Legal document

Privacy Policy

Last updated: April 23, 2026 Effective immediately
Summary

ClipMaster is a self-hosted tool that runs on your own machine. It connects to TikTok, Instagram, and YouTube via official OAuth only to post videos on your behalf. All OAuth tokens are encrypted and stored in a local database. No personal data is ever sold, shared with, or transmitted to any third party beyond the platform APIs needed to publish your content.

1. Who we are

ClipMaster is an AI-powered video clipping and publishing tool operated by its owner for content automation purposes. For any privacy-related inquiries, please contact: mert01527@gmail.com.

2. Data we collect

ClipMaster collects only the data necessary to operate the platform connections you configure. The following table details exactly what is collected, why, and how it is stored:

Data Type Source Purpose Storage
TikTok access token & refresh token TikTok OAuth (video.upload video.publish) Upload and publish clips to your TikTok account AES-256 encrypted, local DB only
TikTok display name & avatar TikTok API (user.info.basic) Displayed in the ClipMaster channels overview Local DB, plain text
Instagram access token Facebook Graph API OAuth Create and publish Instagram Reels AES-256 encrypted, local DB only
Instagram business account ID Facebook Graph API Identify the account for media creation Local DB, plain text
YouTube refresh token Google OAuth (youtube.upload) Upload YouTube Shorts AES-256 encrypted, local DB only
Video files YouTube URL or local upload Source material for clip generation Local filesystem, temporary
Audio transcripts Generated locally from video audio AI-powered viral moment detection Local DB/filesystem, temporary
Post performance metrics Platform APIs (24h/48h/72h after posting) Improve future clip detection accuracy Local DB only

3. How we use your data

  • OAuth tokens are used exclusively to upload and publish video content to the platform on behalf of the connected account. No other API actions are performed.
  • Transcripts and AI analysis are processed locally and via an AI API. Transcript content may be sent to an AI provider's API for analysis — governed by their own privacy policy.
  • Performance data (views, likes, shares) is used only internally to refine the viral scoring algorithm. It is never shared externally.
  • No data is sold, rented, or disclosed to any third party for marketing, analytics, or any other purpose.

4. Storage & security

  • All data is stored in a local MySQL database on the machine running ClipMaster. No cloud database or remote storage is used.
  • OAuth tokens are encrypted at rest using AES-256-CBC with HMAC-SHA256 authentication (encrypt-then-MAC). Timing-safe comparison prevents oracle attacks.
  • The encryption key is unique per installation and stored in a local environment file that is excluded from all version control.
  • Dashboard access is protected by bcrypt password hashing (cost factor 12), per-session CSRF tokens, and HTTPOnly session cookies.
  • All API communication with platforms uses HTTPS with TLS certificate verification. No credentials are transmitted over unencrypted connections.

5. Data retention & deletion

  • OAuth tokens are retained until you explicitly disconnect a channel in the ClipMaster dashboard, or revoke access via the platform's own settings.
  • Processed video files and transcripts are temporary and can be cleared at any time via the dashboard reset function.
  • To delete all data permanently: disconnect all channels, use the Reset function, and drop the local MySQL database. Nothing is stored externally.
  • To revoke TikTok access: TikTok app → Settings → Security → Apps and permissions → ClipMaster → Remove.

6. Your rights

Since ClipMaster stores all data locally on your own machine, you have complete direct access to all data at all times. Specifically:

  • Access: All data is in your local MySQL database — accessible directly without any request process.
  • Correction: Data can be edited directly in the database or through the dashboard interface.
  • Deletion: Use the dashboard Reset function or drop the database to permanently delete all data.
  • Portability: Export your database at any time via standard MySQL tools.
  • Revocation: Disconnect any platform connection at any time from the Channels page.

7. Third-party services

When you use ClipMaster's platform integrations, the privacy policies of the respective platforms apply:

8. Children's privacy

ClipMaster is not directed at or intended for use by children under the age of 13. We do not knowingly collect personal information from children.

9. Changes to this policy

We may update this Privacy Policy from time to time. Changes will be reflected by updating the "Last updated" date at the top of this page. Continued use of ClipMaster after changes constitutes acceptance of the revised policy.

10. Contact

For any privacy-related questions, data requests, or concerns, contact us at:

Email: mert01527@gmail.com
We aim to respond to all privacy inquiries within 5 business days.