Privacy Policy
IPSuccess API is operated by one person, against that person's own accounts. This policy states exactly what the application receives from each platform, what it does with it, where it is kept, and how to cut off its access.
1. Who this policy is for
The application has a single operator: the owner of the “In Pursuit of Success” channel. There is no public sign-up, no user registration, and no mechanism by which a third party can connect an account. If you are reading this as a reviewer or as a visitor, you are not a user of this application, and it holds no data about you.
2. Data received from TikTok
When the operator authorizes the application through TikTok Login Kit, TikTok returns:
- the authenticated account's open ID (its identifier);
- the account's display name;
- an access token, and the refresh token that renews it.
That is the complete list. No other field of the account is read. No data belonging to any other TikTok user is accessed at any point: the application never reads comments, followers, audience statistics, direct messages, or other creators' content.
Purpose. The identifier and display name confirm which account granted access, so the operator can see they are publishing to the right channel. The token authorizes uploading the operator's own videos to that same account, through the Content Posting API.
3. Data received from YouTube
When the operator authorizes the application through Google, it requests two scopes:
youtube.upload, to upload videos to the authorized channel, and
youtube.force-ssl, to set the thumbnail, captions and metadata of those uploads.
Google returns an access token and a refresh token for that channel.
The application does not read comments, subscribers, audience statistics, watch history, or any data belonging to other YouTube users or channels. It does not download videos from the platform.
This integration uses YouTube API Services. By authorizing it, the operator is also bound by the YouTube Terms of Service and the Google Privacy Policy. Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4. Where the data is stored
Tokens are JSON files on the operator's own machine, in the project directory. They are not uploaded to a server, not written to a database, and not transmitted to any third party. This application has no backend that stores user data, because it has no users other than the operator.
| File | Contents |
|---|---|
.google-oauth.json | Google Cloud client credential, downloaded by the operator |
.google-oauth-token.json | YouTube access and refresh token |
.tiktok-oauth-token.json | TikTok access and refresh token |
.env | TikTok client key and secret |
All four are listed in .gitignore and are never committed to the repository. The
Google token file is written with mode 600 on filesystems that honour it, so it is
readable only by the operator's own account.
How each token is obtained. For YouTube, the tool starts a temporary server on
127.0.0.1 and Google redirects the authorization code there, using PKCE (S256) — the
code cannot be exchanged by anyone who intercepts it. For TikTok, which requires an HTTPS
redirect for Web applications, the callback page displays the code and the operator pastes it
into the terminal; the exchange then happens on the local machine, directly against
open.tiktokapis.com. The callback page never receives a token, never calls the
TikTok API, and stores nothing.
Video files and their metadata travel from the operator's machine directly to the platform's API. They do not pass through an intermediate service under our control.
5. What is never done
- Platform data is never sold, rented, or shared with third parties.
- It is never used for advertising, ad targeting, or audience profiling.
- It is never used to train machine learning models.
- It is never combined with data from other sources to build a profile of anyone.
- It is never read by anyone other than the operator.
6. Retention and revocation
A token is kept only while it is valid. It is discarded when it expires, when it is replaced by a renewed token, or when authorization is revoked. Deleting the local token file removes the application's stored credentials entirely.
Authorization can be withdrawn at any time, by the account owner, without contacting us:
- TikTok — in the account's settings, under the list of connected apps.
- YouTube / Google — at myaccount.google.com/permissions.
Once revoked, the application's access ends immediately and its stored tokens stop working.
7. Cookies and analytics
This website does not set cookies, does not run analytics, and does not embed third-party trackers. The application itself is not a website and has no web interface that visitors can reach.
8. Children
The application is not directed at children and is not usable by anyone other than its single operator, who is an adult.
9. Changes
If this policy changes, the date at the top of this page changes with it. Changes that affect what platform data the application touches are published here before taking effect.
10. Contact
Questions about this policy, about the data the application accesses, or requests related to it: contato@rankiumsystems.com.br.
The application is built and operated by Rankium Systems, Brazil. For the privacy policy covering Rankium Systems' own website and business contacts, see rankiumsystems.com.br/privacidade.