Privacy Policy

1. Scope and roles

This Privacy Policy applies to the official Social Analytics Desktop website and to the Social Analytics Desktop Windows application. Frédéric Marbaix is the operator and data controller for processing performed through the official website and for any direct support communication.

The desktop application is a local tool operated by you. You decide which authorised accounts, publications, local media and optional external providers it uses. Depending on your circumstances, you may have your own legal responsibilities for data you process with the application.

2. Official website

This static website contains no account system, contact form, advertising, analytics, tracking pixel, telemetry, client-side JavaScript or external display resource. It does not intentionally collect information through the page itself and does not set application, analytics, advertising or tracking cookies.

The site is hosted by Cloudflare. Like other hosting and security providers, Cloudflare may process technical request information such as IP address, date and time, requested URL, user agent, security signals and server logs to deliver and protect the site. Cloudflare acts under its own applicable terms and privacy documentation.

If you contact the operator by email, the message, address and related correspondence are used to answer and manage your request.

3. Data processed by the desktop application

Depending on the features you use and the permissions you grant, the application may process:

• TikTok account identifiers, including the authorised open_id, profile fields, granted scopes and connection status;
• OAuth access and refresh tokens, expiry information and application credentials needed for the authorised connection;
• publication identifiers, descriptions, timestamps, duration, format, links and available statistics such as views, likes, comments and shares;
• successive statistical snapshots, calculated ratios, baselines, trends, comparisons, categories, tags, analyses, recommendations and experiments;
• local media paths, file metadata, hashes, user-provided transcripts, selected frames, OCR output and controlled image derivatives when you use content-analysis features;
• optional AI provider configuration, non-secret provider status, request manifests, structured results and errors;
• local configuration, operational logs, backups, exports and diagnostics generated at your request.

The exact TikTok fields available in production remain to be revalidated on the first approved live TikTok flow.

4. Purposes of processing

The application processes data to connect accounts you authorise, synchronise available publication statistics, preserve historical snapshots, calculate descriptive analytics, organise content, display account-specific dashboards, support optional user-initiated analysis, and provide backup, export, maintenance and diagnostic functions.

There is no advertising profile, cross-account marketing profile or automatic decision that produces legal or similarly significant effects.

5. Local storage and account separation

Application data is stored locally in SQLite and related files on the Windows computer or another location selected by the user. OAuth tokens and configured AI provider keys are stored in a secret file encrypted with Windows DPAPI for the current Windows user.

Each connected TikTok account has its own identity, scopes, tokens, publications, snapshots, categories, tags, baselines and analyses. Statistics for one account are not included in another account's calculations. Backups, exports and diagnostic files are created only when the user requests them; exported material must be protected by the user.

6. TikTok OAuth and API processing

When you connect or synchronise an account, the application communicates with TikTok's official OAuth and API endpoints. TikTok receives information required to authenticate the request, provide the consent screen, issue or revoke tokens, and return authorised data. TikTok independently determines its processing under its terms and privacy policy.

The application is prepared to request user.info.basic, user.info.profile, user.info.stats and video.list. You can deny consent or revoke an existing connection. Revocation does not automatically delete local history, because connection credentials and historical records are controlled separately.

7. Optional external AI processing

AI analysis is optional and requires a supported provider to be configured. No inference is triggered merely by opening a screen. The user starts an analysis for a publication or explicit selection and confirms the outbound-data manifest before the first transmission.

The current implementation uses OpenRouter only when configured and when its zero-cost eligibility checks succeed. A request may contain selected publication facts, calculated analytics, text, or selected and size-controlled media derivatives needed for the chosen analysis. TikTok OAuth tokens, the AI API key, data from other accounts and the complete local database are excluded.

Data sent to an external provider is processed under that provider's own terms, retention rules and privacy policy and may be transferred outside France or the European Economic Area. Do not initiate an AI analysis if you do not accept that external processing.

8. Sharing, sale and telemetry

The operator does not sell personal data. The desktop application contains no advertising, behavioural analytics or telemetry system. Data leaves the device only when required for a user-requested external function, principally TikTok OAuth/API operations or an explicitly initiated optional AI analysis, or when the user exports and shares a file.

The official website is delivered through Cloudflare as described above. Direct email is processed by the email services used by the sender and recipient.

9. Retention, revocation and deletion

Local application data remains on the user's device until the user deletes it, restores another dataset, or removes the relevant files. Cached media derivatives can be cleared without deleting original media or analytical history. Backups and exports remain until the user deletes them.

Revoking OAuth removes or invalidates the selected account's credentials while preserving local history. Deleting an account's local history is a distinct explicit operation and does not by itself revoke OAuth. Provider keys can be deleted separately from analytical results.

Support emails are retained only as long as reasonably necessary to answer the request, maintain relevant correspondence and meet applicable legal obligations.

10. Security

The application uses account-scoped database access, Windows DPAPI for stored secrets, OAuth PKCE and state verification, filtered logs, integrity checks and explicit outbound-data controls. Original selected media is not modified by the content-analysis pipeline. Diagnostics exclude raw OAuth tokens, provider keys and unencrypted secret material.

No system is completely secure. Users must protect their Windows session, device, storage, backups, exports and email account, and should apply software updates when available.

11. Legal bases

Where the EU General Data Protection Regulation applies to the operator, direct support communication is processed to answer your request and for the operator's legitimate interest in maintaining and securing the project. Any processing needed to provide a feature you request may also be necessary to take steps at your request or perform the applicable service arrangement. Where consent is the appropriate basis, it may be withdrawn for future processing.

Most desktop processing takes place under the user's own local control. TikTok and optional AI providers determine their own legal bases for the processing they perform.

12. International transfers

Cloudflare and optional external providers may process technical or submitted data in countries outside France or the European Economic Area. Their own privacy notices describe the locations, safeguards and transfer mechanisms they use. The user controls whether to activate optional AI transmission.

13. Your rights

Subject to applicable law, you may have rights of access, rectification, erasure, restriction, objection and portability, and a right to withdraw consent for future processing. For website or support processing controlled by the operator, contact frederic.marbaix74@gmail.com. Identity verification may be required when reasonably necessary.

For local application data, the application provides account, deletion, export, backup and revocation controls. Requests about processing performed independently by TikTok, Cloudflare, an AI provider or an email provider should also be directed to that organisation. You may lodge a complaint with the French data-protection authority, the CNIL, or another competent supervisory authority.

14. Children

The Service is not directed to children and is not designed to collect information from them through this website. Do not connect another person's account without authority. TikTok's own age requirements and parental rules continue to apply.

15. Changes, contact and hosting

This policy may be updated when the Service, applicable law or third-party requirements change. The effective date at the top identifies the current version.