Privacy Policy

Last updated: October 23, 2026

1. Overview

Ningverse Shorts ("the Service") respects your privacy. This policy explains what data the Service collects, how it is used, and how it is protected.

2. Data We Collect

The Service collects the following types of data when you connect your social media accounts:

• OAuth Authorization Data: When you connect a platform account (e.g., TikTok, YouTube, Instagram), the platform issues an authorization code that we exchange for access tokens.
• Access and Refresh Tokens: These tokens allow the Service to publish videos to your connected accounts on your behalf.
• Account Identifiers: The Service stores your platform-specific user ID (e.g., TikTok Open ID) to verify the correct account connection.
• Granted Scopes: The Service records which permissions you granted (e.g., video.publish, user.info.basic) for audit purposes.

3. How Data Is Stored

All tokens and credentials are stored using Windows DPAPI (Data Protection API) with CurrentUser scope encryption on the local machine. This means:

• Tokens are encrypted and can only be decrypted by the same Windows user on the same machine
• No tokens are stored in plain text, in databases, or on external servers
• Tokens are never logged, printed, or transmitted to third parties

4. How Data Is Used

• Publishing: Access tokens are used solely to publish approved videos to your connected accounts
• Account Verification: User IDs are used to confirm the correct account is connected
• Token Refresh: Refresh tokens are used to maintain access without requiring you to re-authenticate daily

5. Data We Do NOT Collect

• We do not collect or store your platform passwords
• We do not collect personal information beyond what is needed for publishing
• We do not sell, rent, or share your data with third parties
• We do not use your data for advertising or tracking

6. TikTok-Specific Data Handling

When you connect your TikTok account via OAuth:

• We request only the scopes necessary for video publishing (video.upload, video.publish) and basic account info (user.info.basic)
• Your TikTok access token expires after 24 hours; we use the refresh token (valid for 365 days) to renew it
• We store your TikTok Open ID to verify account identity
• You can revoke access at any time from your TikTok privacy settings
• When access is revoked, we delete all stored tokens

7. Data Retention and Deletion

• Access tokens are retained until they expire (24 hours) or until you revoke access
• Refresh tokens are retained until they expire (365 days) or until you revoke access
• You may request deletion of all stored credentials at any time
• When tokens are deleted, they are permanently removed from local encrypted storage

8. Security Measures

• DPAPI encryption for all stored credentials (same-level protection as Windows user credentials)
• Token values are never logged, printed, or included in error messages
• OAuth state parameter verification prevents CSRF attacks
• All API communication uses HTTPS
• Local loopback only for OAuth redirect handling (no external servers)

9. Your Rights

• Right to know what data is collected and how it is used
• Right to revoke access at any time
• Right to request deletion of all stored credentials
• Right to disconnect your account at any time

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date.

11. Contact

For privacy-related questions, please visit our contact page.