Privacy Policy

BlowUp (“BlowUp”, “we”, “us”) is a tool that helps creators publish videos to their own TikTok accounts and compare how those videos perform. This policy explains what information we collect, how we use it, and the choices you have. Questions: maxtrinh4@gmail.com.

Account information. When you sign up we collect your email address and a password (stored only as a salted hash), or, if you sign in with Google, your email address and basic profile information provided by Google.

TikTok account data. When you connect a TikTok account, TikTok provides us, with your authorization, an access token and refresh token, your basic profile information (such as display name, avatar, and account identifier), and the list of videos on that account together with their metadata and performance metrics (such as view counts). Tokens are stored encrypted. We only access the TikTok data covered by the permissions you approve during TikTok’s authorization flow.

Content you upload. Video files, captions, tags, and notes you create in BlowUp in order to publish or analyze your posts.

Usage and technical data. Standard server logs (such as IP address, browser type, and timestamps) generated when you use the service, used for security and debugging.

We use this information solely to operate BlowUp: to authenticate you, to publish videos to the TikTok accounts you connect (only when you initiate a post), to ingest and display the performance of your videos, to compute comparisons across your own posts, and to keep the service secure. We do not use your data for advertising, we do not sell or rent your personal information, and we do not use your content or metrics to build products for anyone other than you.

We share data only with the service providers that host BlowUp, and only as needed to run it: Supabase (database hosting), Cloudflare R2 (video file storage), Railway (application hosting), Google (if you sign in with Google), and TikTok (to publish your videos and retrieve your video data through TikTok’s official APIs, subject to TikTok’s own privacy policy). We may also disclose information if required by law. There are no other third parties.

We keep your data while your account is active. You can disconnect a TikTok account at any time from within BlowUp, or revoke BlowUp’s access from TikTok’s own settings (Settings → Security & permissions → Apps & websites); either action invalidates the stored tokens. To delete your BlowUp account and its associated data — including stored tokens, uploaded videos, and ingested metrics — email maxtrinh4@gmail.com and we will complete the deletion within 30 days.

TikTok access and refresh tokens are encrypted at rest. Passwords are stored only as salted hashes. All traffic to and from BlowUp is encrypted in transit (HTTPS). No method of storage or transmission is perfectly secure, but we limit collection to what the service needs to function.

BlowUp is not directed at children and may not be used by anyone under 13 (or the minimum age required to use TikTok in your region, if higher).

If we change this policy we will update this page and revise the date above. Material changes will be communicated to registered users by email.

For any privacy question or request: maxtrinh4@gmail.com.