Effective date: August 30, 2026

Privacy Policy

This Privacy Policy explains how HuyiKuai handles personal information when creators use its website, TikTok Login Kit connection, and Content Posting API Direct Post workflow.

Operator and contact

HuyiKuai is operated by HU Junjie, an individual operator based in China (the "Operator," "HuyiKuai," "we," or "us"). The Operator is responsible for the personal information described in this policy. Privacy questions and requests may be sent to H1429311366@outlook.com.

Service availability

HuyiKuai is intended only for creators located in countries and regions where TikTok is lawfully available. It is not offered to users in mainland China or any other jurisdiction where TikTok is unavailable or prohibited.

Information we process

• Website login: your chosen username, a salted password hash, session records, and limited security counters. Passwords are processed over HTTPS by our API and password verification service; plaintext passwords are not saved in our database.
• TikTok authorization information: the authorization code used for token exchange, TikTok open identifier, approved scopes, access token, and connection status.
• Upload information: creator-selected videos, filenames, sizes, temporary media URLs, publish identifiers and publishing status.
• Workspace information: the owner identity, connected accounts, saved draft titles and scripts, posting settings, and scheduled tasks.
• Technical information: IP address, browser and device information, request time, and security or error logs that may be processed by our hosting provider when the website is accessed.
• Support information: the email address and message content a person voluntarily sends to our support address.

Video handling

A video chosen by the creator is uploaded to HuyiKuai's secured temporary storage so it can be published immediately or at the creator-selected time. After the creator reviews the caption, privacy, interaction and disclosure settings and explicitly confirms posting, HuyiKuai transfers the video to TikTok through the Content Posting API Direct Post PULL_FROM_URL workflow. TikTok retrieves the file using an unguessable temporary media URL; anyone holding that URL can retrieve the file while it remains available. Temporary video files are automatically deleted under the retention periods described below.

How and why we use information

We process the information above only to:

• connect the TikTok account selected by the creator;
• save creator-authored scripts and captions within their workspace;
• perform the creator-requested immediate or scheduled Direct Post;
• maintain session security, diagnose errors, and prevent abuse;
• respond to support, privacy, and deletion requests; and
• comply with applicable legal obligations.

Depending on applicable law, these activities are based on performing the service requested by the user, the user's authorization or consent, legitimate interests in securing the service, and legal obligations.

TikTok permissions

The user.info.basic scope is used to identify the connected creator account. The video.publish scope is used to publish only after the creator selects a local video, reviews the posting settings and explicitly confirms the action. Although video.upload is included with the Content Posting API product, HuyiKuai does not request it during OAuth or use the draft-upload workflow. HuyiKuai does not sell TikTok data, use it for advertising, scrape TikTok, or use it for an unrelated purpose.

Cookies and local browser storage

HuyiKuai stores its workspace session credential in browser local storage and may also set a Secure, HttpOnly session cookie. Server sessions expire after 7 days for website logins (30 days for legacy TikTok logins), and the current session is revoked when you sign out. Changing your website password revokes all website sessions. TikTok access and refresh tokens are encrypted on the server, not stored in browser local storage. Temporary OAuth state, a verifier, and return-flow information are held in session storage. Server authorization challenges expire after ten minutes. The selected interface language is stored locally. HuyiKuai does not use advertising or cross-site tracking cookies.

Disclosure and service providers

We do not sell personal information. Information may be disclosed only to TikTok to provide the requested TikTok feature, to Vercel as the website hosting provider, to Cloudflare for API hosting, database and temporary video storage, to professional advisers where necessary, or to authorities when required by applicable law.

International processing

The Operator, TikTok, Vercel, Cloudflare, and their infrastructure may be located in different countries. Information may therefore be processed outside the user's country. Where required, we rely on applicable contractual, consent-based, or other lawful transfer mechanisms.

Retention

• Website sessions expire after 7 days; legacy sessions expire after 30 days. Expired sessions and short-lived login rate-limit counters are periodically removed. Browser local storage remains until cleared by sign-out, the application, or the user, but an expired server session cannot be used.
• OAuth state in session storage normally lasts only for the browser session.
• Saved drafts remain until you delete them or request workspace data deletion.
• Unused video uploads are scheduled for deletion after 30 days. Files referenced by scheduled or processing posts remain available until those tasks are resolved.
• After successful publication, temporary video files are scheduled for automatic deletion after 7 days. Cleanup runs periodically and may be delayed by service interruptions.
• Support emails may be retained for up to 12 months after resolution.
• Security and request logs are retained only as long as reasonably needed for security, troubleshooting, and hosting operations, subject to the hosting provider's controls.

Information may be retained longer only when necessary to comply with law, resolve a dispute, or investigate abuse.

Security

We use HTTPS, restricted server-side handling of TikTok credentials, encryption of server-held TikTok tokens, workspace access controls, and expiring server sessions. No internet service can guarantee absolute security. Users must not send us passwords, payment card details, or one-time verification codes in support messages. Enter your website password only in our sign-in, registration, or password-change forms. We never request your TikTok password.

Your choices and rights

Subject to applicable law, users may request access, correction, deletion, restriction, or a copy of their personal information, and may object to or withdraw consent for certain processing. TikTok authorization can be revoked through TikTok account settings. Requests can be made using the contact email above, and we may verify the requester's identity before responding. See also our Data Deletion Instructions.

Children

HuyiKuai is intended for adults and is not directed to anyone under 18. If we learn that we processed a child's personal information, we will take reasonable steps to delete it.

Changes to this policy

We may update this policy when the service or legal requirements change. The revised policy will be posted here with a new effective date. Where required by law, additional notice or consent will be provided.

Contact

Operator: HU Junjie (individual), China
Email: H1429311366@outlook.com