Privacy Policy

Last updated: August 18, 2026

FloPost stores the minimum it needs to publish videos to your TikTok account on your instruction. This page lists exactly what that is, where it lives, and how to get rid of it.

What we store

• Your FloPost account — a name, email address, and avatar, taken from the TikTok or Google account you sign in with.
• Connected TikTok accounts — the account's public profile (display name, username, avatar) and the OAuth access and refresh tokens you grant on TikTok's consent screen. Tokens are encrypted at rest with AES-256-GCM and are never logged or sent to the browser.
• Post history — captions, chosen settings, and TikTok's reported status for each publish attempt, so the dashboard can show you what happened.
• Videos, briefly — an uploaded video is staged in object storage only long enough for TikTok to download it. It is deleted as soon as TikTok confirms the post, and no later than one day after upload in every other case. FloPost keeps no copy.

What we do not do

• No selling or sharing of your data with advertisers.
• No analytics trackers, ad pixels, or fingerprinting.
• No reading of your TikTok inbox, messages, followers, or anything beyond the scopes shown on TikTok's consent screen.
• No posting without your explicit instruction — every publish starts with you pressing the button.

Where it lives

FloPost runs on infrastructure from Vercel (application hosting), Supabase (database), and Cloudflare (DNS and temporary video storage). Data is processed by TikTok when you sign in or publish, and by Google if you choose Google sign-in — each under their own privacy policies.

Cookies

One cookie: the session that keeps you signed in. It is httpOnly, signed, and expires after 30 days. There are no third-party cookies.

Deleting your data

• Disconnect a TikTok account from the dashboard — this revokes the token with TikTok and deletes the stored copy.
• You can also revoke FloPost's access at any time from TikTok's own app settings; the stored token stops working immediately.
• Full deletion — email yugie.nugraha@gmail.com from the address on your account and every record above is removed.

Changes

If this policy changes, the date above changes with it. Material changes will be visible before you next publish.

Contact

Privacy questions: yugie.nugraha@gmail.com.