Privacy Policy | CuriosityLoop

This Privacy Policy describes how Zylean AS (“CuriosityLoop”, “we”, “us”, or “our”) collects, uses, and protects information when you use the CuriosityLoop web application at https://curiosity-loop.com.

1. Information we collect

1.1 TikTok account information

When you connect your TikTok account using TikTok Login Kit, we receive the following information with your permission:

TikTok Open ID (a unique, anonymised account identifier)
Display name and avatar image URL
OAuth access token and refresh token
Token expiry timestamps
Granted permission scopes

We do not receive your TikTok password, email address, phone number, followers list, messages, or analytics.

1.2 Video and publishing data

Generated video metadata (title, caption, hashtags, duration)
Publishing settings you select (privacy level, interaction options)
TikTok publish ID returned by the Content Posting API
Publication status history (processing, succeeded, failed)

1.3 Technical and security logs

Server-side structured logs for error diagnosis (sanitised — no tokens or credentials)
Request identifiers for log correlation
Rate-limiting state (IP-based, not stored permanently)

2. How we use your information

To authenticate your TikTok account connection
To display videos pending review in your dashboard
To submit approved videos to your connected TikTok account
To track publishing status from TikTok
To notify our workflow system (n8n) of publishing events
To protect against unauthorised access and duplicate submissions
To diagnose and resolve technical errors

3. Data storage and processors

We use the following third-party services to operate CuriosityLoop:

TikTok — OAuth authentication and content publishing. Your interaction with TikTok’s authorization pages is governed by TikTok’s own privacy policy.
Supabase — Database and file storage for video assets and publishing records, hosted on AWS infrastructure.
Replit — Hosting and deployment of this web application.
n8n — Private workflow automation for video generation orchestration. Receives event notifications (video IDs and status codes only — no tokens).
OpenAI — Used in the content generation pipeline for script drafting and research assistance.
ElevenLabs — Used in the content generation pipeline for voiceover production.
Creatomate — Used in the content generation pipeline for video assembly and rendering.

4. Token security

OAuth access and refresh tokens are encrypted using AES-256-GCM before being stored in HTTP-only, Secure, SameSite session cookies. Tokens are never:

Stored in local storage or readable JavaScript
Included in server logs
Transmitted to third parties other than TikTok’s official API

5. Data retention

Session cookies expire after 7 days of inactivity or when you disconnect your account
Video and publishing records are retained until you request deletion
Technical logs are retained for up to 90 days
Rate-limiting state is held in memory only and is not persisted

6. Your rights

You have the right to:

Access personal data we hold about you
Correct inaccurate data
Request deletion of your data
Withdraw consent (by disconnecting your TikTok account)
Object to processing

To exercise these rights, email contact@zylean.com with the subject line “Privacy Request”.

7. Security safeguards

All data is transmitted over HTTPS/TLS
Tokens are encrypted at rest using AES-256-GCM
Server-side validation on all inputs
CSRF protection via OAuth state parameter
Rate limiting on authentication and publishing routes
Content Security Policy and other HTTP security headers

We do not claim any specific certification. We implement security controls proportionate to the data we handle.

8. Changes to this policy

We may update this policy when our practices change. Material changes will be posted on this page with an updated effective date. Continued use after notice constitutes acceptance.

9. Data controller contact

Zylean AS
Organisation number: 937 332 459
Tovdalsvegen 111, 4363 Brusand, Norway
contact@zylean.com