Privacy Policy

1. Introduction

Canopy ("we", "us", "our") is committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, and safeguard information when you use our TikTok scheduling service. By using Canopy, you agree to the collection and use of information as described in this policy.

2. Information We Collect

2.1 Information from TikTok (via OAuth)

When you connect your TikTok account, we receive the following from TikTok's API:

• TikTok User ID (open_id)
• Display name / username
• Profile picture URL
• OAuth access token and refresh token (used to post on your behalf)

2.2 Content You Upload

• Video files you upload for scheduling
• Captions, hashtags, and post settings you provide
• Your selected posting date and time

2.3 Automatically Collected Data

• Session cookies (to keep you logged in)
• Server logs (IP address, request timestamps) for security and debugging

3. How We Use Your Information

We use your information exclusively to provide the Canopy service:

• Authentication: To verify your identity and maintain your session
• Post Scheduling: To store and publish your posts to TikTok at the scheduled time
• Token Management: To refresh your TikTok access token when it expires so scheduled posts can be published
• Service Improvement: To diagnose errors and improve reliability

We do not sell, rent, or share your personal data with third parties for advertising or marketing purposes.

4. Data Storage & Security

Your data is stored on a secure server. We take the following measures to protect it:

• Access tokens are stored in the database and protected by server-side access controls
• Sessions are managed with encrypted, HTTP-only cookies
• Video files are stored temporarily on our server and served only to TikTok's API for publishing
• All connections to our servers are made over HTTPS in production

5. Data Retention

• Published posts: Post records are retained in our database for your historical dashboard view
• Video files: Video files may be deleted from our servers after successful publication to TikTok
• Account data: Retained as long as your account is active. You may request deletion at any time

6. TikTok Data & Third-Party Services

Canopy integrates with the TikTok Content Posting API and Login Kit. When you use Canopy, TikTok's own Privacy Policy and Terms of Service also apply to how TikTok handles your data. We encourage you to review TikTok's Privacy Policy.

Canopy does not share your data with any third-party services beyond TikTok's API, which is necessary to provide the core scheduling functionality.

7. Your Rights

You have the right to:

• Access: Request a copy of the data we hold about you
• Deletion: Request deletion of your account and all associated data
• Revocation: Revoke Canopy's TikTok access at any time via your TikTok account settings
• Correction: Request correction of inaccurate data

To exercise any of these rights, contact us through the Canopy application.

8. Cookies

Canopy uses a single session cookie (canopy-session) to keep you authenticated. This cookie is HTTP-only (not accessible to JavaScript), encrypted, and expires after 7 days of inactivity. We do not use tracking or advertising cookies.

9. Children's Privacy

Canopy is not intended for users under the age of 13 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that we have collected data from a child without parental consent, we will delete that information promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes by updating the "Last updated" date. Continued use of the Service after updates constitutes acceptance of the revised policy.

11. Contact

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us through the Canopy application.