Privacy Policy

1. Information we collect

Account

You sign in with GitHub or Google through Supabase Auth. We store your provider user id and email address, and keep a signed session cookie so you stay logged in.

Profile and ideas

If you provide them, we store a display name, content niches, a target audience description, and the content ideas you add, edit, or check off in the workspace.

TikTok API data (read-only)

If you connect TikTok, we request read-only Display API access with the scopes user.info.basic, user.info.profile, user.info.stats, and video.list. We store:

• Avatar, display name, username, bio, profile link, and verification status
• Follower, following, like, and video counts
• Video titles, descriptions, duration, create time, and performance metrics (views, likes, comments, shares)
• OAuth access and refresh tokens so we can sync metrics on your behalf

We do not post, edit, or delete content on TikTok. Access is limited to reading the profile and video metrics needed to ground AI suggestions in your own performance data.

Users may revoke ShipLog's access at any time through their TikTok account security settings, which immediately prevents ShipLog from accessing or refreshing your TikTok data. To request permanent deletion of your stored account data, tokens, and cached metrics from our database, please contact support@ahmedrashid.ca. All verified deletion requests are processed manually within 30 days.

2. We use AI

ShipLog uses artificial intelligence. When you use Review my ideas or Generate metric-backed ideas, we send your idea text, niche/audience settings, and synced TikTok metrics to Amazon Bedrock (Anthropic Claude models) so the response can be tailored to your channel. We may cache the model output for a short period to avoid repeating the same request. We do not use your data to train our own models.

3. We do not sell your data

ShipLog does not sell, rent, or trade your personal information or TikTok data to third parties. We do not share it for advertising or cross-context behavioral advertising.

4. Third-party data collectors

Third parties collect or process data when you use ShipLog, either because you sign in or connect an account with them, or because we use them to operate the product:

• GitHub and Google — identity and email when you sign in with their OAuth
• Supabase — authentication and session handling
• Amazon Web Services — hosting, private database storage, and Bedrock AI processing
• TikTok — Display API profile and video metrics when you connect your account

Those companies have their own privacy policies. We do not sell your data to them; we share only what is needed to provide the feature you used.

5. Private storage

User data is stored in a private PostgreSQL database on AWS. We do not put your ideas, tokens, profile data, or TikTok metrics in a public storage bucket or otherwise make them publicly downloadable. Access is limited to your signed-in account and the operators needed to run the service.

6. Cookies

We use a session cookie to keep you signed in and a short-lived cookie during TikTok OAuth to prevent CSRF. We do not use advertising or third-party tracking cookies.

7. Data deletion requests

To request deletion of your account and associated data, contact us at support@ahmedrashid.ca. We will delete your user-submitted content (including content ideas and profile text), stored tokens, profile data, TikTok metrics we cached, and AI cache entries within 30 days. Deleting your ShipLog data does not change anything on TikTok itself.

8. Children

ShipLog is not directed at children under 13, and we do not knowingly collect personal information from them.

9. Changes

We may update this policy from time to time. The effective date at the top of this page will change when we do. Continued use of ShipLog after an update constitutes acceptance of the revised policy.