TikTok integration

Every TikTok product and scope MyPostiz requests, what each one is used for inside the application, and what the application deliberately cannot do.

MyPostiz connects to TikTok only through TikTok's official developer products. It does not automate the TikTok website or mobile app, does not use unofficial endpoints, and does not scrape any TikTok page. The account it connects to is a TikTok account owned by the operator of the application, connected by the operator through TikTok's own authorisation screen.

Products we use

Login Kit	Lets the operator authorise their own TikTok account through TikTok's authorisation screen, so that MyPostiz receives an access token instead of ever handling a TikTok password.
Content Posting API (Direct Post)	Uploads the video or photo the operator prepared and publishes it to that same account at the scheduled time, together with the caption and the post settings the operator chose.

Scopes we request, and why

MyPostiz requests six scopes. Each one is used by a specific screen or step in the product:

Scope	Where it is used in MyPostiz
`user.info.basic`	Read the open ID, display name and avatar of the account the operator just authorised, so the connected channel can be shown in the channel list. Without it the operator cannot tell which account a scheduled post is about to go to.
`user.info.profile`	Read the profile details of that same account (username / handle and profile link) so the channel is labelled with the real @handle rather than an internal identifier.
`user.info.stats`	Read the follower, following, likes and video counts of the operator's own account and show them on the channel preview screen, so the operator can confirm the correct account is connected and see the effect of publishing.
`video.upload`	Send the media file the operator attached to the post to TikTok's servers when the scheduled time arrives. This is the upload half of publishing.
`video.publish`	Publish that uploaded media as a post on the operator's own account (Direct Post), applying the caption and the post settings the operator selected before scheduling.
`video.list`	Read back the list of posts on the operator's own account after publishing, so MyPostiz can confirm the post really exists and mark the scheduled item as published rather than failed.

All six scopes apply only to the account that the operator authorised. MyPostiz has no feature that reads another creator's profile, statistics or videos, and no feature that publishes to an account the operator has not personally connected.

What the publishing flow looks like

Connect. The operator opens the dashboard, chooses “Add channel → TikTok”, and is redirected to TikTok's authorisation screen. After approving, TikTok returns an access token to MyPostiz. The connected account then appears in the channel list with its avatar, display name and handle.
Compose. The operator writes the caption, attaches the video or photos, and selects the TikTok post settings that MyPostiz passes on to the Content Posting API — who can view the post, and whether comment, duet and stitch are allowed. Any commercial-content declaration required by TikTok is made here as well.
Schedule. The operator picks a date and time. The post is stored as a scheduled item and nothing is sent to TikTok yet. Until that moment the item can still be edited or deleted.
Publish. At the scheduled time MyPostiz uploads the media (video.upload) and publishes it (video.publish) to the operator's own account.
Confirm. MyPostiz reads back the account's post list (video.list) and marks the item as published, or records the error TikTok returned and marks it as failed.

Content and compliance

All content published through MyPostiz is created by the operator: our own text, our own images and our own videos. We do not upload other people's content.
Post settings offered by the Content Posting API — audience, comment, duet and stitch — are passed through exactly as the operator selected them; MyPostiz does not override them.
When a post is commercial content, the operator declares it in the composer so that the declaration is sent with the post, and the resulting content follows TikTok's Branded Content Policy.
Everything published must follow TikTok's Community Guidelines and Terms of Service. Our own Terms of Service make that a condition of using the application.

What MyPostiz does not do

It does not post to any account other than the operator's own connected accounts.
It does not read, download, repost or analyse other creators' videos or profiles.
It does not read direct messages, follower lists or comment threads.
It does not generate or publish anything on its own; a person writes and schedules every post.
It does not sell, rent or share any TikTok data with third parties, and does not use it for advertising, profiling or training machine-learning models.

Data handling summary

The only TikTok data MyPostiz stores is the access token for the connected account, that account's own display name, handle and avatar, and the posts the operator wrote together with their publish result. Tokens are deleted when the account is disconnected in the dashboard. The full detail, including retention periods and how to request deletion, is on the Privacy Policy page.

TikTokとの連携について（日本語）

MyPostiz は TikTok の公式の仕組み（Login Kit と Content Posting API）だけを使います。TikTokのサイトやアプリを自動操作したり、非公式の方法でデータを取得することはありません。接続するのは、運営者本人が TikTokの認可画面で許可した、運営者自身のアカウントだけです。

user.info.basic / user.info.profile	接続したアカウントの表示名・ユーザー名・アイコンを読み取り、投稿先を画面に表示して取り違えを防ぐため
user.info.stats	本人アカウントのフォロワー数・いいね数・動画数を表示し、接続先が正しいことと公開後の反映を確認するため
video.upload / video.publish	予約した時刻に、本人が作成した動画・画像を本人のアカウントへ公開するため
video.list	公開後に本人アカウントの投稿一覧を読み、公開が成功したかを確認して結果を表示するため

いずれの権限も、運営者本人が接続したアカウントにのみ適用されます。他人のアカウントへ投稿する機能、他人のプロフィールや動画を取得する機能、ダイレクトメッセージやフォロワー一覧を読む機能はありません。