Privacy Policy

Last updated: 25 Oct 2026

Auto Post Tool ("we", "us", "the Service") is a web application available at https://autoposttool.online that lets approved users schedule and publish their own videos to their own TikTok, Facebook, Instagram, YouTube and Threads accounts (each only after the user connects it) and view basic statistics about their TikTok accounts. The Service is operated by Xe Dien Smile Co., Ltd. (CÔNG TY TNHH XE ĐIỆN SMILE), tax code 0319384061 (registered address: 285 - 285A Hậu Giang, Phường Bình Tây, Thành phố Hồ Chí Minh, Việt Nam; phone: 0889.075.881; email: support@autoposttool.online). This policy explains what data we collect, why, how long we keep it and how you can delete it.

YouTube API Services. Auto Post Tool uses YouTube API Services. If you connect a YouTube channel, you agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy (http://www.google.com/policies/privacy). Section 2e explains exactly what YouTube API Data we access, collect, store, use, process and share.

1. Data you give us

Account data: your name, email address, a one-way hash of your password (we never store the password itself), your preferred language and the short description of how you plan to use the Service, which we use to review your sign-up.
Plan data: whether you are on the free trial or the Pro plan and when it ends. Bank transfers are made directly between you and our bank; we do not collect or store card or bank login details.
Videos and captions: video files you upload, their captions and the settings you choose for each post (audience, comments, Duet, Stitch, AI-generated content label, content disclosure, scheduled time).
Messages: what you send us through the contact form.

2. Data we receive from TikTok

When you click "Continue with TikTok" and approve access on TikTok's page, TikTok sends us the following, only for the scopes you approve:

Scope	Data	Why we use it
`user.info.basic`	Open ID, display name, avatar	To identify the connected account and show you which account a post goes to.
`user.info.stats`	Follower count, following count, total likes, video count	To show your account numbers and their daily trend on the Stats page.
`video.list`	Your latest public videos: ID, caption, cover image, link, date, duration, views, likes, comments, shares	To show how your recent videos perform on the Stats page.
`video.publish`	Creator info (nickname, username, avatar, allowed privacy options, whether comments/Duet/Stitch are turned off, maximum video length) and post status	To show the correct options before you post and to publish the video you approved.
`video.upload`	Upload status	To send videos to your TikTok inbox as drafts when you choose that option.

We also receive an access token and a refresh token that let the Service act for you within those scopes. We never receive or store your TikTok password.

2a. Data we receive from Google (Sign in with Google, YouTube)

Sign in with Google. When you click "Continue with Google" we receive your Google account ID, your email address (verified by Google) and your display name (openid, email, profile), only to create and sign in to your Auto Post Tool account.

YouTube. When you click "Connect YouTube" and approve access, we receive, only for the scopes you approve: your YouTube channel ID, title and thumbnail (youtube.readonly) and permission to upload the videos you confirm (youtube.upload), plus OAuth tokens stored encrypted. We use this data only to show your channel and upload the videos you approved, with the title, description, privacy, "not made for kids" and "altered or synthetic content" settings you chose.

Auto Post Tool's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Auto Post Tool uses YouTube API Services. By connecting YouTube you agree to be bound by the YouTube Terms of Service. See also the Google Privacy Policy.

You can revoke our access at any time on Google's security settings page: security.google.com/settings/security/permissions. When you disconnect YouTube here, delete your account or revoke access, we delete your YouTube data within 7 days (normally immediately). YouTube data other than tokens and statistics is refreshed or deleted after 30 days. We do not sell this data, use it for advertising, or let people read it unless you agree or the law requires it.

2b. Data we receive from Meta (Facebook, Instagram and Threads)

When you click "Connect Facebook / Instagram" and approve access, Meta sends us, only for the permissions you approve: the list of Facebook Pages you manage and their names, IDs and profile pictures (pages_show_list, business_management); Page content and engagement needed to show post status (pages_read_engagement); permission to publish the posts you create and confirm (pages_manage_posts); your connected Instagram professional account's username, ID and profile picture (instagram_basic); and permission to publish the Reels you confirm (instagram_content_publish). We also receive access tokens, stored encrypted. We use Meta data only to show you your accounts and to publish what you approved. We never sell, license or buy Platform Data and never use it for advertising or profiling.

Deleting Meta data. Disconnect the account on the Channels page or delete your account here and we delete the Meta tokens and related data immediately. You can also remove Auto Post Tool in Facebook (Settings & privacy → Settings → Apps and websites); Meta will then send us a deletion request and you can check its status at https://autoposttool.online/data-deletion.php.

Threads

When you click "Connect Threads" and approve access, Meta sends us your Threads profile's ID, username, display name and profile picture (threads_basic), and permission to publish the posts you create and confirm (threads_content_publish). We receive a long-lived access token (60 days, renewed while you use the Service), stored encrypted. For each post we publish for you, we keep the post ID and link returned by Threads. We do not read your other posts, replies or insights, and we use Threads data under the same commitments as above.

Deleting Threads data. Disconnect the profile on the Channels page or delete your account here and we delete the Threads tokens and related data immediately. You can also remove Auto Post Tool in the Threads app (Settings → Account → Website permissions); Threads then notifies us to delete it, and you can check its status at https://autoposttool.online/data-deletion.php.

2c. Applicable law and transfers abroad

We process personal data in accordance with Vietnam's Law on Personal Data Protection No. 91/2025/QH15 and Decree 356/2025/ND-CP. When you ask us to publish to TikTok, Facebook, Instagram or YouTube, your video, caption and account identifiers are sent to those companies, whose servers may be outside Vietnam; we send only what is needed to publish.

2d. Data we receive from TikTok for the Engagement add-on (TikTok API for Business)

When you connect a TikTok account in Engagement → TikTok and approve on TikTok's page, TikTok sends us, only within the permissions you approve: the account's open ID, display name, username and profile picture (user.info.basic, user.info.username); the IDs, captions, links and dates of your recent public posts (video.list); the comments and replies on those posts with the commenter's display name, username, a TikTok user identifier and the comment time and visibility (comment.list). With comment.list.manage we post the replies you approve and hide or unhide comments you choose; we never delete other users' comments. We also receive an access token (valid 1 day) and a refresh token (valid 1 year), stored encrypted.

We use this data only to show the comments of your own TikTok posts in your inbox, draft and send the replies you approve, flag buying questions for you and count your response times. Comments are kept at most 90 days, and deleted 30 days after your Engagement add-on ends. Disconnecting the account in Engagement → TikTok revokes our access at TikTok and deletes the account's tokens, comments and replies immediately; you can also remove Auto Post Tool in the TikTok app (Settings and privacy → Security → Manage app permissions).

AI drafting. To suggest a reply, the comment text and your brand rules are sent to the AI provider you or we selected (Google Gemini or Anthropic Claude). When the free shared AI is used, commenter names are not sent and phone numbers and e-mail addresses are masked. AI providers act as processors; we do not use TikTok data to train models, for advertising or for profiling, and we never sell it.

2e. YouTube API Data: what we access, collect, store, use, process and share

What we access and collect: only after you click "Connect YouTube" and approve on Google's page: your YouTube channel ID, channel title, custom URL and channel thumbnail (scope youtube.readonly), and permission to upload videos you confirm (scope youtube.upload). For each video we upload for you we keep the YouTube video ID and upload status returned by the API. We also receive OAuth access and refresh tokens. We do not read your other videos, comments, subscribers, watch history or analytics.
How we use and process it: to show you which channel is connected, to upload the video, title, description and settings (privacy, made for kids, altered or synthetic content) that you chose, and to show whether the upload succeeded. Nothing else. We do not use YouTube API Data for advertising, profiling, selling, or training AI models.
How we store it: on our server in Vietnam; OAuth tokens are encrypted (AES-256-GCM) and never sent to your browser. Your uploaded video file is deleted from our server once YouTube has received it (or after 30 days if never posted).
How often we refresh or delete it: channel title, custom URL and thumbnail are refreshed from the YouTube API once a day; if a channel cannot be refreshed for 30 days (for example, access was revoked), all of its YouTube API Data is deleted. When you disconnect YouTube, delete your account, or revoke access at security.google.com/settings/security/permissions, we delete all of your YouTube API Data immediately and at the latest within 7 days.
Who we share it with: internally, only the staff who operate the Service, and only to fix a problem you report. Externally, the video and settings you chose are sent to Google/YouTube to publish them; our hosting provider stores the encrypted data on our behalf. We do not share YouTube API Data with any other third party, except where required by law.

3. How we use data

To run the Service: publish, schedule or send to drafts the videos you choose, with the settings you chose, and show their status.
To show statistics about your own TikTok accounts to you.
To review sign-ups, prevent abuse and keep the Service secure (for example, we keep the IP address of failed log-in and password-reset attempts for 15 minutes to block password guessing).
To send you service emails: sign-up received, account approved or declined, password reset links, plan activation and plan reminders. We do not send marketing emails (for the home-page mini game: if you agree there, we may call or message you with advice).
To answer your messages.

We do not sell or rent data, use it for advertising, build profiles of TikTok users, or use TikTok data for any purpose other than showing it to you and posting for you. We do not access any TikTok account that you have not connected yourself.

4. Where and how data is stored

Data is stored on our web hosting server. TikTok access and refresh tokens are encrypted (AES-256-GCM) and are never sent to your browser.
Uploaded videos are stored under a random, unguessable file name so that TikTok can fetch them at posting time. Folder listing is disabled. A video is deleted from our server as soon as TikTok has received it, or 30 days after upload if it is never posted.
Password reset links are single-use, expire after 1 hour and are stored only as a one-way hash.
Statistics snapshots (one per account per day) are kept so you can see trends.
We use a session cookie to keep you logged in and a language cookie that remembers whether you chose English or Vietnamese. We do not use advertising or tracking cookies.

5. Sharing

We share data only with TikTok, Google/YouTube and Meta (Facebook, Instagram, Threads), when we send your videos, captions and settings to the platform you chose at your request (for YouTube see 2e), and with our hosting provider, which stores the server and delivers our emails. AI providers (Google, Anthropic) receive comment text only to draft replies for the Engagement add-on, as processors (see 2d). We may disclose data if required by law.

6. Retention and deletion

Disconnect a TikTok account (Dashboard → Disconnect): we revoke our access at TikTok and delete that account's tokens, statistics and post history immediately.
Delete your account (Account → Delete my account): we revoke TikTok access for all your connected accounts and delete your tokens, videos, posts, statistics and login data immediately.
You can also revoke access at any time in the TikTok app: Settings and privacy → Security → Apps and services. Our stored tokens then stop working immediately; disconnect the account here (or delete your account) to remove them from our server as well.
You may ask us to delete your data by email at support@autoposttool.online. We complete requests within 30 days.
Videos already published on TikTok are controlled by you in TikTok; deleting your account here does not delete them from TikTok.

7. Your rights

You can access, correct, export or delete your data, and object to or restrict its processing. Write to us at the address below.

8. Children

The Service is intended for users aged 18 or older. We do not knowingly collect data from children. If you believe a child has used the Service, contact us and we will delete the data.

9. Security

We use HTTPS, password hashing, encrypted token storage, CSRF protection and access controls. No method is 100% secure, but we work to protect your data and will notify affected users of any breach as required by law.

10. Changes and language

We may update this policy. The date at the top shows the latest version. For important changes we will notify users by email or on the dashboard. This policy is written in English, which is the governing version. A Vietnamese translation is provided for convenience; if the two versions differ, the English version applies.

11. Contact

Xe Dien Smile Co., Ltd. (CÔNG TY TNHH XE ĐIỆN SMILE), tax code 0319384061 — Auto Post Tool
Registered address: 285 - 285A Hậu Giang, Phường Bình Tây, Thành phố Hồ Chí Minh, Việt Nam
Phone: 0889.075.881
Email: support@autoposttool.online
Contact form: https://autoposttool.online/contact.php

12. Home page mini game and weekly hall of fame

The home page has an optional 20-second mini game. You can play without giving us any personal data.

Every game: to stop cheating, the server keeps a random game code, the start time, the score it calculated and a one-way keyed hash of your IP address (not the IP address itself). This record is deleted automatically after 2 days.
Only if your score reaches the weekly Top 10 and you choose to save it: we store the display name and Vietnamese mobile number you type, your score, the time and the language of the page. There are two separate boxes, neither ticked in advance: (1) required to save a score: you agree to show your name and phone number (2 digits hidden) on the hall of fame; (2) optional: you agree that we may contact you with advice. We store each choice separately with the time you agreed.

Why: to show the weekly hall of fame (display name, score and your phone number partly hidden, for example 090801xx02; the full number is never sent to other visitors' browsers), to prevent cheating and spam, and to contact you for advice about Auto Post Tool only if you ticked the second box. If you did not, we will not call or message you. The hall of fame is for fun only: there are no prizes. We never sell these data or use them for anything else.

Legal basis: your consent, under Vietnam's Law No. 91/2025/QH15 on Personal Data Protection and Decree 356/2025/ND-CP. You can withdraw it at any time; withdrawing does not affect what was done before.

How long: saved names and phone numbers are kept for 12 months from the day you saved them, then deleted automatically. Weekly boards restart every Monday at 00:00 (Vietnam time); past weeks stay visible until the 12 months are over.

Who can see the full number: only the administrators of Auto Post Tool. The data are stored on our own server together with the rest of the Service data (section 4) and are not shared with third parties, except where the law requires it.

Your rights: to see, correct or delete your entry, or to withdraw consent, email support@autoposttool.online with the name and phone number you used. We act on deletion requests within 72 hours. Please do not save your details if you are under 16; if we learn that someone under 16 did, we delete the entry.