Last updated: 25 August 2026
Summary
Roytoy (“the Studio”) is single-tenant software run by one person on their own computer. It has no end users, collects no personal data from the public, and operates no server that the public can reach. The only account it touches is the operator’s own.
1. Data the Studio holds
| Data | Source | Where it is stored | Why |
|---|---|---|---|
TikTok access_token, refresh_token, open_id | Returned by TikTok’s OAuth 2.0 flow after the operator grants consent | A local configuration file on the operator’s own computer | To upload and publish videos to the operator’s own TikTok account, and to renew access when the token expires |
| TikTok display name | user.info.basic | Held in memory during a session; shown in the local dashboard | To confirm which account is authorized before publishing |
| Generated video files, captions, hashtags | Created by the Studio | The operator’s own computer | To render and publish the videos |
Access tokens are stored only on the operator’s machine. They are transmitted only to TikTok’s own API endpoints over HTTPS, and to no one else.
2. Data the Studio does not collect
- No personal data about TikTok users, viewers, followers, or commenters.
- No analytics, tracking pixels, advertising identifiers, or behavioural profiling.
- No contact lists, direct messages, or content belonging to other TikTok accounts.
- No data from anyone who visits this website beyond ordinary web server logs kept by the static hosting provider.
3. Sharing
No data is sold, rented, or shared with third parties. There is no advertising network, no data broker, and no analytics vendor in the publishing path.
The only outbound transfers are the API calls the Studio makes to publish content:
- TikTok — video files, captions, hashtags, and privacy settings, sent to the Content Posting API.
- YouTube — the equivalent, sent to the YouTube Data API.
Those transfers are governed by each platform’s own privacy policy (TikTok, Google).
4. Retention and deletion
Tokens are kept only while the integration is in use. The operator can:
- Revoke the Studio’s access at any time from TikTok’s Settings → Security & permissions → Manage app permissions, which invalidates the tokens immediately; and
- Delete the local configuration file and generated media, which removes every copy the Studio holds.
Because the Studio stores no data about anyone else, there is no third-party data to request, export, or erase. Anyone who nonetheless wishes to make an enquiry can use the contact route in section 6.
5. Security
- Tokens live in a local file that is excluded from version control and never published.
- All API communication uses HTTPS.
- The dashboard is not exposed to the public internet.
6. Contact
Enquiries about this policy can be directed to the operator through royfactory.net.
7. Changes
This policy may be updated as the Studio changes. The revision date at the top of this page always reflects the current version.
한국어 요약
Roytoy는 운영자 1인이 자신의 컴퓨터에서 실행하는 단일 사용자 소프트웨어입니다. 일반 이용자가 없으며, 외부인의 개인정보를 일절 수집하지 않고, 공개된 서버도 운영하지 않습니다.
보관하는 정보는 운영자 본인의 TikTok OAuth 토큰(access_token, refresh_token, open_id)과
생성된 영상 파일이며, 모두 운영자의 로컬 컴퓨터에만 저장됩니다. 토큰은 TikTok API 외의 어떤
곳으로도 전송되지 않습니다.
시청자·팔로워·댓글 작성자 등 타인의 정보를 수집하지 않고, 분석 도구나 광고 식별자도 사용하지 않으며, 어떤 데이터도 제3자와 공유하거나 판매하지 않습니다. 운영자는 TikTok 설정의 보안 및 권한 → 앱 권한 관리에서 언제든 접근 권한을 철회할 수 있고, 철회 즉시 토큰은 무효화됩니다.