// LEGAL

Privacy Policy

Last updated: June 12, 2026

1. Who We Are

This Privacy Policy describes how Khuê Trần (the "Provider", "we", "us"), based in the Socialist Republic of Vietnam, handles personal data processed by khuetran.com (the "Site") and the tools published under this domain, including the KTB Post content publishing tool ("Service").

Contact for data protection matters: [email protected].

2. Scope

KTB Post is a content publishing tool that enables creators ("Creators", "Users") to upload and publish video content to their TikTok accounts via the official Content Posting API. The Service is distributed as a CLI that each Creator runs on their own machine, authenticating their own TikTok account through TikTok's authorization dialog.

Because the Service runs locally on each Creator's machine, the Provider does not operate a centralized server that aggregates Creator data. The personal data processed by the Service belongs to the authenticated Creator and stays on their own device, except where explicitly transmitted to TikTok via the official API (which is, in fact, the entire purpose of the Service).

3. Data We Collect

3.1 Data from TikTok

When the Creator authenticates the Service with TikTok via OAuth 2.0, TikTok returns the following data for the authenticated account only:

3.2 Data the Creator Provides

• Video files (MP4) selected from the Creator's local machine for upload.
• Captions, hashtags, and post metadata entered by the Creator.

3.3 Site Analytics

The Site itself is a static showcase site. It does not use cookies, advertising trackers, or third-party analytics SDKs. Standard web-server access logs (IP address, user agent, timestamp) may be retained by the hosting provider for up to 30 days for security and abuse prevention only.

4. How We Use Data

Personal data is processed strictly for the following purposes:

• Authenticating the Creator's TikTok account through TikTok's official APIs.
• Publishing video content to the authenticated TikTok account at the Creator's request.
• Displaying account information (name, avatar) in the local tool interface.
• Diagnosing errors and improving the Service for the Creator's own workflow.
• Complying with applicable Vietnamese law and TikTok's developer policies.

We do not sell, rent, or share personal data with third parties for advertising or marketing purposes. We do not use TikTok data to build profiles of other users.

5. Data Storage and Retention

• TikTok tokens (access_token, refresh_token) are stored only on the Creator's local machine in an encrypted-at-rest configuration file. They are never transmitted to or stored on any third-party server controlled by the Provider.
• Video files and metadata are stored locally on the Creator's machine. They are not uploaded to any storage provider other than TikTok itself.
• Publish history (publish_id, timestamp, status) is retained locally for as long as the Creator finds it useful, and may be deleted at any time.
• Sandbox tester data (if any) is deleted within 7 days of the tester being removed from the sandbox, or upon written request.

6. Data Sharing

The Creator shares personal data only with:

• TikTok Pte. Ltd. — to enable the integration itself. See TikTok's Privacy Policy.
• Competent Vietnamese authorities — when legally compelled under Vietnamese law, including but not limited to the Cybersecurity Law No. 24/2018/QH14 and Decree No. 13/2023/ND-CP.

7. TikTok Integration Disclosures

This section provides explicit disclosure of how the Service integrates with TikTok and handles TikTok-originated data, as required by the TikTok Developer Terms of Service.

7.1 OAuth scopes requested

The Service requests only the three scopes strictly required for its single workflow:

• user.info.basic — identifies the authenticated TikTok account (open_id, display_name, avatar_url).
• video.upload — uploads MP4 binary to the TikTok Content Posting API.
• video.publish — publishes the uploaded video directly to the authenticated account's feed (Direct Post).

No analytics scopes (video.list, user.info.profile, user.info.stats), Share Kit scopes, or commercial-content scopes are requested.

7.2 Token lifecycle

• OAuth access tokens are stored on the Creator's local machine only, in a permission-restricted file under the user's home directory.
• Tokens are never transmitted to any third-party server controlled by the Provider.
• Refresh tokens are used exclusively to renew expired access tokens; they are deleted upon revocation.
• The Creator may revoke the integration at any time from the TikTok security settings, which immediately invalidates the stored tokens.

7.3 Content posted to TikTok

Video content uploaded via this integration is owned by the Creator. The Service does not access, store, or share content that already exists on the Creator's TikTok account. All publish actions require explicit operator intent (the operator selects the file and runs the CLI command).

7.4 Compliance and prohibited use

The Service complies with, and the Creator agrees not to use the Service to violate, the following TikTok policies:

• TikTok Developer Terms of Service
• TikTok Community Guidelines
• TikTok Content Sharing Guidelines
• Login Kit best practices

7.5 No affiliation with TikTok

The Service is an independent personal tool built by Khuê Trần. It is not affiliated with, endorsed by, or sponsored by TikTok Pte. Ltd. or any of its subsidiaries. References to "TikTok" in this policy and the Service are solely to identify the platform being integrated.

8. Your Rights

In accordance with Decree No. 13/2023/ND-CP on the protection of personal data, data subjects (the Creator using the Service and any authorized sandbox testers) have the right to:

• Be informed about the processing of their personal data.
• Access, correct, or update their personal data.
• Withdraw consent and request deletion of their personal data.
• Object to processing or request restriction of processing.
• File a complaint with the competent Vietnamese authority.

To exercise these rights, email [email protected]. Requests will be addressed within 72 hours where feasible, and no later than the timeframes mandated by Vietnamese law.

9. Security

The Provider applies reasonable technical and organizational measures to protect personal data, including OS-level disk encryption recommendations for the Creator's machine, scoped OAuth tokens, HTTPS-only API traffic, and least-privilege access scopes (only the TikTok scopes strictly required for the workflow are requested). However, no system is 100% secure; data subjects acknowledge this residual risk.

10. Children's Privacy

The Service is not intended for children under 18. The Provider does not knowingly collect personal data from minors. If you believe a minor's data has been collected, contact us for immediate deletion.

11. International Data Transfers

When the Creator authenticates with TikTok, personal data may be processed by TikTok in jurisdictions outside Vietnam (e.g., Singapore, United States, Ireland) under TikTok's own safeguards. The Creator does not perform any other cross-border transfer of personal data.

12. Compliance with Vietnamese Law

Any conflict between this Privacy Policy and mandatory provisions of Vietnamese law shall be resolved in favor of Vietnamese law.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date reflects the latest revision. Material changes will be communicated through the Site.

14. Contact

For privacy questions, data subject requests, or any concerns related to personal data, please contact:

Khuê Trần
Email: [email protected]
Jurisdiction: Socialist Republic of Vietnam