Your TikTok account stays yours.
In short: we never see your password, we never post without you, we encrypt what we receive from TikTok and we delete videos after they go out.
You authorize on TikTok’s page
When you connect an account, we send you to TikTok’s official authorization page. You log in there and choose “Authorize”. TikTok returns a one-time code, which we exchange for an access token (valid for 24 hours) and a refresh token (valid for one year).
With them, OLO can only do what you approved: read the basic profile (name, photo), post videos and send drafts. It cannot read messages, followers or other videos.
user.info.basic- account name, photo and identifier
video.publish- direct posting, with the settings you choose
video.upload- sending drafts to the TikTok Inbox
Little data, locked well
Encryption
TikTok tokens are encrypted with AES-256-GCM, with a key kept apart from the database. OLO account passwords are stored only as scrypt hashes.
Secure connection
All traffic goes over HTTPS with HSTS. Pages use a strict Content Security Policy and protection against forged requests (CSRF).
Limited access
Only the people who run OLO can access the servers. The app runs as a separate user, with no rights over the rest of the server.
Automatic deletion
Videos are deleted 7 days after posting. Sessions expire after 30 days, the event log after 180.
No tracking
No analytics or advertising cookies. Fonts and files are served from our own server, not by third parties.
Rate limiting
Login, sign-up and password reset are limited per IP and per account, to stop password guessing.
Revoke access any time
In OLO: “TikTok accounts” → “Disconnect”. OLO deletes the tokens, cancels the posts scheduled on that account and asks TikTok to revoke access.
In the TikTok app: Profile → ☰ → Settings and privacy → Security and permissions → Apps and services permissions → OLO → Remove access.
You delete your OLO account in Settings, and you can download your data first, as JSON. Details on the Data deletion page.
Write to contact@olo.ro with the subject “OLO security”. We answer within two working days and take no action against people who report in good faith.
For the legal details, see the Privacy Policy and the Cookie Policy.