes, PKCE values, and signed upload URLs are not embedded in this public website or intentionally written to public logs or publishing result files.
Content and publishing information
The application processes videos selected by the operator, associated metadata and captions, media properties, content fingerprints, the creator’s selected privacy and interaction choices, disclosure choices, consent timestamps, upload progress, TikTok publish identifiers, provider status, and local completion or recovery records.
Website information
This static website does not provide user accounts, forms, analytics, advertising, or behavioral tracking. Hosting and network providers, including Cloudflare Pages and related infrastructure, may automatically process technical request information such as IP address, browser type, requested URL, timestamps, and security events under their own policies.
3. How we use information
We process this information to:
- authenticate the creator through TikTok Login Kit;
- verify that the connected account matches the intended creator;
- read current TikTok Creator Info capabilities;
- prepare and preview the exact selected video;
- apply the creator’s privacy, interaction, disclosure, and caption choices;
- publish only after an explicit creator action;
- refresh authorization when appropriate;
- verify provider completion and prevent accidental duplicate publishing;
- retain safety evidence for failed, ambiguous, and completed attempts; and
- protect the service, diagnose errors, and meet legal obligations.
4. Legal bases
Where applicable law requires a legal basis, we rely on performance of the service requested by the creator, the creator’s consent for TikTok authorization and publishing choices, our legitimate interests in security and preventing duplicate or unauthorized publishing, and compliance with legal obligations. Consent may be withdrawn by revoking the app’s TikTok access, subject to records we must retain for security or legal reasons.
5. Sharing and service providers
We transmit information to TikTok only as needed to provide the connected features the creator requests, including authorization, account verification, Creator Info, and creator-confirmed Content Posting API operations. Website hosting and network providers may process technical traffic data. We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising.
6. Storage, security, and retention
Application credentials are stored in restricted files in the operator-controlled environment and excluded from the public source repository. Result files and recovery records are designed to exclude credentials and signed upload URLs. We use access controls, atomic writes, exact identity checks, source fingerprint checks, single-use consent, and fail-closed recovery rules. No system can guarantee absolute security.
Authorization credentials are retained until they expire, are rotated, are revoked, or are removed by the operator. Content and publishing records are retained as long as reasonably needed to operate the service, prevent duplicate publishing, resolve ambiguous attempts, comply with law, or establish and defend legal claims. The operator may remove local data when it is no longer required, provided doing so does not create an unsafe unresolved publishing state.
7. Your choices and rights
You may choose not to connect TikTok or publish content. You may revoke Media Uploader’s TikTok access through TikTok account settings. Depending on your location, you may have rights to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent. To make a request, contact us using the details below. We may need to verify the request and may retain limited information where permitted or required by law.
8. International processing
TikTok and infrastructure providers may process information in countries other than your own. Where required, the relevant service provider is responsible for appropriate transfer safeguards under its terms and privacy policy.
9. Children
Media Uploader is intended for creators legally able to authorize and publish content through TikTok. It is not directed to children under 13, and we do not knowingly collect personal information from children through this website.
10. Third-party services
TikTok features are governed by TikTok’s own terms and privacy policies. Links to third-party services are provided for convenience; their information practices are not controlled by this policy.
11. Changes
We may update this policy to reflect changes to the product, law, or service providers. We will post the updated date on this page. Material changes will be communicated where required.
12. Contact
Questions or privacy requests may be sent to media@maxxi.org. Please do not email access tokens, passwords, unpublished videos, or other secrets.