MYSTORIALegal
Privacy policy
Effective September 24, 2026
The short version. MYSTORIA Publisher uses your TikTok information only to publish the videos you approve to your own account. Tokens are encrypted. Uploaded videos are deleted soon after posting. We don't sell data, show ads, use tracking cookies, or train AI on your information. You can delete everything from Settings.
Scope
This policy covers the MYSTORIA website (mystoria.io) and MYSTORIA Publisher, a tool that lets creators prepare, approve and publish their own finished videos to their own TikTok accounts. It also covers the tools MYSTORIA uses to publish and report on its own YouTube, Instagram and X accounts.
What we collect
When you sign in with TikTok, we receive what you approve on TikTok's consent screen:
- Your TikTok account identifier for this app (open_id), display name and profile image (the
user.info.basicpermission). We store these to recognize your account when you sign in and to show you which account you're posting to. - Access and refresh tokens (the
video.publishpermission). We store these, encrypted, so MYSTORIA Publisher can send the posts you approve at the times you chose, including when you're not signed in.
When you post, we ask TikTok for your current posting options: your nickname and username, the privacy levels available to you, whether comments, Duet and Stitch are allowed, and the longest video you can post. We use them to show you the right choices and to check a post right before it's sent. We don't store them, apart from the settings you chose for each post.
What you give us to publish: the video files you upload, your captions, the privacy, interaction, disclosure and AI-label settings you choose, and the times you pick. We store them to send each post exactly as you approved it. We also keep an approval log (when you approved each post and with which settings) so you and we can see what was authorized. If you create a key for your own tools, we store only a one-way hash of it, so we can recognize the key without keeping it.
If you contact us, we store your message, the topic, any reply address you choose to give, and a salted one-way hash of your IP address used only to limit abuse of the form.
We don't request access to your followers, messages, analytics, other videos or anything else on TikTok.
How we use it
Only to provide the service you ask for: to show you which account you're posting to, to publish or send your approved videos to TikTok at the times you chose, to show you each post's status, to keep a record of your approvals, and to answer your messages. We don't use your information for advertising, we don't sell it, and we don't use it to train AI models.
How long we keep it
- Uploaded videos are deleted automatically within 24 hours after TikTok finishes processing the post, or after the post fails or is cancelled.
- Drafts you never approve are deleted, video included, 30 days after upload. Uploads that were never used in a post are deleted after 7 days.
- TikTok tokens are kept while you're connected. They're deleted when you disconnect, and also when TikTok tells us you've removed MYSTORIA Publisher's access.
- Post records and approval history are kept until you delete your data, so you can see what was posted and when.
- Sign-in sessions expire after 30 days.
- Support messages are kept for up to 12 months, and are deleted sooner if you delete your data while signed in.
Security
TikTok tokens are encrypted at rest with AES-256-GCM, using a key kept separate from the database. Keys for your own tools are stored only as hashes. Video links we create are private, signed and expire. All traffic uses HTTPS.
Who else processes it
- TikTok receives the videos, captions and settings you approve for publishing, under TikTok's privacy policy.
- Cloudflare hosts this website and stores MYSTORIA Publisher's data (database and video storage).
- For MYSTORIA's own channels, Google (YouTube), Meta (Instagram) and X process the content MYSTORIA publishes there. AI services may help MYSTORIA prepare its own content. They aren't given MYSTORIA Publisher users' information.
Use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
We'll disclose information if the law requires it. Otherwise we don't share it.
Cookies
MYSTORIA Publisher uses a sign-in cookie and short-lived cookies that protect the TikTok sign-in step. There are no advertising or analytics cookies or scripts on this site. Cloudflare, our host, may process ordinary web-request information under its own privacy policy.
Your choices
- Delete everything: in MYSTORIA Publisher, Settings, then "Disconnect and delete my data". See Data deletion.
- Ask us to delete it: if you can't sign in, email support@mystoria.io or use the contact form with your TikTok @username, and we'll delete your records.
- Remove access from TikTok: you can also remove MYSTORIA Publisher in the TikTok app's settings.
- Posts already on TikTok stay there until you delete them in TikTok.
Children
MYSTORIA Publisher isn't directed at children, and it relies on TikTok's own age requirements for accounts.
Changes
We'll update this page if these practices change, and change the date at the top.
Contact
Email support@mystoria.io, or use the contact form and choose "My data or privacy". This is also the route for deletion requests if you can't sign in.