Privacy
Effective 11 November 2026.
Who is the controller
PublishVid is operated by Sadano Mayk Moreira, an individual. That person is the controller of the personal data this app holds. This policy describes only what this app does.
Contact: publishvid@ilhadigital.online. Support page: https://publishvid.ilhadigital.online/contact. Website: https://publishvid.ilhadigital.online.
There is no separate data-protection officer. Privacy requests go to the contact email.
What the service does
The service lets you sign in with your own TikTok account and publish a video you choose on your device to that same account, after you confirm.
There is no separate email or password account. The app account is the TikTok account you authorize.
Data we collect
From TikTok, after you authorize the app: your open_id, display name, avatar URL, and username. We use them to identify the connected account and to show you which account will receive the video.
Access token and refresh token. They are stored encrypted on the server (AES-GCM) and are used only to call TikTok for you: account details, the post you confirmed, status, and revocation. If TikTok rotates the refresh token, the stored value is replaced.
The caption, privacy choice, comment, Duet, and Stitch settings, commercial-disclosure choices, and the confirmation text you accepted.
Video file name, type, size in bytes, and duration. These are used to check TikTok's duration limit and to build the upload. The video bytes are streamed to TikTok in parts and are not stored.
The publish id and status TikTok returns, so we can show whether the post is processing, published, or failed.
A session cookie (HttpOnly) and a CSRF token, so you stay signed in and cross-site requests are rejected.
A short-lived counter of requests from your connection, used to slow abuse. It is not a browsing history. It is deleted within about two hours.
What we do not collect
We do not collect your email address, a password, a payment card, an identity document number, a date of birth, your contacts, your messages, or other people's accounts. We do not sell data and we do not build an advertising profile.
Why we use it
We use this data to provide the service you asked for: signing you in, showing the account you will post to, and publishing the video you confirmed. Under Brazil's Lei Geral de Proteção de Dados (art. 7, V), that is processing to perform a service you requested.
The short request counter is used only to slow abuse and keep the service available. Under art. 7, IX, that is a legitimate interest. It is not a browsing profile, and it does not override your rights.
The sign-in screen and the confirmation on the post screen are the steps that start that processing.
How long we keep it
The session lasts 14 days, or until you log out, whichever comes first. Expired sessions are deleted.
The sign-in state used during TikTok authorization lasts 10 minutes.
Tokens stay until you disconnect or delete the account.
Post and video metadata stay so you can see the status of a post. They are deleted when you delete the account. Unfinished posts, and video metadata that is no longer attached to a post, are deleted after 24 hours.
A scheduled job runs every hour and deletes expired sessions, expired sign-in attempts, those unfinished records, and old rate-limit counters.
Deletion inside the app happens when you confirm it. A deletion request sent by email is completed within 15 days of a request we can match to an account, which is the period in art. 19 of the LGPD.
Who receives it
We share personal data only with TikTok and with Cloudflare.
TikTok receives the video while it is in transit, and the post settings, because you asked to publish there. TikTok is an independent controller of what is published on TikTok, under its own policy. This app does not control TikTok's later use of that post.
Cloudflare hosts the app and stores the database, including the encrypted tokens and the post metadata, as the operator acting on the controller's instructions. Cloudflare also processes the network connection. There is no email vendor and no video-storage bucket.
We do not sell or rent personal data. We do not share it with advertisers or with other apps.
International transfer
Cloudflare and TikTok may process this data outside Brazil. The transfer happens because you asked to publish on TikTok and because the app is hosted on Cloudflare.
Under art. 33, IX, of the LGPD, read with art. 7, V, that transfer is allowed when it is necessary to perform the service you requested. We do not send the data to any other recipient.
Disconnect and deletion
Disconnect revokes the token at TikTok and deletes the tokens stored here. Delete account does that and also deletes the account, the session, and the post metadata.
If revocation fails, the local copy is still deleted. You can also remove the app in TikTok's settings.
A video TikTok has already accepted is not removed from TikTok by this app. You delete that video in TikTok.
You can delete data from the account page, from the data deletion page, or by emailing publishvid@ilhadigital.online.
Your rights
Under art. 18 of the LGPD you can ask for: confirmation that we process data; access to it; correction of incomplete or outdated data; anonymization, blocking, or deletion of data that is unnecessary or excessive; portability of the data this app actually holds; information about who we share it with; information that you may refuse to connect TikTok, in which case this app cannot sign you in or post; and revocation of the TikTok authorization.
Portability covers the account identifiers and the post metadata we store. We cannot hand over the video file, because we do not store it, and we cannot export TikTok's copy of a published video.
Use the product, or email publishvid@ilhadigital.online. We answer within 15 days. You can also petition the Brazilian data-protection authority, the ANPD, at https://www.gov.br/anpd.
Security
The site is served over HTTPS. Tokens are encrypted at rest with AES-GCM. The session cookie is HttpOnly. The video is streamed to TikTok and is not written to a file store. Secrets are not kept in the application source.
Children
This service is not directed at children under 12. We do not ask for age or for an identity document. TikTok applies its own age rules to the account you connect.
If you believe we hold data about a child under 12, email publishvid@ilhadigital.online. We delete the data we can match to that account.
Changes
If this policy changes, the new text appears on this page with a new effective date.