Legal
Privacy Policy
1. Who is responsible
Julian Voh is responsible for the ContentMachine product website and the ContentMachine instance he operates. For privacy questions or requests, email julianwyco@gmail.com. If you use a separately self-hosted instance, its operator determines how that instance is configured and used; contact that operator about its recordings, storage and users. This policy does not make Julian Voh the operator of independent installations.
2. Information processed and why
| Information | Purpose |
|---|---|
| Selected channel names, stream addresses, recording times and settings | Receive selected broadcasts, manage the rolling buffer, organize recordings and show channel status. |
| Video and audio, visible faces, voices, transcripts, thumbnails and previews | Store and edit authorized footage; suggest facecam crops, captions and highlights; render exports. Face detection supports framing and does not identify a person or create an identity recognition database. |
| Clip selections, crop coordinates, layouts, edits, titles, captions, hashtags and post drafts | Save projects and prepare the content you choose to share. |
| Platform account identifiers, display name, avatar address, granted scopes and permitted statistics | Identify the authorized destination account and display account information in the workspace. |
| OAuth access and refresh tokens, authorization state and connection timestamps | Complete account authorization, maintain authorized connections and carry out requested API actions. ContentMachine does not collect your platform password. |
| Upload status, platform response identifiers, resulting links and error messages | Show progress, avoid duplicate work where supported and help resolve failed transfers. |
| Technical connection information, IP address, browser requests and operational logs | Deliver pages and media, diagnose faults and protect the service. The scope and retention of infrastructure logs depend on the hosting configuration. |
| Email address and correspondence you send to the operator | Answer support requests, handle privacy requests and resolve complaints. |
Sources include your inputs, footage selected by the instance operator, connected platforms acting under your authorization, and technical requests from your browser. Footage may contain other people; recording and editing must have an appropriate legal basis and any required permissions.
3. TikTok data and permissions
user.info.basic: obtain the app-specific account identifier, display name and avatar so the destination account is recognizable. TikTok may also return a developer-scoped identifier.user.info.stats: display permitted follower, following, like and video counts for the connected account.video.list: retrieve permitted information about the authorized account's recent public videos to calculate and display their view totals. This does not authorize downloading other creators' videos.video.upload: transfer the selected video file to the authorized creator's TikTok inbox after the user initiates the upload. The user continues editing and completes publication in TikTok.
Only permissions enabled for the integration and authorized by the account holder can be used. TikTok production availability depends on TikTok approval. This policy describes the initial inbox-upload integration; it does not claim an approved Direct Post integration or access to private messages, contacts or advertising data. The initial inbox transfer does not automatically set the final public caption or publish the post.
4. Other connected services
Where enabled, YouTube and Instagram connections similarly use official authorization and process the permitted account profile, statistics, selected export and publication metadata needed for that connection. They are optional and independent of a TikTok connection. Information sent to a platform is also governed by that platform's policies, including TikTok's Privacy Policy, Google's Privacy Policy and Meta's Privacy Policy.
5. Legal bases where the GDPR applies
Processing necessary to provide the requested workspace, editing and account-transfer functions is based on performance of the service agreement, Article 6(1)(b) GDPR, where you are the user entering that agreement. Optional processing that relies on consent uses Article 6(1)(a); consent can be withdrawn for the future. Platform authorization is a technical permission and does not by itself establish a legal basis for processing someone else's footage.
Necessary security, fault diagnosis and proportionate support administration rely on legitimate interests under Article 6(1)(f): operating a secure service, preventing misuse and resolving problems. Processing to meet a legal obligation relies on Article 6(1)(c). Where footage concerns people other than the user, the instance operator must identify the applicable basis before recording or processing it. We do not treat the user's service agreement as those people's consent.
6. Storage, recipients and security
Application files, projects and account records are stored on the instance operator's server and configured backup devices. OAuth tokens are kept in restricted server-side files and are excluded from the application's standard media backup. File permissions restrict token access; this is not a claim that all application data is encrypted at rest. Standard backups use an encrypted backup repository.
Selected files and necessary API metadata are transmitted to the connected platform when you request the corresponding action. Platform API communication uses HTTPS. Do not expose an instance publicly without appropriate HTTPS and access controls. The current product website does not give visitors access to the application server.
Local transcription, highlight analysis and facecam framing process footage on the instance. The current workflow does not send recordings to a hosted language model for these analyses. Loading software models or updates can contact their distribution services. The video editor can load Google Fonts and client libraries from external providers; those providers receive the browser's technical request information. The public legal website uses local styles and system fonts, without such embeds.
The legal website is hosted on GitHub Pages. GitHub receives technical visit information and logs IP addresses for security under its Privacy Statement. Email services also process correspondence when you contact us. We do not sell personal data, use it for targeted advertising, or provide clips or account data to unrelated advertisers or AI model training services. Information may be disclosed where legally required or necessary to protect legal rights, subject to applicable law.
7. International processing
The application stores its working data on the server chosen by the instance operator. GitHub, connected social platforms, external resource providers and email providers may process data in other countries, including outside the European Economic Area. Their policies explain their locations and transfer safeguards. Where we engage a processor and a restricted international transfer is involved, an applicable lawful transfer mechanism is required, such as an adequacy decision or standard contractual clauses. Contact us for information relevant to your instance and request.
8. How long information is kept
- Unsaved stream buffer: the default window is approximately 15 minutes. Unprotected older segments are removed through normal cleanup; pinned segments, active operations and configured settings can extend this period.
- Saved clips, highlight candidates, drafts, transcripts and projects: retained while needed for your saved work until you or the operator deletes them. Rejecting a highlight does not delete its file.
- Connection tokens: retained while the account is connected and removed locally when you disconnect it. Disconnection attempts provider-side revocation; you can also revoke access directly in the provider's settings. Expired access tokens may be refreshed while authorization remains valid.
- Account profile and upload history: disconnecting stops future use of the connection but does not automatically erase historical profile or transfer records. Request deletion if you want those records removed.
- Backups: versioned copies can outlive deletion from active storage. The current backup configuration does not automatically expire all old snapshots. A deletion request must therefore also address affected backup copies, or restrict them from normal use until they can be safely removed. Deleted data must not be reintroduced through a restore.
- Operational events: the application's activity feed retains its latest 300 events. Other server logs follow the host's retention configuration. Support correspondence is kept while needed to resolve the matter or meet applicable recordkeeping requirements.
Retention is reviewed against the purpose of processing. Legal obligations or establishing, exercising or defending legal claims may require limited longer retention. Such data is restricted to that purpose. No fixed backup-erasure deadline is represented as an implemented automatic feature.
9. Cookies, preferences and notifications
The public product and legal pages do not use analytics, advertising cookies or tracking pixels. The application stores interface preferences, such as layout, volume and theme, in your browser's local storage. You can clear them through your browser. Optional browser notifications require your permission; you can turn them off in the application or browser. The current installation does not provide a general background web-push service after the browser is closed.
10. Your choices and rights
You can delete supported clips and projects through the workspace, disconnect a social account, revoke the integration in the platform's settings and clear browser preferences. Deleting a local file does not remove a video already transferred to TikTok or another platform; remove that copy through the platform.
Where applicable, you can request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You can withdraw consent without affecting prior lawful processing. You can complain to the data protection supervisory authority where you live, work or believe a breach occurred. Contact julianwyco@gmail.com; we may request proportionate information to verify that the request concerns your data. Do not send passwords or access tokens. We handle requests within the deadlines required by applicable law, normally one month under the GDPR, subject to permitted extensions.
See Data deletion instructions for a practical request format. You need not have an account to raise a concern about your voice, likeness or other personal information appearing in footage.
11. Automated suggestions and children
Highlight scores and edit suggestions assist editorial review. They do not make decisions producing legal or similarly significant effects, and a person chooses what to retain and share. The service is intended for adults aged 18 or older and is not directed at children. Contact us if you believe a child's data has been supplied improperly.
12. Policy changes
Changes will be posted here with an updated effective date. Material changes will be communicated where required. Questions about this policy can be sent to Julian Voh at julianwyco@gmail.com.