Privacy Policy

1. Who is responsible

TrinketBot Creators is operated by Claylake Interactive (Finnish business ID 3659997-5), which is the controller of the personal data described on this page. You can reach us at trinketbotapp@gmail.com.

2. Summary

• You sign in with TikTok's own sign-in. We never see or store your TikTok password.
• We ask TikTok for exactly two permissions: your basic profile (user.info.basic) and the list of your own public videos (video.list). We ask for nothing else.
• We store your TikTok identifier, your name and profile picture address, a list of your latest public videos (at most 20, details below), and the access that lets us ask TikTok for them.
• Nothing is sent anywhere. Your videos and details are shown to you, on your panel, and to no one else. We do not share, sell or publish them.
• The Disconnect button on your panel removes the connection and deletes everything stored about you at once. A creator who has not visited for 180 days is deleted automatically.

3. What we collect, and why

From TikTok, when you continue with TikTok and approve

• Your TikTok open ID, an identifier TikTok gives this site for your account. It tells us which stored account is yours. It is not your username.
• Your display name and profile picture address (permission user.info.basic). Shown at the top of your panel. The picture itself is loaded by your browser straight from TikTok; we do not copy it.
• Details of your latest public videos (permission video.list), at most 20: each video's ID, its title (cut to 300 characters), the address of its cover picture, its length, the address of TikTok's player for it, its public link on TikTok, and the date it was posted. Shown as the grid on your panel and used for Watch and Copy link. We ask TikTok for these fields only, not for a video's description or its counts of views, likes or comments. We do not receive or keep the video files, and we do not receive private videos.
• Access tokens: the tokens TikTok gives this site so it can ask for the above on your behalf, and the permissions TikTok says you granted. They are used for nothing else, stored encrypted, and never shown to you or to anyone.

Our own records

• When you first connected, and when you last visited (updated at most once a day). The second one decides when an unused account is deleted.
• A sign-in session for each browser you are signed in with: a random value kept in a cookie, of which only a one-way hash is stored, with the time it expires.

Technical data

Your IP address is used briefly, in memory, to limit how often one address can try to sign in or refresh, to protect the service from abuse. It is not written to our database. The servers that run the site keep ordinary technical logs, as any web service does, for security and for fixing faults.

Our basis for handling this data is your consent, which you give when you approve the permissions on TikTok's page and can withdraw at any time by pressing Disconnect, and our need to provide the panel you asked for.

4. What we do not do

• We do not send your videos, your details or your links to any other service or person, automatically or otherwise. The only way a link leaves the panel is you copying it.
• We do not download your videos, and we do not use any way of reading TikTok other than TikTok's own sign-in and data services.
• We do not post, edit, like, follow or delete anything on your TikTok account. The permissions we hold cannot do that.
• We do not look at anyone else's account, and TikTok does not allow this site to.
• We do not sell data, show advertising, or build profiles for advertising or analytics.

5. Cookies and your browser

These pages set only the cookies the sign-in needs:

• trinketbot_creator_session keeps you signed in. It is HttpOnly (page scripts cannot read it), lasts up to 30 days or until you sign out, and is sent only to the panel's own service.
• trinketbot_creator_oauth lasts 10 minutes and is used once, to make sure the sign-in you finish is the one you started in the same browser.

Your light or dark theme choice is saved in your browser's own storage and never sent to us. There are no advertising or analytics cookies or trackers on these pages. When you press Watch, TikTok's own player loads inside the page and may ask about, and set, cookies of its own; those are TikTok's, under TikTok's policies, not ours.

6. Who else is involved

• TikTok. It provides the sign-in and the data. What TikTok does with your information is described in TikTok's own privacy policy. When you press Watch, your browser loads TikTok's player directly from TikTok, and your browser also loads cover pictures directly from TikTok's servers; so TikTok sees those requests, as it would on any page that shows TikTok content. We send no referring address with them.
• Our database host, a managed database provider that stores the data described on this page, and our application hosting providers, whose servers run these pages and the service behind them. They handle data only to run the service.

Nobody else receives your data from us.

7. How long we keep it

• Your account (identifier, name, picture address, tokens, permissions, times): until you press Disconnect, until 180 days after your last visit, or until TikTok tells us the connection has ended (for example, you removed this site in your TikTok settings). Then it is deleted.
• Your list of videos: replaced as a whole every time it is refreshed (so a video you delete on TikTok leaves the list), and deleted with your account.
• Sessions: until you sign out or they expire after 30 days, whichever is first; expired ones are removed in a daily clean-up, and all of them go with your account.
• The sign-in check: 10 minutes, held in memory only.

Deleting is immediate in our database. Like any hosted database, ours may keep technical backups for recovery for a limited time, and deleted data leaves them as they expire; we do not use them for anything else.

8. Your choices and rights

• Disconnect (on your panel, with a confirmation) asks TikTok to end this site's access, then deletes your account, your sessions and your saved list of videos right away (if TikTok does not answer, the deletion goes ahead anyway).
• Sign out ends the session in this browser only.
• You can also remove this site from the apps you have authorised in your TikTok settings. The next time this site asks TikTok and is told the access has ended, the account here is deleted; if you never open the panel again, it is deleted after 180 days without a visit.
• You can ask us for a copy of what we hold about you, to correct it, or to delete it, and, depending on where you live (for example under the EU/UK GDPR), to restrict or object to its use. Write to trinketbotapp@gmail.com. If you are in the EU/EEA and unhappy with how we handle your data, you can complain to the Finnish Data Protection Ombudsman (tietosuoja.fi).

9. Security

• Tokens are encrypted at rest (AES-256-GCM) before they are written to the database.
• A session's token is never stored, only its SHA-256 hash, so a copy of the database alone cannot be used to sign in as anyone.
• Traffic is served over HTTPS, cookies are HttpOnly and restricted to same-site use, and sign-in and refresh requests are rate-limited.

No system is perfectly secure, and we cannot promise absolute protection, but these choices are made so that a stolen copy of the database does not hand over a working session or a usable token.

10. Children

TrinketBot Creators is for TikTok account holders, and TikTok's own minimum age applies (currently 13, or higher where local law requires it). We do not knowingly collect data from anyone below that age.

11. Changes to this policy

If this policy changes in a way that affects what we collect or how we use it, we will update the date at the top. Our Terms of Service sit alongside this policy.

12. Contact

Questions about this policy, or requests about your data: trinketbotapp@gmail.com.