Privacy Policy

1. Information we collect

Account

You sign in with GitHub or Google through Supabase Auth. We store your provider user id and email address, and keep a signed session cookie so you stay logged in.

Profile and ideas

If you provide them, we store a display name, content niches, a target audience description, and the content ideas you add, edit, or check off in the workspace.

TikTok API data (read-only)

If you connect TikTok, we request read-only Display API access with the scopes user.info.basic, user.info.profile, user.info.stats, and video.list. We store:

• Avatar, display name, username, bio, profile link, and verification status
• Follower, following, like, and video counts
• Video titles, descriptions, duration, create time, and performance metrics (views, likes, comments, shares)
• OAuth access and refresh tokens so we can sync metrics on your behalf

We do not post, edit, or delete content on TikTok. Access is limited to reading the profile and video metrics needed to ground AI suggestions in your own performance data.

Users may revoke ShipLog's access at any time through their TikTok account security settings, which immediately prevents ShipLog from accessing or refreshing your TikTok data. To request permanent deletion of your stored account data, tokens, and cached metrics from our database, please contact support@ahmedrashid.ca. All verified deletion requests are processed manually within 30 days.

2. We use AI

ShipLog uses artificial intelligence. When you use Review my ideas or Generate metric-backed ideas, we send your idea text, niche/audience settings, and synced TikTok metrics to Amazon Bedrock (Anthropic Claude models) so the response can be tailored to your channel. We may cache the model output for a short period to avoid repeating the same request. We do not use your data to train our own models.

3. We do not sell your data

ShipLog does not sell, rent, or trade your personal information or TikTok data to third parties. We do not share it for advertising or cross-context behavioral advertising.

4. Third-party data collectors

Third parties collect or process data when you use ShipLog, either because you sign in or connect an account with them, or because we use them to operate the product:

• GitHub and Google — identity and email when you sign in with their OAuth
• Supabase — authentication and session handling
• Amazon Web Services — hosting, private database storage, and Bedrock AI processing
• TikTok — Display API profile and video metrics when you connect your account
• PostHog — product analytics and error reports, used so we can see how ShipLog is used and fix problems while we develop the product

When product analytics is enabled, the PostHog script in your browser and our server send usage and error events to PostHog. Those events can include your account id and email when you are signed in, the pages and features you use, and error reports. Text shown in the app, including idea text on screen, can be included in browser events. We use this to understand how ShipLog is used and to fix problems while we develop the product. We do not use PostHog for advertising. PostHog's policy is at posthog.com/privacy.

Those companies have their own privacy policies. We do not sell your data to them; we share only what is needed to provide the feature you used.

5. Private storage

User data is stored in a private PostgreSQL database on AWS. We do not put your ideas, tokens, profile data, or TikTok metrics in a public storage bucket or otherwise make them publicly downloadable. Access is limited to your signed-in account and the operators needed to run the service.

6. Cookies

We use a session cookie to keep you signed in and a short-lived cookie during TikTok OAuth to prevent CSRF. When PostHog is enabled, it may also store an identifier in a first-party cookie or in local storage so the same browser can be recognized across visits. We do not use advertising cookies.

7. Data deletion requests

To request deletion of your account and associated data, contact us at support@ahmedrashid.ca. We will delete your user-submitted content (including content ideas and profile text), stored tokens, profile data, TikTok metrics we cached, and AI cache entries within 30 days. That covers data stored in ShipLog's database. Usage events already sent to PostHog are held by PostHog; contact us at the same address if you also want those removed. Deleting your ShipLog data does not change anything on TikTok itself.

8. Children

ShipLog is not directed at children under 13, and we do not knowingly collect personal information from them.

9. Changes

We may update this policy from time to time. The effective date at the top of this page will change when we do. Continued use of ShipLog after an update constitutes acceptance of the revised policy.