Information we collect

• Connected account profile: account identifier, username, nickname/display name, avatar URL, profile details, authorized scopes, connection time, and last seen time returned by TikTok after authorization.
• Account statistics: profile engagement statistics such as follower count, following count, like count, and video count when authorized by the user.
• Upload activity: file name, file size, MIME type, caption/title, selected privacy level, interaction settings, AI/commercial disclosure labels, selected cover timestamp, platform publish ID, upload status, timestamps, and technical error codes/messages.
• Authentication data: access tokens and refresh tokens needed to keep a connected account working. These are stored encrypted and are not shown in the frontend or admin dashboard.
• Technical data: basic operational information needed to run the service, troubleshoot errors, prevent abuse, protect the service, and improve reliability.

How we use data

• To let users sign in with TikTok and maintain their authorized account connection.
• To show the connected account identity and available publishing settings returned by TikTok.
• To validate and temporarily prepare only user-selected videos before securely transferring them with the user-selected post settings to the connected platform.
• To monitor publishing status, diagnose upload failures, provide support, and protect the service from abuse or security issues.
• To avoid asking users to reconnect every day when short-lived access tokens expire.

What we do not do

• We do not sell connected account, TikTok profile, or upload activity data.
• We do not publish content without an authorized user flow and a user-selected upload.
• We do not present ourselves as TikTok or as the connected platform provider.
• We do not use collected data for unrelated advertising products.

Storage, security, and deletion

Sensitive connection tokens are encrypted before storage. Raw secrets, access tokens, refresh tokens, and client credentials are not intentionally exposed in public pages or the admin dashboard.

Selected video bytes are stored temporarily while an authorized upload is validated and prepared. With direct transfer, temporary media is deleted after transfer or failure. When TikTok retrieves a prepared video from a temporary Midx link, the prepared file remains available for up to 75 minutes and is removed within approximately 90 minutes; incomplete uploads are removed within 24 hours.

We retain service data for as long as needed to provide the product, support users, troubleshoot uploads, protect security, comply with legal obligations, or until a valid deletion request is completed.

Users may request access, correction, disconnect, or deletion of stored service data by contacting contact@midx.app. Logging out clears the browser session but does not by itself delete server-side records.

Third-party platforms

TikTok may process data under its own terms and policies when a user authorizes Midx and sends selected content through TikTok integrations. Midx is an independent service and is not affiliated with, sponsored by, endorsed by, or operated by TikTok.

Billing information

When you use Midx Priority, Midx may store your internal user ID together with Polar customer, checkout, subscription, order, and refund identifiers; product and subscription status; billing-period and cancellation dates; payment or refund amounts and currency; and timestamps needed to provision access, prevent duplicate checkout, reconcile billing, provide support, and prevent fraud. Midx does not receive or store your full card number, card verification code, or raw payment credentials.

Payment providers and retention

Polar acts as the authorized reseller and Merchant of Record and may use payment processors such as Stripe to process purchases. Their handling of payment and identity information is governed by their own terms and privacy notices. Midx keeps limited billing records for subscription access, accounting, dispute handling, security, and legal compliance. A deletion or disconnect request may not remove records that must be retained for financial, fraud-prevention, dispute, or legal obligations.