Operator
Haru Studio Build is operated by Hyun Seok Park. Contact: harustudiokr@gmail.com.
Haru Studio Build is operated by Hyun Seok Park and provides a hosted photo workspace alongside a separate local Windows tool.
This Privacy Policy describes the hosted TikTok photo dashboard and distinguishes the separate local tool where its data practices differ.
Hosted Dashboard
The hosted dashboard is separate from the Windows application. It uses TikTok Login Kit for sign-in and account authorization. We process the authorized account identifier and display name, encrypted access and refresh tokens and their expiry, session records, selected photos, title and caption, AI and rights declarations, transfer identifiers and statuses. The dashboard does not receive your TikTok password.
Hosted account and queue records are stored in Cloudflare D1. Tokens are encrypted using a server-held key; the browser is not given platform tokens or app secrets. Selected photo sources are stored in a private Cloudflare R2 bucket with a seven-day expiration rule and can be previewed only through the signed-in account's authorized requests. Copies staged for TikTok retrieval are publicly retrievable by their temporary URLs for at most24 hours, with a one-day storage expiration fallback.
Hosted account/queue records remain until removed; there is no automatic purge of all database records. Sessions last up to seven days; authorization-state records expire after ten minutes. Signing out removes the current session but does not revoke TikTok authorization. Account deletion attempts revocation and removes hosted records and images; uncertain operations and unsuccessful revocation may require support assistance. Provider backups and platform-held drafts/posts are separate and may have provider-controlled retention. The hosted dashboard does not expose or import the operator's local token database.
Information We Process
When a user connects a supported social media account, Haru Studio Build may process information made available through the platform's authorized APIs, including account identifiers, display name and basic account information, access and refresh tokens, authorization scopes and expiration information, publishing status and platform-generated post identifiers, and content selected by the user for publishing.
Haru Studio Build only requests platform permissions necessary for its enabled functionality.
TikTok Data
When TikTok is connected, Haru Studio Build may use TikTok's official APIs to identify the TikTok account authorized by the user, securely maintain the user's authorized session, transfer user-selected content to TikTok using the Content Posting API, and check the processing and publication status of submitted content.
The user retains control over final publication where TikTok requires final review and posting within the TikTok application.
Local Storage and Security
Haru Studio Build is primarily operated locally on the user's computer.
Sensitive authentication credentials, including supported access tokens, refresh tokens, and application secrets, are stored locally using Windows data protection and encryption mechanisms.
Authentication credentials are not intentionally displayed or logged in plain text by Haru Studio Build.
Temporary Media Processing
Some social media APIs may require media to be accessible through a temporary public HTTPS URL.
When necessary, selected media is temporarily uploaded to Cloudflare Pages and R2 so the relevant platform can retrieve it. Staged files are publicly accessible to anyone who has their temporary HTTPS URL; they are not protected by the local account login.
Temporary media is used only to facilitate the requested publishing workflow. The publisher requests a 24-hour URL lifetime and attempts deletion after confirmed retrieval or publication. The media service denies expired URLs and attempts deletion when an expired object is requested. Physical deletion of objects that are never requested again depends on Cloudflare storage lifecycle settings; an expired URL is not proof of physical deletion.
How Information Is Used
Information processed by Haru Studio Build is used to authenticate authorized social media accounts, prepare and transfer user-approved content, manage publishing workflows, prevent duplicate publishing, monitor submission and publication status, and maintain the security and reliability of the publishing process.
Data Sharing
Haru Studio Build does not sell personal information.
Information is transmitted to third-party platforms only as necessary to perform functionality explicitly authorized by the user.
Those platforms process information according to their own privacy policies and terms.
Data Retention
Local publishing records and authentication information remain stored until removed by an authorized operator; there is no automatic local retention purge. Disconnection removes the selected account credentials and disables future use. Scoped deletion can remove its platform deliveries, related events and exclusive prepared derivatives while preserving shared content used by other platforms. A disabled routing record remains to prevent accidental reassignment. Source artwork, backups and exported copies require separate review.
Temporary remotely staged media is retained only as necessary for platform retrieval and is intended to be deleted after successful processing or after a limited fallback retention period.
Revoking Access and Data Removal
Users may revoke Haru Studio Build's access to connected third-party accounts through the relevant platform's account or authorization settings where supported.
For assistance removing locally stored authorization credentials, publishing records and prepared media, follow the data-removal instructions. Local removal requires access to the computer holding the data. Revoking platform access does not automatically erase local records.
For assistance with deletion or privacy-related requests, contact the email address below.
Security
Reasonable technical measures are used to protect locally stored credentials and publishing information, including operating-system-level encryption for sensitive credentials.
No method of electronic storage or transmission can be guaranteed to be completely secure.
Children's Privacy
Haru Studio Build is not designed for use by children and does not knowingly collect personal information from children.
Changes to This Policy
This Privacy Policy may be updated when Haru Studio Build's functionality, third-party integrations, or applicable requirements change.