Your information, clearly explained
Privacy Policy
At a glance. This policy covers the Zao website and its limited TikTok Sandbox workspace. Authorized target users can connect a test account and explicitly request a private video post. Authorization data and publishing records are stored on the server; selected video files are transferred temporarily through memory to TikTok, without a Zao video library. Public posting approval has not been obtained. Scheduling, bulk publishing, subscriptions, and payments are not offered.
1. Who operates Zao
Zao is a project operated by Mao Yongxiang at zao.helloyongxiang.com. For questions about personal information, contact helloyongxiang@gmail.com.
2. Information involved
- Technical request information. Our hosting and security provider, Cloudflare, processes information needed to deliver and protect the website. This can include your IP address, request time, requested URL, browser information, referrer, and security signals.
- TikTok authorization and identity. When you choose to connect an eligible Sandbox target account, TikTok's authorization flow provides an account identifier (open ID), display name, avatar, the permissions granted, and access and refresh tokens. Zao uses these tokens on the server to perform the authorized test flow. We do not ask for your TikTok password.
- Video and post details. Selecting a video first creates a local preview in your browser. After your explicit publishing confirmation, a video of up to 32 MiB, its caption, visibility, interaction choices, and applicable content disclosures are processed and sent to TikTok. The video passes through Cloudflare Worker memory for this transfer; Zao does not retain a stored video library.
- Publishing records. We store the connection between a browser session and its publishing requests, account identifiers, request fingerprints used to prevent duplicate submissions, publishing identifiers, file sizes, transfer progress, timestamps, status, and error information. The workflow may also receive post identifiers from TikTok where available.
- Contact correspondence. If you email us, we receive your email address, message contents, and any attachments you include. Please do not send account passwords, access tokens, identity documents, or information that is unnecessary for your request.
The calendar illustration on the homepage remains a design example. The separate Sandbox workspace makes real authorization and publishing requests when the relevant configuration is ready and an eligible tester chooses to proceed.
3. Why information is processed
Authorization and identity information identify the connected destination and let Zao carry out the actions you authorize. Video and post details are processed to submit the specific private post you confirm. Publishing records support status queries, duplicate-submission protection, error handling, and troubleshooting. Technical information protects the service, while contact information supports inquiries and privacy requests.
Where a legal basis is required, these activities rely on providing the test service you request, your authorization where applicable, our legitimate interests in operating a secure service and answering requests, or an applicable legal obligation. Browsing the website does not authorize a TikTok connection, video upload, or unrelated marketing.
5. Service providers and disclosures
We use Cloudflare Pages, Workers, and D1 to deliver the website, run the test workflow, and store server records. Cloudflare operates infrastructure in multiple countries, so information may be processed outside your country. See Cloudflare’s Privacy Policy for its services and practices.
TikTok processes the authorization you grant and receives the video and posting details you explicitly confirm for upload. TikTok's own terms, privacy practices, account settings, and content policies govern its processing and any resulting post. A private post is still sent to and stored by TikTok.
Our contact address is hosted by Gmail. If you email us, the email providers involved process your correspondence under their respective policies. We may also disclose information when legally required or reasonably necessary to address fraud, security incidents, or legal rights. We do not sell personal information or share it for targeted advertising.
6. Retention and security
TikTok identity data and access and refresh tokens are encrypted on the server in Cloudflare D1. HTTPS protects transfers, the session cookie is HttpOnly, and server-side authorization and CSRF checks restrict access to the current browser session. These safeguards reduce risk; no internet service can guarantee absolute security.
The selected video is used temporarily in Worker memory for the requested transfer and is not saved as a Zao video-library file. TikTok controls retention of any content it receives under its own practices and your account settings.
A browser session is valid for seven days; expiry does not by itself mean all corresponding server records are immediately deleted. Authorization, expired-session, publishing, and technical records may remain until operational or requested cleanup, as needed for the test service, security, troubleshooting, or legal obligations. This version does not promise an automatic fixed-period deletion schedule. You can request cleanup using the contact details below.
Provider-managed technical records follow provider practices and the settings in use. We retain contact correspondence as needed to answer requests, handle reasonable follow-up, or meet applicable legal requirements, and review information for deletion or minimization when it is no longer needed.
7. Connection controls and privacy requests
The workspace's Disconnect account action removes the stored authorization from the current browser session and attempts to revoke it with TikTok. The displayed result distinguishes a locally disconnected session from a revocation confirmed by TikTok. If remote revocation is not confirmed, you can remove Zao through TikTok's app-permission settings. This action does not delete TikTok posts or automatically remove historical Zao publishing records.
Depending on the laws that apply to you, you may have rights to request access, correction, deletion, restriction, portability, or to object to processing. For server-record cleanup or another privacy request, email helloyongxiang@gmail.com with the subject “Zao privacy request” and describe the information concerned. A publishing request ID or relevant date can help identify records; do not send tokens or passwords.
We may ask for proportionate information to verify that a request relates to you. Please do not send identity documents unless specifically needed through an appropriate channel. We will respond within the period required by applicable law; some records may need to be retained for legal reasons. You may also contact the data-protection authority available in your jurisdiction.
8. Intended audience
Zao is intended for adult creators and people working with publishing workflows. We do not knowingly solicit personal information from children. If you believe a child has sent information to us, contact us so that we can review and remove it where appropriate.
9. Policy changes and future services
This policy describes the limited Sandbox flow, not an approved public-posting, scheduling, or bulk-publishing service. Before introducing materially different processing, such as a retained video library, additional platforms, payments, or broader public service, we will update the policy and obtain any required authorization.
Updates will be published here with a revised date. Where a material change requires additional notice or consent, we will provide it as required by applicable law.
10. Contact
Mao Yongxiang · Zao
helloyongxiang@gmail.com