Privacy

When you register we store your name, email address and password. The password only ever exists as a cryptographic hash held by our authentication provider — in plain text it is available to nobody, including us.

The legal basis is performance of the contract (Art. 6(1)(b) GDPR). Without this data there is no account.

We store what you create in the app: your brand profile (audience, offer, problem, proof, tone, goal, things to avoid), topics and slide texts, captions, the background images you upload, and the schedule and status of your posts.

Finished carousel images are cached so the same carousel does not have to be rendered again on every download.

If you connect a TikTok account we store the TikTok id (open_id), the display name, the avatar and the access and refresh tokens. Without those tokens we could not post on your behalf.

The tokens are specially protected: they live in a table the browser has no access to at all — they are readable only on the server. You can disconnect at any time under Settings, which deletes them.

What we do not do: read other people’s profiles, collect reach data from accounts that have not connected, or scrape TikTok.

The app gets by with four processors. Each does exactly one job:

• Supabase — accounts, database and storage for your images.
• Vercel — running the application. The servers are currently in the United States; the transfer relies on the European Commission’s Standard Contractual Clauses.
• Groq — generates the text suggestions. It receives your topic and brand profile, not your name or email address.
• TikTok — receives only what you deliberately post: your carousel images, the caption, and the privacy level you chose.

There are no ad networks, no analytics tracking and no sharing for advertising purposes.

Some of the text in this app is written by a language model: the suggestions for slides and captions, and the conversation when you set up your brand. At those points you are knowingly interacting with an AI (Art. 50(1) of Regulation (EU) 2024/1689).

No AI paints the images. They are drawn from templates — the same input produces the same pixels every time. Only the text inside them may come from a model.

Every generated image carries a machine-readable provenance marker in its metadata (IPTC DigitalSourceType). If the text came from a model it reads compositeWithTrainedAlgorithmicMedia; if it came from our own text builder it reads algorithmicMedia. This satisfies the marking duty in Art. 50(2) and stays with the file when you download it.

You see and can edit every text before anything is published. Nothing decides anything about you automatically — there is no automated decision-making within the meaning of Art. 22 GDPR.

Two strictly necessary cookies: one keeps you signed in, the other secures the TikTok connection flow against abuse and expires straight after. The app sets no tracking or advertising cookies — which is why there is no cookie banner.

Your data stays as long as your account exists. Delete your account and the account, brand, posts and images go with it. Individual images and templates you can remove yourself at any time.

Posts already published on TikTok live at TikTok — only you can delete those, there.

You have the right to access, rectification, erasure, restriction, data portability and objection. An informal message to the address below is enough.

You can also lodge a complaint with the supervisory authority — the competent one is the Austrian Data Protection Authority.