LEGAL
Privacy Policy
Effective August 22, 2026
This policy explains how Hidden How processes information when creators connect TikTok and transfer a selected video to their TikTok inbox as a draft. Hidden How is operated by HY Trading, represented by Hyeonho Yi.
Information we process
When you connect TikTok, TikTok may provide an app-specific account identifier, display information, granted permissions, OAuth access and refresh tokens, and token expiry information. Hidden How never receives or stores your TikTok password.
We also process essential session identifiers, authorization state, upload-job status, timestamps, limited API responses and errors, and the video file you deliberately select. Our hosting and security provider may process standard technical information such as IP address, device information, request time, and security events.
How information is used
We use this information only to maintain your authorized connection, transfer a selected video to TikTok, display status, protect the service, troubleshoot errors, respond to support requests, and comply with law. We do not sell personal information, run third-party advertising, build advertising profiles, or use uploaded videos to train AI models.
TikTok permissions and creator control
Hidden How uses TikTok's official OAuth authorization. The user.info.basic permission is used only to retrieve and display the connected account's app-specific identifier, display name, and avatar. The video.upload permission is used only after you select a video and explicitly consent to sending it. Hidden How sends a draft to your TikTok inbox; it does not automatically publish to your profile. You complete editing and publication inside TikTok.
To complete the requested transfer, TikTok retrieves the selected file from a short-lived, unguessable URL on Hidden How's verified domain.
Storage and retention
Hidden How uses Cloudflare infrastructure. Essential session, connection, and job records are stored in D1. OAuth tokens are encrypted before storage. Selected videos are held temporarily in private R2 storage for the requested transfer.
Media retrieval access expires within 24 hours and is normally limited to two hours after transfer begins. Stored video files may be deleted earlier when delivery or failure is confirmed; otherwise they become eligible for expiry cleanup after expiration. Upload-job records are retained for up to 24 hours to enforce transfer limits and support status handling. Connection records and encrypted OAuth tokens remain until you disconnect TikTok or delete your Hidden How data. Deleting Hidden How data does not delete a draft or post already transferred to TikTok.
Sharing
Information is shared only with TikTok to perform the transfer, Cloudflare to host and secure the service, and authorities when legally required. Hidden How is independent and is not owned, operated, or endorsed by TikTok.
Security and your choices
We use HTTPS, server-side secrets, encrypted OAuth tokens, private object storage, short-lived authorization state, essential secure cookies, ownership checks, and limited retention. You can disconnect TikTok, revoke Hidden How in TikTok settings, or request deletion at any time.
Children and international processing
The service is not directed to anyone below TikTok's minimum age or the applicable age of digital consent. Service providers may process information in other countries subject to appropriate protections.
Changes and contact
We may update this policy as the service or legal requirements change. The current version and effective date will remain posted here. The data-service contact is HY Trading, attention Hyeonho Yi. For privacy questions or requests, email ho.yi1114@gmail.com with the subject “Hidden How Privacy Request”.