Privacy Policy

Last updated: August 13, 2026

1. Introduction

Social Studio ("the Service") is an Obsidian plugin for cross-platform content publishing. This Privacy Policy explains how we handle your data. The Service is designed with a local-first, privacy-preserving architecture.

2. Data We Do Not Collect

• We do not collect, store, or transmit your personal data to any server.
• We do not use analytics, tracking, or telemetry.
• We do not sell or share your data with any third party.
• We do not have a backend server. The Service runs entirely within Obsidian on your device.

3. Data Stored Locally

The following data is stored locally on your device within Obsidian's encrypted SecretStorage:

• Platform credentials: API keys, client secrets, and OAuth tokens required to publish to third-party platforms.
• TikTok OAuth token: Access token, refresh token, open_id, and scope — stored under the key tiktok-token in SecretStorage.
• TikTok PKCE verifier: Temporary code verifier used only during the OAuth2 authorization flow, cleared immediately after token exchange.
• User preferences: Theme selections, platform configurations, and publishing settings — stored in Obsidian's plugin settings (not in SecretStorage).
• Publishing history: Local records of successful and failed publishing attempts.

All data remains on your device and is never transmitted to any server controlled by the Service developers.

4. Third-Party Platforms

When you publish content to a third-party platform (e.g., TikTok, YouTube, WeChat), that platform's privacy policy applies to the data you send to them. We encourage you to review the privacy policies of each platform you use.

5. TikTok Data Handling

When you use the TikTok integration, the following data is transmitted to TikTok's API for the purpose of publishing your content:

• OAuth2 authorization: Your TikTok authorization code is exchanged for an access token via TikTok's OAuth2 endpoint. This exchange happens directly between your device and TikTok's servers.
• Creator info query: The Service queries TikTok's creator_info API to retrieve your creator nickname, avatar URL, privacy level options, interaction settings, and maximum video post duration. This information is displayed in the pre-publish confirmation modal and is not stored beyond the modal session.
• Video file: The video file you select is uploaded directly to TikTok's servers via the Content Posting API.
• Post metadata: Title, privacy level, interaction settings (comment/duet/stitch), and commercial content declarations (brand_organic_toggle, brand_content_toggle) are transmitted to TikTok as part of the publish request.
• Post status: The Service polls TikTok's API to check the processing status of your published video. The resulting publish ID and status are stored locally for your reference.

The Service does not transmit any data to TikTok without your explicit confirmation through the pre-publish modal. No data is transmitted to any server controlled by the Service developers at any point during the TikTok publishing flow.

6. OAuth2 Authentication

For platforms that support OAuth2 (e.g., TikTok, YouTube), the Service:

• Redirects you to the platform's authorization page in your browser.
• Uses PKCE (Proof Key for Code Exchange) for TikTok to prevent authorization code interception attacks.
• Receives an authorization code, which is exchanged for an access token.
• Stores the access token locally in Obsidian's encrypted SecretStorage.
• Uses the token only to perform publishing actions on your behalf.
• Automatically refreshes expired tokens when possible, without requiring re-authorization.

7. Data Security

• Credentials are stored using Obsidian's built-in encrypted SecretStorage mechanism.
• All API communications use HTTPS encryption.
• Network requests are restricted by a security policy with URL allowlist.
• No data is transmitted to any server controlled by the Service developers.
• The Service is open-source, allowing full audit of data handling practices.

8. Open Source

Social Studio is open-source software. You can review the source code at our GitHub repository to verify our data handling practices.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Continued use of the Service after changes constitutes acceptance of the new policy.

10. Contact

For questions about this Privacy Policy, please open an issue on our GitHub repository.