Splicersplicer.site

Privacy Policy

Last updated: 8 October 2026 · Domain: splicer.site

This policy applies to Splicer, the self-hosted service at splicer.site, operated by Nicolas Oreski. It is intended for TikTok Content Posting API review, Meta (Instagram) App Review and Google OAuth / YouTube App Review and describes how personal data is handled by Splicer.

1. Controller

Controller for personal data processed by Splicer:

Nicolas Oreski
Kirchensteig 14
2253 Weikendorf
Austria
Website: https://splicer.site
Email: nico.oreski@gmail.com

2. Purpose of processing

Splicer is a social media management tool. It allows you to connect social accounts, upload media, schedule and publish posts, and check publication status. Personal data is processed only to provide these features.

3. Categories of data

Splicer user account data (e.g. name, email, login credentials)
OAuth tokens and metadata for connected platform accounts (TikTok, Instagram, YouTube)
Media and post content you upload or schedule
Technical logs (IP address, timestamps, errors) as needed for operations and security

4. TikTok Content Posting API

Splicer can connect a TikTok account via TikTok Login Kit / OAuth so that the signed-in Splicer user can upload and publish videos they choose through the TikTok Content Posting API. Requested scopes are limited to user.info.basic, video.publish, and video.upload. Analytics / video-list access is not enabled.

For each connected TikTok account, Splicer stores only what is needed to keep the connection and publish status working:

OAuth access_token and refresh_token
TikTok open_id
token expiry fields (expires_in, refresh_expires_in)
posting metadata such as publish_id, publish status, and error codes returned by TikTok

Splicer does not store TikTok follower lists, analytics datasets, or video files returned by TikTok. Uploaded media is the content you provide in Splicer.

TikTok data is used only to authorize the connection and to upload/publish/check status for posts you initiate. It is not sold and is not used to train third-party AI models.

You may revoke access at any time:

in your TikTok account / connected-apps settings, and/or
by disconnecting the TikTok account inside Splicer.

After revocation or disconnect, stored TikTok OAuth tokens and related posting metadata for that connection are deleted or no longer used.

Use of TikTok APIs is also subject to TikTok’s terms and privacy policy for developers and end users.

5. Instagram (Meta Platform)

Splicer can connect an Instagram professional account (Business or Creator) via Business Login for Instagram (Instagram API with Instagram Login), or via Facebook Login for Instagram accounts linked to a Facebook Page, so that the signed-in Splicer user can publish and manage content on that account. Requested permissions are instagram_business_basic, instagram_business_content_publish, instagram_business_manage_comments, instagram_business_manage_messages, and instagram_business_manage_insights (Facebook Login path: instagram_basic, instagram_content_publish, instagram_manage_comments, instagram_manage_insights, pages_show_list, pages_read_engagement).

For each connected Instagram account, Splicer stores only what is needed to provide the features you use:

the Instagram account ID, username, display name, profile picture URL and follower count
the OAuth access token (encrypted at rest) and its expiry
metadata of posts you publish through Splicer (media IDs, publish status, error codes)
comments and direct messages on the connected account, received via Meta webhooks, so they can be read and answered in the Splicer inbox
account and post insights (e.g. reach, views, likes, comments, saves, shares) for the Splicer analytics view

Instagram data is used only to provide these Splicer features for the account owner. It is not sold, not shared with third parties other than Meta itself, and not used to train AI models.

You may revoke access and have your data deleted at any time:

by disconnecting the Instagram account inside Splicer – this revokes the app’s permission on Instagram and deletes the stored token, profile data, inbox messages, insights and posts that targeted only that account;
by removing the app in Instagram (Settings → Website permissions / Apps and websites) or in Facebook (Settings & privacy → Apps and websites) – Meta then notifies Splicer, which deletes the matching connected account and its data (anything that cannot be matched automatically is deleted manually within 30 days); you can also use “Send request” there to request data deletion and receive a confirmation code with a status link;
by emailing nico.oreski@gmail.com with your Instagram username – the data is deleted within 30 days and you receive a confirmation.

Use of Instagram APIs is also subject to the Meta Platform Terms and the Instagram Privacy Policy.

6. Google / YouTube API Services

Splicer uses Google OAuth and YouTube API Services to sign in and/or connect YouTube (and, where configured, other Google services). This may include basic profile information and the permissions required to schedule and publish content on your behalf.

Data obtained via Google/YouTube is used only to provide the Splicer features you authorize (connecting channels, uploading/scheduling videos including Shorts, status checks). It is not sold and is not used to train third-party AI models.

You may revoke access at any time:

in your Google Account security settings under third-party access, and/or
by disconnecting the account inside Splicer.

After revocation or disconnect, stored OAuth tokens and related cached platform data for that connection are deleted or no longer used.

Use of YouTube API Services is also subject to the YouTube Terms of Service and the Google Privacy Policy.

7. Legal bases

Where the GDPR applies: Art. 6(1)(b) (performance of a contract / use of Splicer), Art. 6(1)(a) (consent for OAuth grants), and Art. 6(1)(f) (legitimate interest in secure operation).

8. Retention

Data is retained while your account or connected integration exists, or as required by law. After account deletion or disconnecting an integration, related tokens and data that are no longer needed are removed.

9. Recipients / hosting

Splicer runs on a server operated by Nicolas Oreski (splicer.site). Platform APIs (TikTok, Meta/Instagram, Google/YouTube) receive data only within the scope of the OAuth permissions you grant.

10. Your rights

You may request access, rectification, erasure, restriction, and data portability, and may object to processing where applicable by law. You may lodge a complaint with a data protection supervisory authority.

11. Contact

Privacy requests: nico.oreski@gmail.com