Creator Mode: own-account TikTok connection
The downloadable Windows release is separate from the internal Publisher described below. Its HTTPS authorization broker is live on Cloudflare Workers with per-connection Durable Object storage. Production authorization is configured but pending required TikTok approval. A separate Sandbox Login Review demonstrates user.info.basic only for configured Sandbox target users after broker activation; uploads and posts remain disabled. This section describes the implemented data handling when a creator authorizes the service.
Creators authorize their own TikTok account on TikTok using Desktop PKCE and a loopback callback. The desktop sends the authorization code, verifier and state to an HTTPS broker. The broker keeps the TikTok client secret in server secret configuration and stores encrypted access/refresh tokens, account open_id, granted scopes, expiry and nickname in an isolated record per connection. It returns only an opaque session handle and display information. The desktop protects this handle using current-user Windows DPAPI; it does not store TikTok access or refresh tokens.
Selected MP4 files and previews remain on the computer. After express consent, video bytes transfer directly to TikTok's temporary HTTPS upload URL, without passing through AIVMeta's broker. The broker processes caption, privacy, interactions, disclosures, video hash/size/duration, consent flags and TikTok publish/status identifiers. It does not receive the local file path or video bytes. Local unencrypted SQLite receipts contain connection/flow identifiers, file hashes and status records; these have no automatic deletion schedule.
OAuth pending state expires after 10 minutes. Broker connections and their token/posting records expire and are deleted after at most 30 days, sooner if refresh authorization expires or the creator disconnects. Disconnect disables local use, requests TikTok revocation and deletes stored broker credentials even if TikTok revocation fails. It deletes saved local handles after confirmed broker deletion. If the network request fails, locally disabled opaque handles remain only to retry deletion. Use TikTok's connected-app settings to revoke access if required. Disconnect does not delete videos or platform content.
The code writes no request bodies, query strings, authorization headers, tokens or provider error bodies to logs. Worker observability is configured off. Abuse controls retain salted hashes of connection IP addresses and request counts for approximately 10 minutes, and per-connection counters until connection deletion. Hosting providers can still process network information and retain operational/security records according to their own policies; provider operational retention is governed by their policies. No claim about the provider's retention period is made.
To remove local data, first disconnect, close the desktop, then remove its portable folder and the AIVMeta/CreatorMode folder under your Windows LOCALAPPDATA. Email hello@aivmeta.com for deletion help; do not send session handles, tokens or secrets. The package is unsigned and depends on the security of the user's Windows account and the hosting account. These safeguards do not guarantee security.
1. Connected accounts and authentication
Publisher uses the platforms' OAuth authorization flows. Account holders sign in with the relevant platform and choose whether to grant access. Publisher receives authorization codes and, after exchange, access tokens, refresh tokens where provided, granted permissions, and expiry information. Platform passwords are not entered into Publisher.
Depending on the platform and permissions, Publisher processes account or channel IDs, display names, usernames, avatar URLs, and linked Facebook Page and Instagram professional-account information. TikTok's basic identity response supplies an account identifier, display name, and avatar URL. These details help identify the connected account and confirm the destination before publishing.
2. Media and publishing records
Publisher reads media files included in its local lesson library and the associated titles, descriptions, captions, hashtags, and publishing settings. It checks local files and may use locally prepared distribution copies for platform-compatible uploads.
It stores publishing metadata, account bindings, approvals, schedules, file hashes, processing status, errors, and platform responses such as upload, container, video, or post IDs and publication timestamps. These records support status checks, troubleshooting, and protection against duplicate posts.
3. How information is used and shared
Connected-account information and tokens are used to authenticate platform requests, confirm account identity, check permissions and upload status, and carry out publishing actions or schedules authorized by the operator.
- TikTok: when enabled and authorized, the Inbox upload flow sends the selected video to TikTok. The account holder then finishes editing, captioning, and posting in TikTok. Direct posting, including a caption and publishing settings, is a separate flow that requires the relevant permissions and explicit setup.
- Instagram: authorized Reel operations transfer the selected video, caption, and applicable disclosure settings to Meta/Instagram and retrieve processing and publication status.
- YouTube: authorized operations transfer selected videos, titles, descriptions, privacy settings, and caption tracks where enabled; they may also manage playlist placement and scheduled public release.
The Publisher workflow has no data-sale, advertising, or data-broker integration. Its connected-platform data is used for the publishing functions described here, not sold through the application. Platform providers receive the information needed for authorized API requests and process it under their own policies. Published content can be visible to others according to the account holder's platform settings.
4. Local storage and security
Publisher stores configured client credentials and OAuth tokens in a local vault encrypted with Windows Data Protection API (DPAPI) for the current Windows user. It checks OAuth state, uses PKCE for TikTok Desktop login, and communicates with platform APIs over HTTPS.
Publishing metadata, receipts, settings, and diagnostic records are also stored locally, including in a SQLite database and files. Those records and the media files are not encrypted by the credential vault. Access therefore also depends on the computer's account permissions, disk protection, backups, and security. Encryption and these safeguards do not guarantee that a device or account cannot be compromised.
5. Retention, disconnecting, and revoking access
Publisher has no automatic age-based deletion schedule for its local media library or publishing history. Records remain until the operator removes them or requests help with deletion. Disconnecting an account does not delete local videos, publishing receipts, or content already transferred to a platform.
- TikTok: local disconnect removes stored user tokens, the connected identity, and account binding, while preserving app credentials and posting receipts. It does not send a remote revocation request.
- Instagram: local disconnect removes the stored connection credentials. It does not automatically revoke access at Meta; published receipts remain.
- YouTube: disconnect attempts Google token revocation before clearing local user tokens. If revocation fails, Publisher reports the failure and retains the token so revocation can be retried. Client configuration and publishing history are preserved.
Use each platform's account or connected-app settings to revoke access there, and its content controls to remove uploaded or published media. Platform providers control retention of their own copies. Local files and backups must be handled separately by whoever controls the computer.
6. Website visits and contact messages
This static website does not provide an account sign-in or collect OAuth tokens. It has no AIVMeta analytics scripts, advertising pixels, or embedded social feeds. GitHub Pages hosts the site and may process connection information, such as IP addresses and request details, to serve and protect it. The site loads fonts from Google Fonts, which receives the browser requests needed to deliver them.
See GitHub's Privacy Statement and Google's Privacy Policy. Following a social link takes you to a separate service with its own privacy practices. Emailing AIVMeta shares your email address and message with AIVMeta and the email services involved in delivery so that your request can be handled.
7. Privacy and deletion requests
Email hello@aivmeta.com to request access, correction, or deletion of information held by AIVMeta, or help removing Publisher data. Identify the relevant platform, account, and records; do not send passwords, client secrets, or tokens. We may need enough information to verify that you are entitled to make the request.
AIVMeta can address information it controls and provide guidance for local data. It cannot remotely erase files on a computer it does not control or guarantee deletion from third-party platforms. We will explain any records that cannot be removed, including information that must be retained to meet applicable legal obligations or address a dispute.
8. Updates and contact
We may update this policy as the website or publishing workflow changes. The effective date above identifies the current version. For questions about this policy or a privacy request, contact hello@aivmeta.com.