Midnight Case Files Privacy Policy

This policy explains what data Midnight Case Files accesses, how it is used, and how it relates to user data accessed through TikTok's Login Kit and Content Posting API.

Who operates this project

Midnight Case Files is an independently operated content project. For any question about this policy or how the project handles data, contact support@courses4everyone.com.

What this application does

This application uses TikTok's Login Kit and Content Posting API, authorized via OAuth, to upload video content to a single TikTok account that the operator owns and controls. The application is used exclusively by its operator to publish that operator's own content — it is not distributed to, or used on behalf of, any other person or account.

What data is accessed

• Basic profile info (open ID, avatar, display name) via the user.info.basic scope, used only to confirm the operator is authenticating their own account.
• An OAuth authorization token scoped to uploading videos to the operator's own TikTok account (the video.upload scope).
• No other TikTok account data — followers, messages, other users' content, or any other TikTok service — is requested or accessed.

What is not collected

This application does not collect data from viewers of its videos. It does not use analytics or advertising trackers, and it does not sell or share any data with third parties.

Data protection and security

The OAuth client key, client secret, and access token used to authorize uploads are stored exclusively as encrypted secrets in our CI/CD provider's (GitHub Actions) secret store. They are encrypted at rest, are never written to source control, logs, or any database, and are only decrypted transiently in memory during an automated publishing run.

• Encryption in transit: All communication with TikTok's OAuth and Content Posting API endpoints occurs exclusively over HTTPS/TLS.
• Encryption at rest: Credentials are stored using GitHub Actions' encrypted secrets storage, which uses libsodium sealed-box encryption; they are not stored in any other system.
• Access control: Only the project operator has access to these credentials. No third party, contractor, or additional service has access.
• No persistent user data storage: This application does not operate a database of TikTok user data. The only credential retained is the operator's own access token, used solely to re-authorize the operator's own upload requests.
• Revocation: Access can be revoked at any time from the operator's TikTok account settings, which immediately stops all future access.

Data retention

The access token used to publish videos is retained only for as long as the account remains active and the automated publishing pipeline continues to run. It is not retained beyond that operational need, and is deleted/rotated if the pipeline is decommissioned.

Changes to this policy

This policy may be updated as the project evolves. The version in effect at any given time applies to that period.