1. Scope and current status
This policy covers the Clip Operations dashboard operated under the HypeCircuit product name. The service is currently a public sandbox/control-plane prototype with no production social posting connection.
The application does not run product analytics or advertising trackers, query Twitch or Kick directories, follow platform accounts, poll livestreams, subscribe to source webhooks, record or download creator media, run inference against creator streams, or send media to a social platform. Shown clip media, scores, captions, creators, and delivery history are fixtures or provisional demonstration data.
A separate controlled TikTok Sandbox path may allow an allowlisted operator to authorize an operator-owned target account using user.info.basic. Its current connection availability is reported by the dashboard; no posting or media scope is requested. Hosting and workspace-authentication providers may process technical request information needed to deliver and secure the site under their own terms.
2. Source and approval records
The control plane may store a typed platform handle, display label, source type, local follow/pause/mute state, authorization and agreement status, disabled future monitor state, aggregate candidate signals, safety/rights results, destination scope, operator decision, feedback reason, timestamp, and credential-free audit event. A typed handle is not externally verified and is not treated as consent.
Current candidate signals are seeded fixtures, not observations from real streams. Before real source processing, this policy and the product notice must describe the exact connector, permitted event/media data, processors, storage, retention, deletion, and creator-revocation behavior.
3. TikTok Sandbox information
After an operator completes Sandbox authorization, the service uses only information necessary to maintain and verify that connection:
- authorization data: access and refresh tokens, token expiry, and exact granted scope;
- basic TikTok identity: app-specific Open ID, display name, and avatar URL available through
user.info.basic; - security metadata: operator identifier, hashed one-time OAuth state, verification timestamps, and non-secret outcomes; and
- revocation state: whether remote revocation was confirmed or manual revocation is required.
Tokens are stored only as AES-GCM ciphertext in the managed server database. The encryption key, client secret, operator allowlist, and plaintext tokens are excluded from client code and the database. Unexpected scope causes rejection rather than retention.
4. Why information is used
Control-plane records support rights verification, source-state management, transparent ranking, safety review, human decisions, future calibration analysis, and auditability. TikTok Sandbox data is used only to verify and maintain the intended test-account connection and honor disconnect or revocation.
The service is not designed to sell personal information, build advertising profiles, target minors, or inspect the TikTok account’s videos.
5. No content posting
The current TikTok authorization requests only user.info.basic. It does not request video.upload, video.publish, video-list, or any media scope. The application cannot upload a draft, Direct Post, publish publicly, list account videos, or ingest creator streams.
Any future scope expansion requires an explicit product decision, updated notice and consent, platform approval, and a new review of creator-rights, content-safety, destination, revocation, and final human-approval controls.
6. Storage and security principles
Client secrets and account tokens remain server-side, encrypted at rest, excluded from browser storage, screenshots, logs, analytics, and support messages, and accessible only to the authorization service. Hosted secrets hold encryption material and the operator allowlist; the managed database contains ciphertext and minimum connection metadata.
The service applies secure one-time OAuth state, exact least-privilege scope checks, account-identity verification, authenticated mutation headers, token refresh controls, and credential-free audit events. No security measure eliminates all risk; key rotation and incident procedures must be maintained before broader use.
7. Retention and deletion
Sandbox tokens are kept only while the test connection remains active and necessary. Disconnect deletes the local encrypted record and requests TikTok revocation. If remote revocation cannot be confirmed, the dashboard requires manual revocation.
OAuth state expires after ten minutes. Local watch/source records remain until an operator unfollows or deletes them; production retention periods must be finalized before real source activation. Credential-free events may be retained only as needed for security, rights, approval, and revocation evidence. The prototype has no source-media database.
8. Sharing and service providers
Information would be shared only with providers needed to host, secure, process, or deliver an approved workflow. Providers should receive only the data needed for their task and be subject to appropriate contractual and security controls. The operator must publish its finalized provider list and cross-border processing information before production launch.
9. Choices, access, and revocation
TikTok users may decline or revoke authorization through TikTok. Creators may exercise revocation rights under their agreement. The operator must provide a verified method to request access, correction, deletion, or restriction where applicable and must authenticate requests before disclosing information.
10. Children
The service is not intended for children and must not target minors with gambling or other age-restricted content. If information is collected contrary to applicable age requirements, processing must stop and the information must be deleted as required.
11. Changes and contact
This policy must be updated before production activation to identify the operator, jurisdiction-specific rights, finalized retention periods, service providers, and a public privacy contact. Material changes should be dated and communicated appropriately.
A dedicated public privacy address has not yet been published. During the prototype stage, contact the person or workspace channel that provided access. Do not include passwords, client secrets, access tokens, or unredacted creator agreements in an initial request.