Privacy Policy

Effective date: August 31, 2026

1. Introduction

This Privacy Policy explains how Slipstream ("Slipstream", "we", "us") collects, uses, and protects information when you use our service at slipstream.jakedami.co. Slipstream is an independent tool operated by Jake D'Amico that lets you send your own prepared content (videos and photos) to your TikTok inbox as drafts, using TikTok's official Content Posting API. You review and publish your content yourself, inside TikTok. By using Slipstream, you agree to the practices described in this policy.

2. Information we collect

TikTok account information. When you connect your TikTok account through TikTok's official login (OAuth), TikTok provides us with your basic public profile: an account identifier, your display name, and your avatar image. We request only the user.info.basic and video.upload permissions — never permission to post on your behalf, read your messages, or access your followers.
Access tokens. TikTok issues an access token that authorizes Slipstream to create drafts for your account. Tokens are stored in your own browser's local storage, not in a server-side database. Tokens pass through our server only transiently, to sign requests to TikTok's API, and are not retained there.
Content you upload. Media files and captions you submit are transmitted through our infrastructure to TikTok in order to create your draft. We do not keep copies of your content after the transfer to TikTok completes.
Technical and log data. Like most web services, our hosting provider (Cloudflare) processes standard technical data when you use the site — such as IP address, browser type, and request timestamps — for security, abuse prevention, and service operation. We do not use third-party analytics, advertising trackers, or marketing cookies.

3. How we use information

We use the information above solely to:

Provide the service — authenticate you with TikTok, transfer your content, and show you the status of your uploads;
Maintain the security and integrity of the service, including preventing abuse and unauthorized access;
Comply with legal obligations and TikTok's developer policies.

We do not use your information or content for advertising, profiling, model training, or any purpose unrelated to operating Slipstream.

4. Legal bases for processing

Where laws such as the EU/UK General Data Protection Regulation (GDPR) apply, we process your information on the following bases: performance of a contract (providing the service you request), and our legitimate interests in keeping the service secure and operational.

5. How we share information

TikTok. Your content and the associated API requests are sent to TikTok to create drafts on your account. TikTok's handling of your data is governed by TikTok's Privacy Policy.
Service providers. We use Cloudflare to host the website and API. Cloudflare processes technical data on our behalf as a hosting provider.
Legal requirements. We may disclose information if required to do so by law or valid legal process.

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

6. Data retention

Access tokens remain in your browser until you disconnect Slipstream or clear your browser storage. Tokens also expire on TikTok's schedule.
Uploaded media is not retained after it has been delivered to TikTok.
Operational logs held by our hosting provider are transient and kept only as long as needed for security and troubleshooting.

7. Security

All traffic to and from Slipstream is encrypted in transit using HTTPS. API credentials are stored as server-side secrets, never exposed to the browser. Because tokens live in your own browser rather than a central database, there is no server-side store of user credentials to breach. No method of transmission or storage is 100% secure, but we design the service to hold as little of your data as possible.

8. Your rights and choices

Revoke access at any time. In the TikTok app, go to Settings → Security & permissions → Manage app permissions and remove Slipstream. This immediately revokes our access to your account.
Delete local data. Clearing your browser's storage for this site removes all tokens and settings held locally.
Access, correction, deletion. Because we do not maintain a server-side database of user data, there is generally nothing for us to retrieve or delete beyond what is described above — but you may contact us at any time to ask questions or exercise rights available to you under applicable law (including the GDPR and the California Consumer Privacy Act). We will respond within the timelines the law requires.

9. Children's privacy

Slipstream is not directed to children and may not be used by anyone under the age of 13 (or the higher minimum age required in your jurisdiction). We do not knowingly collect information from children. If you believe a child has used the service, contact us and we will take appropriate action.

10. International users

Slipstream is operated from the United States, and Cloudflare serves the site from data centers around the world. By using the service, you understand that your information is processed in the United States and other jurisdictions where our providers operate, which may have different data-protection laws than your own.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date above. Material changes will be noted on this page. Your continued use of the service after a change takes effect constitutes acceptance of the updated policy.

12. Contact

Questions or requests about this policy: jake@jakedami.co