Privacy Policy

This Privacy Policy describes how Loopcraft ("Loopcraft", "the Service", "we", "us") collects, uses, stores, shares and protects your personal information when you use our creator publishing service. By using the Service you agree to the collection and use of information in accordance with this policy.

1. Who we are

Loopcraft currently lets creators connect one TikTok identity and review, schedule or publish original videos through TikTok's official API. Additional platform integrations may be offered in later releases and will use their official authorization flows. For any privacy question or request you can contact us at hernann1501@gmail.com.

2. Information we collect

Loopcraft identity and session. TikTok Login creates your Loopcraft creator space. We store your TikTok open ID, display name and avatar plus a random browser-session token. Only a SHA-256 hash of that session token is stored in our database. Loopcraft does not create or store a separate password.

TikTok account information. When you connect a TikTok account via TikTok Login Kit we receive and store your TikTok open ID, union ID, display name and avatar URL, together with the OAuth access and refresh tokens required to act on your behalf. Tokens are encrypted at rest with AES-256-GCM. We never receive or store your TikTok password.

YouTube account information. When you connect a Google account, Google provides the YouTube channel ID, channel name and image plus the OAuth tokens needed to upload videos and identify the selected channel. We never receive or store your Google password.

Instagram account information. When you connect an Instagram professional account, Meta provides its account ID, username and account type plus the OAuth token needed to publish Reels. We never receive or store your Instagram or Facebook password.

Content you provide. We store the videos, captions and publishing settings you provide so that we can send them only when you choose.

Technical data. Like most web services we process basic technical information (IP address, browser type, timestamps) in server logs for security and troubleshooting purposes.

3. TikTok API scopes and how we use them

Loopcraft requests only the following TikTok scopes, and uses each one solely for the purpose described:

• user.info.basic — to read your open ID, display name and avatar so we can show which account you have connected.
• video.publish — to directly publish the videos you schedule, at the time and to the account you selected.

We only ever act on publishing actions that you explicitly configure. We do not read your private messages, followers, analytics or any data outside the scopes above.

4. Optional future platform permissions

When the YouTube integration is enabled in a future release, Loopcraft will request youtube.upload to upload the videos you choose and youtube.readonly only to identify and display the connected channel. Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

When the Instagram integration is enabled in a future release, Loopcraft will request instagram_business_basic to identify the professional account and instagram_business_content_publish solely to create and publish the Reels you explicitly send or schedule.

5. How we use your information

We use the data described above exclusively to operate the Service: authenticating you, connecting your social accounts, storing your scheduled content, publishing it through the selected official APIs, and showing you the status of your posts. We do not sell or rent your personal data, we do not use it for advertising, and we do not use your content or data to train machine-learning models.

6. Sharing and third parties

We share data only with the following categories of recipients, and only to the extent necessary to run the Service:

• TikTok — the videos, captions and publishing instructions you schedule are transmitted to TikTok via its official API, subject to TikTok's own Privacy Policy.
• Google/YouTube and Meta/Instagram — videos, metadata and publishing instructions are sent only to each platform you select, subject to that platform's privacy policy.
• Hosting and infrastructure providers — the servers and storage used to run the Service process data on our behalf under confidentiality obligations.
• Legal requirements — we may disclose information if required to do so by law or a valid legal process.

7. Cookies

Loopcraft uses only strictly necessary cookies: a session cookie that keeps you signed in. We do not use advertising, analytics or cross-site tracking cookies.

8. Data retention

We retain your data for as long as your account is active. Uploaded source files remain in your library until you delete your Loopcraft account or ask us to remove them. Disconnecting a destination immediately deletes its stored OAuth tokens and associated scheduled posts. The self-service “Delete account” control permanently removes your database records, OAuth tokens, uploaded videos and generated preview images immediately, except where retention is required by law.

9. Your rights and choices

Depending on where you live (including under the GDPR and CCPA), you may have the right to access, correct, export, restrict the processing of, or delete your personal data. You can exercise these rights at any time by emailing hernann1501@gmail.com, and we will respond within 30 days. You can also:

• disconnect any connected destination from within Loopcraft, which deletes its tokens; and
• revoke Loopcraft's access from TikTok, Google or Instagram account settings, which immediately invalidates the corresponding tokens.

10. Security

We take reasonable technical and organizational measures to protect your data, including encryption of OAuth tokens at rest (AES-256-GCM), transport encryption (HTTPS/TLS) for all traffic, hashed random session tokens, per-creator data isolation, and access to production systems restricted to the operator of the Service. No method of transmission or storage is 100% secure; if we become aware of a breach affecting your data we will notify you as required by applicable law.

11. International transfers

The Service is operated from infrastructure that may be located outside your country of residence. Where data is transferred internationally, we rely on appropriate safeguards such as standard contractual clauses provided by our infrastructure vendors.

12. Children's privacy

The Service is not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date above. Material changes will be communicated through the Service before they take effect.

14. Contact

For privacy requests, questions or complaints: hernann1501@gmail.com.