Privacy Policy

Effective date: 2026-11-10

1. Operator and contact

Trần Đại Phát operates Castle War Content Studio. For privacy, support or deletion requests, contact nuiprono1@gmail.com.

2. Scope of this policy

The Studio is a local Windows workflow for game experiments, MP4 creation, review and optional user-authorized TikTok Inbox transfers. This website provides product information, documentation and an example gameplay clip. It does not host your Studio, accept video submissions or perform TikTok sign-in.

3. Information processed by the Studio

• TikTok authorization: authorization codes, short-lived OAuth state and a PKCE verifier; access and refresh tokens, token expiry times, the TikTok open_id and granted scopes.
• Basic account information: with user.info.basic, the adapter requests open_id and display_name. The display name is used in runtime memory to show the target account; this implementation does not request profile pictures, followers, contacts or private messages for the Inbox workflow.
• Content and instructions: experiment settings/results/replays, rendered MP4s, thumbnails, captions, approvals, schedules, consent timestamps, file hashes, target account identifiers, provider publish IDs, status and error-code history.
• Support communications: information you voluntarily send by email if you contact the operator.

The Studio does not request your TikTok password or session cookies. The Inbox review configuration requests only user.info.basic and video.upload. Other modules of the repository can have separate live-stream data; they are not required or connected to this independent Experiment Studio workflow.

4. Purposes and permissions

user.info.basic is used to identify and display the account you authorized. video.upload is used to transfer an MP4 you selected and approved to TikTok Inbox. Tokens maintain this authorized connection; records support status tracking, explicit instructions, troubleshooting and duplicate prevention. We do not promise that an upload will be approved or published.

5. Local storage and safeguards

The current default content directory is data/content-studio/ on your computer. Studio records, publishing instructions, status history and encrypted OAuth credentials are stored in its SQLite database. The directory may be changed by the local operator’s configuration.

OAuth credentials are encrypted using AES-256-GCM with a key held in backend environment configuration. Client secrets and that encryption key are not sent to the website or frontend. Refresh tokens are rotated when TikTok supplies a replacement. Pending OAuth state expires after 10 minutes and expired entries are cleaned when a new authorization starts; consumed state is removed. Content files, captions and ordinary queue/history records are not encrypted by this application.

Administrative access is restricted to the local computer. You are responsible for access to your Windows account, configuration, storage and backups. Encryption of tokens does not protect an unlocked or compromised computer and does not make all locally stored information anonymous.

6. Transfers and service providers

When you authorize TikTok, the backend exchanges OAuth data with TikTok. When you confirm an Inbox transfer, your MP4 is sent to TikTok with the authorized account credentials; provider IDs are used for status requests. The Inbox upload endpoint does not accept the Studio caption or privacy choice; you enter those while completing the draft in TikTok.

TikTok processes those transfers and resulting posts under its own terms and privacy policy. Disconnecting the Studio does not remove content or records held by TikTok. No central Castle War media server is used by this local workflow.

This static website is prepared for Cloudflare Pages hosting. The hosting provider may process IP addresses, request URLs, timestamps, user-agent and security information to deliver and protect the website under its own policies. The website itself does not add analytics scripts, tracking cookies, advertising pixels, a contact form or a TikTok login widget. Images and the example MP4 are served as static files.

7. Retention

The current Studio has no automatic retention period for MP4s, replays, captions, publishing records or status/error history: they remain locally until the operator deliberately removes them or uninstalls the stored data. This policy describes that behavior; it does not promise automatic erasure after a fixed number of days.

OAuth credentials remain until disconnected, replaced, removed after an unusable refresh outcome, or deliberately deleted by the local operator. Expiry of a token does not automatically erase all associated content/history. Backup copies may remain until the person controlling the backup deletes them. The operator must review retention needs as the service evolves.

8. Disconnect and request deletion

1. Use Publishing → Disconnect to pause new queued transfers, remove local OAuth credentials/pending states and attempt remote token revocation.
2. If remote revocation is not confirmed, remove the app from your connected-app settings in TikTok.
3. For local MP4s and database records, there is currently no erase-all UI. Stop Studio and any other process sharing its database, identify the correct Studio directory and request targeted deletion assistance from the operator. Do not delete a shared database or another user’s data blindly.
4. Delete relevant backup copies separately if you control them. Content already uploaded or posted must be managed in TikTok.

Send deletion requests to nuiprono1@gmail.com, stating which installation and categories of data are involved. Do not email passwords, access/refresh tokens or a full database. The operator may need information sufficient to verify you control the affected data. No fixed response deadline is claimed here.

9. Website and support data

You do not need to sign in to read this website. Contacting support shares the information in your message with the operator and the email services involved. Avoid sending sensitive credentials. Hosting and email providers control their own infrastructure logs and retention; this local application does not set their retention periods.

10. Changes and questions

Material changes to actual data handling will be reflected in this policy with an updated effective date. Questions can be sent to nuiprono1@gmail.com.