1. Introduction
Hobbyster Creator Studio ("we", "us", "our") respects your privacy. This Privacy Policy explains what personal information we collect, how we use it, how we share it, and your rights regarding it when you use our Service at https://hobbysters.cc.
This policy is designed to comply with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws.
2. Data Controller
The data controller for personal information collected through the Service is Hobbyster Creator Studio. For privacy inquiries, contact us at privacy@hobbysters.cc.
3. Information We Collect
3.1 Account Information
When you register, we collect:
- Your name
- Your email address
- Your password (stored only as a one-way cryptographic hash; we never store passwords in plain text)
3.2 TikTok Integration Data
When you connect a TikTok account through OAuth, we receive and store the following from TikTok's API:
- open_id: A unique identifier for your TikTok account (not your @handle)
- nickname: Your TikTok display name
- avatar URL: The URL of your TikTok profile picture
- OAuth access token and refresh token: Used to upload and publish videos on your behalf
Security: All OAuth tokens are encrypted at rest in our database using Laravel's encrypted casts (AES-256-CBC). They are never transmitted to third parties, never displayed in our UI, and never logged.
We do NOT collect from TikTok: your email address, phone number, follower list, list of videos you have posted, content from other users, or any data beyond what is strictly necessary to identify which account a post is being sent to.
3.3 Content Data
We store information you provide or that our system extracts on your behalf:
- Product URLs you submit for video generation
- Product titles, descriptions, prices, and images extracted from those URLs
- Generated video files (MP4 format) stored on our servers
- Video captions, hashtags, and scheduling preferences
3.4 Technical Data
We automatically collect for security, debugging, and Service improvement:
- IP address
- Browser type and version (User-Agent string)
- Timestamps of requests and Service usage
- Error logs (with sensitive data, including tokens, redacted)
Server logs are retained for a maximum of 30 days, after which they are automatically deleted.
4. How We Use Your Information
We use your information solely to:
- Authenticate you and provide access to the Service
- Generate and publish videos on your behalf to TikTok
- Display your linked TikTok account's nickname and avatar in our dashboard, so you can confirm which account is connected
- Send transactional emails (account confirmations, password resets, important Service notifications)
- Detect and prevent fraud, abuse, and security threats
- Comply with legal obligations (e.g., responding to lawful requests from authorities)
- Improve the Service based on aggregated, anonymized usage patterns
We do NOT use your data for advertising profiling, behavioral tracking, or sale to third parties.
5. Legal Bases for Processing (GDPR)
Under GDPR, we process your personal information based on:
- Contract: Processing necessary to provide the Service you have signed up for
- Consent: When you voluntarily connect a TikTok account, you consent to the processing of OAuth data
- Legitimate interests: Security, fraud prevention, and Service improvement
- Legal obligation: Compliance with applicable laws
6. Data Sharing & Disclosure
We do NOT sell your personal information. We share data only with:
- TikTok Inc. / ByteDance Ltd. — only the video file and caption you publish, transmitted through TikTok's official Content Posting API. We do not share your Hobbyster account credentials with TikTok.
- Hosting and infrastructure providers (Contabo GmbH, EU-based) — bound by data processing agreements, with no access to encrypted token data.
- Email service providers — only for sending transactional emails (transactional content only, no marketing without explicit consent).
- Law enforcement — only when required by a valid legal request and consistent with our policies.
7. Data Retention
We retain personal information only as long as necessary:
- Account information — retained until you delete your account, then deleted within 30 days
- TikTok OAuth tokens — retained only while the TikTok account is connected; immediately deleted upon "Disconnect" action
- Generated videos and product data — retained until you delete them or your account is deleted
- Server logs — automatically deleted after 30 days
- Backups — encrypted database backups are retained for a maximum of 7 days locally and 30 days off-site, then automatically deleted
8. Your Rights
You have the following rights regarding your personal information:
- Right of access: Request a copy of your data
- Right to rectification: Request correction of inaccurate data
- Right to erasure ("right to be forgotten"): Request deletion of your data
- Right to restriction of processing: Request that we limit how we use your data
- Right to data portability: Receive your data in a machine-readable format
- Right to object: Object to processing based on legitimate interests
- Right to withdraw consent: Disconnect your TikTok account anytime via our dashboard
- Right to lodge a complaint: File a complaint with your local data protection authority
To exercise any of these rights, contact us at privacy@hobbysters.cc. We will respond within 30 days.
9. Data Security
We implement industry-standard security measures including:
- HTTPS/TLS encryption for all data in transit
- AES-256-CBC encryption at rest for sensitive data (OAuth tokens, password hashes)
- Encrypted database backups with AES-256 encryption
- Hashed passwords using bcrypt (industry-standard one-way hash)
- Server access restricted via SSH key authentication; root login disabled
- Regular security updates and monitoring
- Automated healthchecks and intrusion alerting
However, no system is 100% secure. In the event of a data breach affecting your information, we will notify you and the relevant data protection authority within 72 hours, as required by GDPR.
10. International Data Transfers
Our servers are located in the European Union (Germany). When you publish to TikTok, content is transmitted to TikTok Inc.'s infrastructure, which may process data globally according to TikTok's own privacy policy. We do not transfer personal data outside the EU/EEA except as needed for this TikTok integration.
11. Children's Privacy
The Service is not intended for users under 18 years of age. We do not knowingly collect personal information from minors. If we discover that we have collected data from a person under 18, we will delete it promptly. If you believe we have collected data from a minor, contact us at privacy@hobbysters.cc.
12. Cookies
We use only essential cookies necessary for the Service to function:
- Session cookie (hobbyster_creator_studio_session) — keeps you logged in
- CSRF token cookie (XSRF-TOKEN) — prevents cross-site request forgery attacks
We do not use third-party tracking, analytics, or advertising cookies. We do not employ behavioral profiling.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. Material changes will be communicated via email or through a notice on the Service at least 14 days before they take effect. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.
14. Contact
For privacy inquiries, data subject requests, or any questions about this Policy, contact us at:
Email: privacy@hobbysters.cc
Website: https://hobbysters.cc
See also: Terms of Service