Privacy Policy
Last updated: 23 September 2026
This policy explains what Shadarc (https://shadarc.com) collects and why. It is meant to be read with our Terms of Service.
1. What we collect
- Account: email, name, authentication data, and workspace settings. If you continue with Google, Google sends us the email and name on that Google account. If you request a password reset, we email a one-time link from [email protected].
- Product data: automations, Templates you save as configurations, media you upload, collections, schedules, and run/publish history.
- TikTok connection data: OAuth tokens (stored encrypted), TikTok
open_id, display name, avatar URL, and, if you use analytics, public stats and video lists TikTok returns for that account. - Product analytics: when enabled, PostHog receives an internal account identifier, normalized page paths, campaign labels, device/browser information, and events such as successful generation, publishing outcomes, and subscription changes. We use local browser storage to connect visits. We do not include OAuth tokens, prompts, slide copy, uploaded image URLs, or payment details in these events. Optional session replay masks input values and rendered text and blocks media.
- Technical: server logs needed to run and debug the app (method, path, status, request/job ids). We do not log request bodies, tokens, or slide copy.
We do not use TikTok Login as Shadarc’s own sign-in. Email/password and Google sign-in are separate from connecting a TikTok publishing destination.
2. How we use it
- to operate your account and the editor, scheduler, and media library;
- to connect TikTok accounts you choose and to send photo slideshows you asked us to send;
- to show you analytics for connected accounts;
- to understand product usage, improve activation, and measure reliability;
- to secure the service and fix bugs.
We do not sell personal data. We do not use your TikTok tokens or media to train a public model.
3. TikTok
Publishing uses TikTok’s APIs. When you publish, TikTok receives the media you choose to publish, along with captions, privacy settings, and other publishing options you configure. TikTok’s own terms and privacy policy apply to its processing of that data.
Scopes we request: user.info.basic, user.info.profile, user.info.stats, video.list, video.upload, video.publish.
You can revoke access in Shadarc (Settings → Connections) or through TikTok’s connected-app settings.
4. Processors
We use infrastructure vendors to host the app, database, object storage, and (when you generate copy) an AI provider. If you continue with Google, Google authenticates you. Resend sends password-reset and optional verification emails. They process data only to provide those functions.
PostHog processes product analytics in its EU cloud project. Optional masked session replay helps us investigate usability problems.
5. Retention
We keep account and product data while the account is open. TikTok tokens are kept until you disconnect or they expire. Server logs are kept only as long as needed to operate the service. You can ask us to delete your account; we will delete or anonymize personal data unless we must keep a record (for example a legal claim). Posts already on TikTok are not deleted by us.
6. Your rights
Depending on applicable law, you may have rights to access, correct, or delete personal data we hold about you. You may also disconnect TikTok at any time.
To exercise your rights, email [email protected].
7. Children
Shadarc is not directed at children under 18. We do not knowingly collect their data.
8. Changes
We will post updates at /privacy. Material changes take effect when posted, or later if we say so.