LEGAL

Privacy Policy

Effective August 22, 2026

This policy explains how Hidden How processes information when creators connect TikTok or YouTube and transfer a selected video through the platform workflow they choose. Hidden How is operated by HY Trading, represented by Hyeonho Yi.

Information we process

When you connect TikTok, TikTok may provide an app-specific account identifier, display information, granted permissions, OAuth access and refresh tokens, and token expiry information. Hidden How never receives or stores your TikTok password.

We also process essential session identifiers, authorization state, upload-job status, timestamps, limited API responses and errors, and the video file you deliberately select. Our hosting and security provider may process standard technical information such as IP address, device information, request time, and security events.

How information is used

We use this information only to maintain your authorized connection, transfer a selected video to TikTok, display status, protect the service, troubleshoot errors, respond to support requests, and comply with law. We do not sell personal information, run third-party advertising, build advertising profiles, or use uploaded videos to train AI models.

TikTok permissions and creator control

Hidden How uses TikTok's official OAuth authorization. The user.info.basic permission is used only to retrieve and display the connected account's app-specific identifier, display name, and avatar. The video.upload permission is used only after you select a video and explicitly consent to sending it. Hidden How sends a draft to your TikTok inbox; it does not automatically publish to your profile. You complete editing and publication inside TikTok.

To complete the requested transfer, TikTok retrieves the selected file from a short-lived, unguessable URL on Hidden How's verified domain.

YouTube API Services

Hidden How uses YouTube API Services only to upload a video that you select and expressly approve. Hidden How requests only the https://www.googleapis.com/auth/youtube.upload permission and uses it only with YouTube's videos.insert method and resumable upload protocol.

Google handles sign-in and authorization. Hidden How never receives your Google password and does not request access to your email, profile, channel list, analytics, comments, playlists, subscriptions, viewing history, or existing YouTube content.

When YouTube is connected, Google may provide OAuth access and refresh tokens, the granted scope, and token-expiry information. During an upload, Hidden How processes the selected video, file information, title, description, visibility, audience designation, altered or synthetic content disclosure, subscriber-notification choice, upload status, and the limited result returned by YouTube, such as the new video ID and actual visibility.

Hidden How uses this information only for the requested upload, progress and result display, duplicate and abuse prevention, troubleshooting, and security. It does not sell Google user data, use it for advertising or profiling, or use uploaded videos or Google user data to train AI models. Routine human access to uploaded videos or Google user data is not permitted.

Hidden How's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Storage and retention

Hidden How uses Cloudflare infrastructure. Essential session, connection, and job records are stored in D1. OAuth tokens and YouTube resumable upload URLs are encrypted before storage. Selected videos are held temporarily in private R2 storage for the requested transfer.

Stored video files are normally deleted promptly after a transfer reaches a terminal status, is cancelled, or definitively fails. If immediate deletion fails or a workflow is abandoned, the file is marked eligible for cleanup 24 hours after selection and is removed during a subsequent service cleanup run, which may occur later. Upload metadata, job status, and limited upload-result data are likewise scheduled to expire after 24 hours and removed during a subsequent cleanup run. Connection records and encrypted OAuth tokens remain until you disconnect the platform, authorization expires or is revoked, or you delete your Hidden How data. Deleting Hidden How data does not delete a draft or post already transferred to TikTok or a video already created on YouTube.

Sharing

Information is shared only with TikTok or Google and YouTube to perform the transfer you choose, Cloudflare to host and secure the service, and authorities when legally required. Hidden How is independent and is not owned, operated, or endorsed by TikTok, Google, or YouTube.

Security and your choices

We use HTTPS, server-side secrets, encrypted OAuth tokens, private object storage, short-lived authorization state, essential secure cookies, ownership checks, and limited retention. You can disconnect either platform or request deletion at any time. You can also revoke Google access through Google Account Security Permissions. Google's handling of information is described in the Google Privacy Policy.

Children and international processing

The service is not directed to anyone below TikTok's minimum age or the applicable age of digital consent. Service providers may process information in other countries subject to appropriate protections.

Changes and contact

We may update this policy as the service or legal requirements change. The current version and effective date will remain posted here. The data-service contact is HY Trading, attention Hyeonho Yi. For privacy questions or requests, email ho.yi1114@gmail.com with the subject “Hidden How Privacy Request”.