Privacy Policy

Last updated: December 19, 2025

This Privacy Policy describes how the privately hosted Postiz instance available at https://postiz.myavatar.website (“Service”) collects, uses, and protects information. The Service is operated for a single organization and is not a shared SaaS platform.

1. Information We Collect

We collect only the information that is required to deliver the Service:

• Account & workspace data: name, email address, organization, seat assignments, role metadata, and localization preferences for invited users.
• Content & scheduling data: media uploads, captions, drafts, calendars, analytics snapshots, and automation settings you create.
• TikTok API data: when you connect TikTok we request user.info.basic and user.info.profile through the TikTok Login Kit plus video.upload and video.publish through the TikTok Content Posting API. These scopes enable sign-in, display of your TikTok profile, and the upload/publish actions you schedule.
• System & security data: server logs, audit trails, and device/network information that help us detect abuse and maintain reliability.

2. How We Use Information

We use the collected information solely for the core functionality of the Service:

• Authenticating users, enforcing workspace permissions, and syncing channel connections.
• Preparing, uploading, publishing, and monitoring social posts on the platforms you link.
• Displaying analytics and operational telemetry so you can manage campaigns.
• Maintaining security, troubleshooting incidents, and complying with legal obligations.

We do not use your information for advertising, profiling unrelated audiences, or selling data.

3. TikTok Data Handling

TikTok data is processed only when you explicitly connect a TikTok account. Access tokens issued for the Login Kit and Content Posting API are stored exclusively within the self-hosted myavatar.website infrastructure, encrypted at rest, and never transmitted to third parties. Tokens are used only when performing the actions you request (authenticating, uploading a video, publishing a post, or retrieving status).

You can revoke TikTok access at any time by removing the integration inside the Service (“Integrations > TikTok”) or from TikTok’s security settings. Revoking access deletes the stored tokens and stops further processing.

4. Data Sharing

We do not sell, rent, or otherwise share your data with third parties. Data leaves the environment only when sent back to the same platform you connected (for example, uploading a video to TikTok or posting media to Meta) or when legally required.

5. Storage & Security

All data is stored within the infrastructure controlled by MyAvatar. We apply role-based access controls, container isolation, encrypted storage volumes, and network segmentation to protect information. Only administrators with a legitimate operational need can access service logs or encrypted secrets.

6. Retention & Deletion

Account and content data are retained while the workspace remains active. You may request deletion of specific assets—or your entire workspace—by emailing privacy@myavatar.website. Removing TikTok or any other integration immediately deletes the corresponding tokens.

7. Your Choices

• Update profile and notification preferences from within the Service.
• Disconnect TikTok or any other platform without assistance.
• Request access, correction, portability, or deletion by contacting us at privacy@myavatar.website. We respond promptly and honor applicable privacy regulations.

8. Changes to this Policy

We may revise this Policy to reflect platform changes or regulatory updates. The “Last updated” date will change when revisions are published, and material updates will be communicated to workspace owners.

9. Contact

Questions about this Policy can be sent to privacy@myavatar.website.