Privacy Policy

Last updated 11 November 2026

1. Who is responsible

PeakFeed is a personal project maintained by an individual developer, who is also the only operator of the software. There is no company, no staff and no third-party processor.

2. This website

These pages are static HTML hosted on GitHub Pages. They set no cookies, run no analytics, and contain no tracking scripts. One web font is loaded from Google Fonts; that request reaches Google and is subject to Google's own privacy policy. Nothing else leaves your browser. GitHub may log requests to its servers as part of operating the hosting, which is outside the developer's control.

3. What the software stores when you connect an account

When the operator connects a platform account through that platform's official OAuth flow, the platform returns credentials. PeakFeed stores the following in a database file on the operator's own computer:

• Access and refresh tokens — encrypted at rest using Fernet (AES-128-CBC with an HMAC-SHA256 authentication tag). The encryption key is generated on first run and kept in a separate local file. Tokens are never returned by the application's own interface and never written to logs.
• The account identifier and display name issued by the platform, stored in clear so the interface can show which account is connected.
• The granted scopes and the token's expiry time, so the software knows what it may do and when to renew.

On TikTok, the information retrieved is that covered by the user.info.basic scope — an account identifier and basic profile details such as display name. PeakFeed does not request, read or store a TikTok user's videos, followers, messages, or statistics through this connection.

4. What the software does with it

The tokens are used for one purpose: to upload video files the operator has explicitly approved to that same account, and to renew the token so the connection keeps working. On TikTok the upload goes to the account holder's own inbox as a draft, which the account holder then reviews in the TikTok app.

5. What it never does

• No data is sold, rented or shared with any third party.
• No advertising, profiling, or behavioural tracking of any kind.
• No passwords are requested or handled — authentication happens on the platform's own sign-in page.
• No content belonging to other people is collected, downloaded or republished by the software on its own initiative.
• Nothing is published to any platform without a person approving it first.

6. Where the data lives

Everything described above is stored locally on the operator's own machine. There is no cloud database, no backup service and no remote log. Data is transmitted only to the platform it belongs to — for example, an upload to TikTok goes to TikTok — over HTTPS.

7. Retention and deletion

Tokens are kept until the operator disconnects the account or the platform expires them. Disconnecting an account removes its stored tokens. Deleting the local database file removes everything the software holds. Because nothing is stored remotely, there is no copy elsewhere to request the deletion of.

An account holder can also revoke PeakFeed's access at any time from the platform's own settings, independently of this software. Revocation takes effect immediately on the platform's side.

8. Children

The software is not directed at children and is not intended for use by anyone below the minimum age required by the platforms it connects to.

9. Changes

If this policy changes, the revised version will be published on this page with a new date above. There is no mailing list to notify, because no contact details are collected.

10. Contact

Questions or requests can be raised at github.com/isaacbuccini/peakfeed/issues.