Privacy Policy

1. Who handles the information

URLPull is operated as an individually owned web application. The verified operator identity and functioning privacy contact must be confirmed before any TikTok review feature is deployed. Privacy and account-data requests may be directed to [email protected].

2. Information and purpose

• Tool requests: submitted URLs, requested operations, derived content metadata, and temporary output necessary to provide a requested result.
• Sessions and reliability: essential random session identifiers, usage limits, operational health, broad event categories, and error information needed for security, abuse prevention, support, and service operation.
• Account or transaction records: limited registration, entitlement, or billing information only when the corresponding account/payment feature is actually used and lawfully required.

We process this information to respond to your request, maintain secure sessions, apply quotas, protect other users, and meet applicable legal obligations. We do not treat a user-submitted URL as a grant to publish someone else's private data.

3. Proposed TikTok integrations: separate permissions

If a TikTok Sandbox Login Kit review is later enabled, URLPull redirects a reviewer to TikTok's official consent interface and asks for user.info.basic only. After authorization, the server may receive an application-specific account ID and display name to show which account authorized the demo. It does not request TikTok passwords, videos, messages, activity history, or account statistics. The review flow uses the OAuth authorization code and server-side token exchange; it immediately attempts to revoke the short-lived TikTok access grant after reading that basic identity. If revocation cannot be confirmed, the page tells the reviewer to check TikTok app permissions instead of claiming a fully completed review.

A future TikTok Data Portability integration would separately request portability.postsandprofile.single for the consenting user's own published video/photo posts (video data category only). That feature is not approved or publicly enabled, and no TikTok portability ZIP, MP4, JPG, direct messages, activity archives, or ongoing exports are obtained by this review journey. Actual eligibility, privacy controls, access, and retention will require separate provider approval and real-user end-to-end verification.

4. Cookies, retention, and deletion

Ordinary tools may use an essential, HTTP-only session cookie and temporary processing storage subject to operational cleanup and contractual/legal retention requirements. Duration varies by data type and operation; a file being returned does not mean it is retained permanently.

For the optional TikTok Login Kit review, a Secure, HTTP-only, same-site browser session cookie expires within 15 minutes; the server stores only SHA-256 digests of one-time CSRF state and session actor, with a five-minute authorization deadline. A successfully completed reviewer identity is held only in an encrypted, HTTP-only browser cookie for up to 10 minutes or until it is cleared. No TikTok access/refresh token, auth code, TikTok ID, or account profile is intentionally persisted in the review database, and no export media is transferred by this flow. The review page provides a clear-session action; expired state metadata is purged from the review store.

5. Security and recipients

URLPull uses HTTPS, strict server-side authority, bounded URL/network requests, access controls, and time-limited delivery paths where supported. No online service can guarantee perfect security. URLPull may need infrastructure, security, and payment processors for relevant features, and TikTok processes its own Login Kit consent and API requests under TikTok's policies. A verified production subprocessor list and data-transfer arrangements remain an operator prerequisite before provider review or launch.

6. Your choices and rights

Depending on your location and applicable law, you may request access, correction, deletion, restriction, objection, or portability of personal data, and withdraw consent where consent is the legal basis. You may decline TikTok authorization, clear the review session, or revoke URLPull from TikTok account permissions. Contact us at [email protected]for help with available choices and requests. Follow our Data Deletion instructions and contact guide for safe request details. We may need to verify ownership without requesting a TikTok password and may retain records only when legally required.

7. Changes

We will update the date and description if actual functionality, recipients, or retention practices change. A proposed or locally tested provider integration is not a statement of approval or general availability. For service-use conditions, read the Terms of Service.