Privacy Policy

1. Introduction

Hobbyster ("we", "us", "our") respects your privacy. This Privacy Policy explains how we collect, use, and protect your information when you use our Service at staging.hobbysters.cc.

2. Information We Collect

2.1 Account Information

When you register, we collect your name, email address, and a hashed password (we never store passwords in plain text).

2.2 TikTok Integration Data

When you connect a TikTok account, we receive and store:

• Your TikTok open_id (a unique identifier)
• Your nickname and avatar URL (public profile data)
• OAuth access tokens and refresh tokens

Security: All TikTok tokens are encrypted at rest using AES-256-CBC. They are never transmitted to third parties.

2.3 Content Data

We store product information you scrape or manually add (titles, prices, images, URLs) and the videos generated from this data.

2.4 Technical Data

We collect server logs (IP, user-agent, timestamps) for security and debugging. Logs are retained for 30 days.

3. How We Use Your Information

• Authenticate you and provide the Service
• Generate and publish videos on your behalf to TikTok
• Send transactional emails (account notifications, errors)
• Improve the Service based on usage patterns
• Comply with legal obligations

4. Data Sharing

We do NOT sell your personal information. We share data only with:

• TikTok: When you publish videos via the Content Posting API
• Infrastructure providers: VPS hosting (Contabo), DNS (GoDaddy), SSL (Let's Encrypt)
• Legal authorities: When required by law

5. Data Security

We implement industry-standard security:

• HTTPS encryption (Let's Encrypt SSL)
• AES-256 encryption for sensitive tokens at rest
• Password hashing (bcrypt)
• SSRF guards against malicious URLs
• SQL injection protection (parameterized queries)
• CSRF protection on all state-changing endpoints
• Server hardening (UFW firewall, Fail2ban brute-force protection)

6. Your Rights

You have the right to:

• Access: View all data we hold about you
• Correct: Update inaccurate information via your profile
• Delete: Request account deletion (contact us)
• Disconnect TikTok: Remove the OAuth link at any time
• Export: Request a copy of your data in JSON format

7. Data Retention

We retain your data while your account is active. Upon account deletion, personal data is removed within 30 days. Anonymized usage statistics may be retained for analytics.

8. Cookies & Sessions

We use only essential cookies for authentication and CSRF protection. No third-party advertising cookies are used.

9. International Transfers

Our servers are located in Germany (Contabo). If you access from outside the EU, your data is transferred to and stored in the EU under GDPR-equivalent protection.

10. Children's Privacy

Hobbyster is not intended for users under 18. We do not knowingly collect data from minors.

11. Changes to This Policy

We may update this Policy. Material changes will be announced via email or in-app notification.

12. Contact

For privacy questions or to exercise your rights, contact us at the address registered in our domain WHOIS.