Privacy Policy

1. Who we are and the scope of this policy

39 Days Home operates 39 Days Home Video Studio. This Privacy Policy describes information processed through our website and video creation, publishing and related workspace services. Contact xushangshe@gmail.com for privacy questions or requests.

This policy covers our processing. TikTok, Meta, AI providers and other third parties apply their own terms and privacy policies to their services. Where a business workspace submits information about other people, that business is responsible for its lawful instructions and required notices.

2. Information we process

Workspace information may include user names, email addresses, tenant and store identifiers, connected account identifiers, display names, permissions and token expiry times. Content includes uploaded images, videos, prompts, narration scripts, captions, subtitles and chosen publishing settings.

When enabled, we process published-post identifiers and available counts such as views, likes and comments, review text and reply drafts, and information entered in the profit ledger. Operational information may include job identifiers, timestamps, errors, network-routing settings and proxy exit IP or latency measurements. Proxy credentials, when supplied, are encrypted using the account credential mechanism.

We may also receive information you send directly to support. Do not send social-account passwords, tokens or unnecessary sensitive data by email or in prompts.

3. TikTok OAuth, access tokens and refresh tokens

You connect your TikTok account by authorizing the application through TikTok’s OAuth flow. TikTok authenticates you and returns an authorization code, which our server exchanges for scoped access and refresh tokens. We do not request or store your TikTok password.

We store access tokens and refresh tokens encrypted at rest using AES-256-GCM. The encryption key is supplied to the server through environment configuration; encrypted credentials are bound to the relevant tenant and platform account. Token values are not returned in the account-management page or placed in publishing queue payloads, and routine diagnostic logs redact credentials.

Server-side components decrypt a token only when needed for an authorized operation. Access tokens authenticate requests to TikTok; refresh tokens renew access when permitted by TikTok. We retain expiry information and approved scopes and may require you to reauthorize when credentials expire or become invalid. TikTok API communications use HTTPS.

Depending on permissions you approve and features enabled, scopes such as user.info.basic, video.publish and video.list support account identification, posts you submit or schedule, and metrics for available published videos. We use tokens for those connected-account services, not to sell access to your account, send tokens to AI providers, or publish unrelated content without your instructions.

4. Why and how we use information

We use information to provide and maintain workspaces; generate and process requested media; translate narration and prepare audio or subtitles; carry out confirmed publishing instructions; recover overdue schedules after interruptions; display available analytics; provide requested business tools; and respond to support requests.

We also use operational data to troubleshoot failures, protect connected accounts, enforce usage rules, prevent duplicate submissions and maintain financial or security records. Where applicable law requires a lawful basis, processing may rely on providing the requested service, consent where required, legitimate operational interests, or legal obligations, depending on the data and purpose.

5. Providers, social platforms and media delivery

Requested features may send selected media and prompts to video providers such as Runway, MiniMax/Hailuo, BytePlus/Seedance or Kling; text or image analysis to DeepSeek or OpenAI; and narration text to a speech provider. Which providers are used depends on the selected engine and configured feature. TikTok OAuth tokens are not included in AI prompts or sent to those AI providers.

Media storage and delivery may use Cloudflare R2 or compatible storage. Some generated or uploaded media is delivered using public URLs configured for the workspace; anyone who obtains such a public media link may be able to access the file. Upload only content appropriate for the chosen delivery settings.

To publish or retrieve authorized information, we send necessary content and credentials to the selected social platform. Service providers may process information in other countries under their own applicable arrangements. We may disclose information when required by law, to protect rights and security, or in a lawful business transfer with appropriate safeguards. We do not sell your OAuth tokens or personal information.

6. Retention and deletion

We retain content and associated records for as long as reasonably needed to provide the configured service, maintain your workspace and satisfy legitimate security, operational or legal purposes. Retention varies by data category and workspace configuration; this policy does not promise automatic deletion after a fixed period for all data.

Encrypted TikTok credentials are retained for the connected-account features in use. To request removal of stored tokens or account data, email xushangshe@gmail.com and identify your workspace and connected account without sending the token itself. After verification, we will review and carry out the request, subject to applicable obligations and necessary retention exceptions. Deleting an account from a workspace may initially disable or soft-delete its record rather than immediately erase every retained record.

Financial, dispute, audit and security records may need to remain for an appropriate period. Backup copies may persist until normal backup retention expires. Deleting data from our service does not itself delete content already published to TikTok or other platforms; manage that content with the relevant platform.

7. Your choices and revoking TikTok access

You control whether to authorize a TikTok connection and which permissions to grant. You can revoke authorization using TikTok’s app-permission controls. Once TikTok processes revocation, previously issued credentials can no longer provide authorized access as permitted before; our next attempted use may fail and require reauthorization.

Revoking access at TikTok and deleting data stored by us are separate actions. Contact us to remove our stored credentials and related data, or contact your workspace administrator to pause account activity or scheduled tasks. We do not claim that revocation instantly deletes all local records.

Depending on where you live, you may have rights to access, correct, delete or obtain a copy of information, object to or restrict processing, withdraw applicable consent, or complain to a competent data protection authority. Email xushangshe@gmail.com; we may verify identity and authority before responding in accordance with applicable law.

8. Security and workspace separation

We use safeguards including account-bound credential encryption, server-side secret configuration, tenant-scoped database access and checks on publishing operations. Access to operational systems should be limited to authorized operators and service components. No storage or transmission method is completely secure.

Safeguards also depend on deployment and workspace administration. Keep devices and connected accounts secure and promptly report suspected unauthorized access. Never share access tokens, encryption keys or proxy passwords in support screenshots or public posts.

9. Website storage, children and updates

This public website does not add advertising trackers or analytics cookies. Application and infrastructure providers may use technical storage or logs needed for their operation; connected platforms apply their own cookie and privacy practices.

The service is intended for adults using business and creative tools, not children under 18. If you believe a child provided personal data, contact us so we can review the situation and take appropriate action.

We may update this policy when features, providers or legal requirements change. We will revise the last-updated date and provide additional notice where appropriate or legally required.