Privacy Policy

1. Who we are

This Privacy Policy describes how the private-beta operator of Publane handles personal data through the service at https://app.wtverkoop.com. The final legal entity and monitored privacy contact will be published before external platform review.

2. Scope

This policy applies to the public website, SaaS account, account connection features, publishing workflow, support, and security operations. It does not replace the privacy terms of a connected third-party platform.

3. SaaS account data

We process the email address, authentication identifiers, account status, consent timestamps, and security/session information needed to create, protect, recover, and delete a product account. Password authentication is provided by Supabase; the application does not store plaintext passwords.

4. Connected account data and OAuth permissions

When the official integration is enabled, users may authorize `user.info.basic` and `video.publish`. We expect to process the platform open ID, display name, username, avatar URL, granted scopes, connection status, and expiration metadata needed for that connection. The current private beta does not connect to TikTok or request these permissions. We do not plan to request unrelated platform permissions in V1.

5. Tokens and credentials

Access and refresh tokens will be kept server-side, encrypted at the application layer, and never intentionally exposed to the browser, source control, or ordinary logs. Client secrets and encryption keys are kept in deployment secret storage.

6. Publishing metadata

We may store a caption, selected privacy and interaction settings, commercial content disclosure, AIGC declaration, consent timestamp, file metadata, publishing identifier, internal state, raw platform status, safe error fields, and public post identifiers where returned. We do not use this metadata to create unrelated advertising profiles.

7. Video handling

V1 is designed not to permanently store user video files. A local file may be previewed in the user’s browser and, after explicit confirmation in the future official workflow, transferred for publishing. The current private beta does not upload video to TikTok or to our servers. This policy will be updated if the verified upload architecture changes.

8. Logs and security data

We may process timestamps, route/event names, a limited request identifier, safe error codes, and platform log identifiers to secure and operate the service. Passwords, cookies, authorization headers, OAuth codes, tokens, client secrets, upload URLs, and raw request bodies are excluded or redacted from application logs by policy.

9. How we use data

• Provide and secure the requested product features.
• Authenticate users and maintain sessions.
• Carry out user-confirmed account connection and publishing operations.
• Display publishing status and troubleshoot safe error information.
• Meet legal, abuse-prevention, and security obligations.

10. Service providers and third parties

Planned providers include Supabase for authentication and PostgreSQL, Netlify for web hosting, and TikTok for authorized account and publishing services. Each provider processes data under its own terms and privacy commitments. The final provider list and international transfer disclosures require owner/legal review before launch.

11. Retention

Account and connection data is retained while needed to provide the service. Expired OAuth state is short-lived. Publishing history and minimal audit events are retained only for a documented operational period. Exact periods must be approved and inserted before public launch. Legal or security requirements may justify limited additional retention.

12. Deletion and disconnect

Users can request account deletion in Settings. A monitored privacy contact will be added before external platform review. A future live process will revoke connected authorization where available, remove token material, and delete or de-identify product data subject to required retention. Disconnecting a platform account does not delete content already published on that platform.

13. Security

The service is designed with encrypted transport, server-only secrets, application-level token encryption, access controls, CSRF defenses, validation, rate-limit boundaries, redacted logging, and reviewed database migrations. No system can guarantee absolute security; suspected incidents should be reported promptly.

14. User rights and regional terms

Available privacy rights depend on the user’s location and the final operating entity. Requests may include access, correction, deletion, restriction, or objection where the law provides them. The final jurisdiction-specific language remains pending owner and counsel details.

15. Changes and contact

Material updates will be posted with a new effective date. Until a monitored privacy address is published, the Contact page states the current private-beta support status.