This policy explains what Sandy ("we", "us") collects when you use the Sandy website and service, why, how long it is kept, who it is shared with, and the choices you have. Sandy is a scheduler: it posts the videos and photos you approve to your own TikTok account at the time you choose.
Who we are
Sandy is run by the operator named on our Contact page, who is responsible for your information (the "controller"). You can reach us at our Contact page.
What we collect, and why
| Information | Why we need it |
|---|---|
| From Google: your name, email address and Google account ID. | To sign you in and keep your Sandy account. We ask Google for nothing else. |
| From TikTok: your TikTok account's ID for Sandy, display name and profile picture, the permissions you granted, and the access tokens TikTok gives us. | To show which TikTok account a post will go to, and to post to it, or send drafts to its inbox, when you have approved a post. |
| From TikTok, for each post: what your account can post right now (its privacy options, whether comments, duets and stitches are allowed, and the longest video it may post), and the post's status and ID once sent. | To show you the right choices on the Post to TikTok screen, to check again just before sending, and to show you what happened to each post. |
| What you upload: your videos and photos, their titles and descriptions, and the facts we read from the files (size, length, frame rate). | To send them to TikTok at the time you chose, and to check TikTok will accept them. |
| Your choices for each post: the time, the privacy setting, comments, duet and stitch, content disclosure, the AI-generated label, and when you approved it. | To post exactly as you approved, and to keep a record that you approved it. |
| A security log: when you sign in or out, connect or disconnect an account, approve a post, and when posts are sent. | To keep the service and your account secure and to help if something goes wrong. |
| Your internet address, briefly, in memory only. | To slow down repeated sign-in attempts and other abuse. It is never written to our database. |
We use this information only to provide Sandy to you. We do not sell it, we do not use it for advertising, we do not build profiles of you, and we do not use your content to train any AI system. The legal basis for using it is that it is needed to provide the service you asked for (performance of our contract with you), and, for the security log, our legitimate interest in keeping the service secure.
How we use TikTok
Sandy connects to TikTok through TikTok's official Login Kit and Content Posting API, with the permissions you grant on TikTok's own sign-in screen:
- user.info.basic: your display name and profile picture, shown so you know which account you are posting to.
- video.publish: to post the videos and photos you approve directly to your profile, with the settings you chose.
- video.upload: to send a post to your TikTok inbox as a draft, when you choose that, for you to finish in the TikTok app.
We use what TikTok gives us only to run Sandy for you. Your TikTok tokens are stored encrypted, and are deleted when you disconnect the account or delete your Sandy account. You can also remove Sandy's access from the TikTok app at any time, in your settings under Security, then Manage app permissions.
Who we share it with
We share information only with the services that make Sandy work, and only what each needs:
- TikTok receives the posts you approve, with your choices, and fetches the files from our site to post them.
- Google confirms who you are when you sign in.
- Cloudflare stores your uploaded files, privately, until they are deleted.
- Hostinger hosts our website and database.
We do not share your information with anyone else unless the law requires us to. Some of these providers may process information outside the United Kingdom; where they do, they protect it with safeguards the law recognises.
How long we keep it
- Uploaded files: deleted 7 days after the post is sent, fails or is withdrawn; files never used in a post are deleted after 2 days.
- Post records (text, choices and status): deleted 180 days after the post is finished.
- TikTok connections and tokens: until you disconnect the account or delete your Sandy account.
- Sign-in sessions: end after 7 days unused, and after 30 days at most.
- The security log: kept for one year. When you delete your account, its entries are no longer linked to you.
- Your Sandy account: until you delete it.
Your choices and rights
- Disconnect a TikTok account at any time on the TikTok page in Sandy.
- Delete your Sandy account at any time in Settings: your posts, files, connections and account are deleted straight away.
- You have the right to ask for a copy of your information, to have it corrected or deleted, to object to or restrict how we use it, and to take it elsewhere. Write to us and we will reply within one month.
- If you are unhappy with how we handle your information, you can complain to the data protection authority where you live; in the United Kingdom that is the Information Commissioner's Office (ico.org.uk).
Cookies
Sandy uses only the cookies it needs to work: one that keeps you signed in, and short-lived ones that protect each sign-in and each TikTok connection while it is in progress. We use no analytics, advertising or tracking cookies, so there is nothing to accept or refuse.
Security
Everything travels over an encrypted connection. Your TikTok tokens are encrypted when stored, sign-in sessions are stored only as one-way fingerprints, and your files are kept in private storage that only Sandy can read. If we ever learn of a breach that affects you, we will tell you and the authorities as the law requires.
Children
Sandy is for people aged 18 and over. We do not knowingly collect information from anyone younger.
Changes to this policy
If we change this policy, we will update the date at the top of this page, and tell you in Sandy before a significant change takes effect.
Contact
Questions about this policy or your information: our Contact page.