Privacy Policy
1. Who we are
Korokk Studio ("Studio") is a private publishing tool operated by Mohd Safwan Abd Rahman, an individual developer in Malaysia. This policy explains what happens to data when you use Studio and when you connect a TikTok account to it.
2. What we collect
| Data | When | Why |
|---|---|---|
| TikTok account identifier (open ID), display name, avatar, follower and like counts | When you connect TikTok | To show you which account is connected and your own statistics |
| List of your own public TikTok videos and their status | When you view your library in Studio | To confirm that an upload or post succeeded |
| Video and photo files you choose to publish | When you upload them | To publish them to the account you selected |
| Access and refresh tokens issued by TikTok (through Composio) | When you connect TikTok | To make API calls on your behalf until you disconnect |
| Sign-in email address | When you open Studio | To restrict access to authorised users |
We do not collect your TikTok password. We do not collect personal data about your followers, your viewers, or any other TikTok user.
3. Where data is stored
- Connected-account tokens are held by Composio (backend.composio.dev) as the OAuth broker. Studio stores only the connection reference.
- Content and drafts are stored on a private self-hosted server controlled by the operator, and in a private GitHub repository for version history.
- Access control is handled by Cloudflare Access; your sign-in email is processed there to decide whether you may open Studio.
No data is sold, rented, or shared with advertisers or data brokers.
4. How we use data
Only to operate the features you ask for: authenticating you, displaying your own TikTok statistics, uploading the media you select, publishing it to your own account, and reporting whether the post succeeded. We do not use your data to train models, and we do not run analytics or profiling on it.
5. Retention
Tokens remain valid until you disconnect the account or revoke access in TikTok. Drafts and media stay on the operator's server until you delete them. Server logs are kept for a maximum of 30 days.
6. Your rights: access and deletion
- Disconnect at any time. Remove the TikTok connection from Studio's settings, or from TikTok → Settings and privacy → Security and login → Manage app permissions. Tokens are discarded and API access stops immediately.
- Request deletion. Email sa7one@gmail.com with the subject "Data deletion request" and the TikTok username you connected. All stored data for that account is deleted within 30 days, and you receive confirmation by email.
- Ask what we hold. The same address can be used to request a copy of the data associated with your account.
7. Security
Studio is served over HTTPS, restricted to authorised email addresses, and reachable only through an authenticated tunnel. Tokens are stored by the OAuth broker, never embedded in web pages. No system is perfectly secure, but access is limited to the operator and named collaborators.
8. Children
Studio is not directed at children and is limited to users aged 18 or over, consistent with TikTok's own age requirements.
9. Changes
If this policy changes, the new version is published at this URL with a new "last updated" date.
10. Contact
Privacy questions or requests: sa7one@gmail.com