Privacy Policy | Rewire Labs Scheduler

Who we are

Rewire Labs Scheduler (scheduler.rewirelabs.app, "the service") is operated by Monish Meher, trading as Meher Technologies (sole proprietorship), Gottfriedstraße 7, 90478 Nuremberg, Germany. We are the controller of your personal data under the EU General Data Protection Regulation (GDPR).

For anything about your data, email connect@rewirelabs.app.

What we collect and why

Your account

Email address. We use it to sign you in. There are no passwords: we email you a one-time sign-in link. We also use it to tell you when a scheduled post fails and to tell you about significant changes to this policy or our terms.
Role. Whether your account is a regular account or an admin account.
Time zone and world clock. Your own time zone and the extra time zones you choose to show next to every time.

Cookies and local storage

When you sign in we set one strictly necessary cookie, rs_session. It is HttpOnly (scripts on the page can't read it) and keeps you signed in for 30 days, or until you sign out. On our server we keep only a hash of it, with its start and expiry time. Because it's needed to provide the service you asked for, it doesn't require consent (§ 25 (2) no. 2 TDDDG).
The website and the app use no analytics, no advertising and no tracking cookies. Our pages load their scripts and fonts from our own domain only.
Your theme choice (light or dark) is saved in your browser's local storage and is not sent to us.

Connected TikTok accounts

When you connect a TikTok account, you sign in with TikTok (TikTok Login Kit) and approve access on TikTok's own screen. We ask for two scopes: user.info.basic, through which we receive your basic profile, and video.publish, so we can publish the posts you schedule. We store:

your TikTok open_id (an identifier TikTok issues for our app), display name and avatar image. We save a copy of the avatar on our server, so our pages never load images from TikTok;
your access and refresh tokens, encrypted at rest with AES-256-GCM;
the scopes you granted and when the tokens expire.

Posts you schedule

When you write a post, we store:

the media you upload (videos and images) and the original file names. Images are converted to JPEG and resized to fit TikTok's limits, which also removes their embedded metadata, such as location. Videos are stored as you upload them;
the caption and title;
the settings you choose: privacy level, whether comments, Duet and Stitch are allowed, the commercial-content disclosure, auto-add music, the cover, and the AI-generated label;
the scheduled time and time zone, your own series and reference labels, the post's status history and any error messages, and the publish ids and links TikTok returns.

Before you post, we ask TikTok for your creator info (nickname, avatar, which privacy options and interactions your account allows, and the maximum video length) and show it to you. We don't keep it beyond what's needed to post.

So that TikTok can fetch your media when it publishes, each uploaded file is served from a long, random, unguessable link on our domain. Anyone who has that exact link can open the file until it's deleted.

API keys

If you create API keys, we store each key's name, a hash of the key and its first 10 characters (so you can recognise it), and when it was created and last used. The full key is shown to you once and is never stored.

Technical data

Your IP address is used briefly in memory to limit sign-in attempts (rate limiting), and it appears in our server logs, which are kept for up to 14 days. For sign-in links we store a hash of the link's token, your email address and the expiry time.

Admin-only Buffer connection

Rewire Labs uses Buffer to post to its own TikTok account. This connection is only available to admin accounts. Other users' data is never sent to Buffer.

How we use TikTok data

We use the data we receive from TikTok only to show you which account a post goes to and to publish the content you scheduled, with the settings you chose, at the time you chose, and to show you whether publishing worked.

We never sell it, never use it for advertising, never use it to train AI models, and never share it with anyone except TikTok, to publish your post.

Who receives your data

We use these service providers:

Hetzner Online GmbH (Germany) hosts our server, which is located in Ashburn, Virginia, USA.
Resend (USA) sends our emails: sign-in links and post-failure notices. It receives your email address and the content of those emails.
TikTok receives your media and post settings when your post is published, and processes them under TikTok's own privacy policy.
Cloudflare (USA) provides DNS for our domain and forwards email sent to connect@rewirelabs.app, so it processes the emails you send us.
Buffer (USA): admin accounts only, as described above.

We don't sell personal data. We disclose it to authorities only where the law obliges us to.

International transfers

Your data is stored on our server in the USA. Transfers of personal data to the USA rely on the EU–US Data Privacy Framework or on the European Commission's Standard Contractual Clauses, as offered by each provider.

How long we keep data

Account data: until you delete your account.
Sign-in sessions: 30 days, or until you sign out.
Sign-in links: expire after 15 minutes and work only once.
Posts (captions, settings, status history): until you delete the post, disconnect the account it belongs to, or delete your account.
Uploaded media: deleted automatically 14 days after the post is published or finally fails, and immediately when you disconnect the account or delete your account.
TikTok tokens: deleted when you disconnect the account or delete your account. We then also ask TikTok to revoke them.
API keys: a revoked key stops working at once; its record is deleted with your account.
Server logs: up to 14 days.
Database backups: kept for 7 days on a rolling basis, so data you delete disappears from backups within 7 days.

Legal bases

Art. 6 (1) (b) GDPR, contract: to provide the service you signed up for: your account and sign-in, connecting TikTok accounts, storing and publishing your posts, and emails about them.
Art. 6 (1) (f) GDPR, legitimate interests: to keep the service secure and available, through rate limiting, server logs and backups.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to object to processing based on legitimate interests, and to data portability (a copy of your data in a common, machine-readable format).

You can withdraw TikTok access at any time: disconnect the account in the app (Accounts → Disconnect), or remove the app's access in TikTok's settings.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the one where you live or the one responsible for us: the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA) in Ansbach, Germany.

To use your rights, email connect@rewirelabs.app, ideally from your account's email address. We answer within 30 days. The quickest way to delete your data is described on How to delete your data.

Children

The service is for people aged 18 and older. We don't knowingly collect data from anyone younger. If you think a child has signed up, tell us and we'll delete the account.

Security

HTTPS everywhere.
TikTok tokens encrypted at rest with AES-256-GCM.
API keys, session cookies and sign-in links stored only as hashes.
Access to the server and the database only by the operator.

We don't make automated decisions about you that have legal or similarly significant effects, and we don't profile you.

Changes to this policy

When we change this policy, we post the new version here and update the date at the top. If a change is significant, we also email account holders.