Clear access. Considered safeguards.

Access starts with the account owner.

The live connection is designed around TikTok’s official account-holder OAuth flow. After creating a Stillkind account, the owner is redirected to TikTok to review the permissions. Stillkind never asks for the TikTok account password.

Our requested capabilities are limited to the product: account identification, listing owned videos and comments, and hiding or restoring comments. We do not need permissions to publish videos, send direct messages, manage ads or follow other users for this product. Exact access is determined by the permissions TikTok approves.

• TikTok Accounts API authorization documentation

Boundaries for the integration.

Stillkind operates on the connected creator’s own account and the comments the approved API makes available. We do not scrape TikTok, request account passwords, sell TikTok data or use creator data for a discovery or ranking marketplace.

No video or audio files are sent to the AI classifier. The classifier uses comment text, the commenter’s username, internal identifiers and the associated video caption.

• TikTok’s permitted Accounts API uses

Safeguards in the current implementation.

Account data is scoped to the authenticated user. Access and refresh tokens are encrypted at application level using AES-256-GCM. Application passwords are hashed with scrypt; stored sessions use hashed random tokens.

Production sessions use HttpOnly, Secure and SameSite cookies. The frontend calls a separate authenticated backend. API credentials stay on the server and are not included in browser code.

These are implementation details, not an independent security certification. We do not claim a completed external security audit, SOC 2 certification or guaranteed uninterrupted service.

AI assists. Creators review.

The current classifier uses OpenAI’s API and returns a suggested action, category and confidence score. A confidence score is a model output, not a measured accuracy guarantee. Only hide decisions above the configured threshold are eligible for automatic action; uncertain comments are kept.

The dashboard exposes moderation history and restore requests. Users should review results, especially in sensitive contexts. TikTok’s own moderation or account restrictions can prevent restoration.

• Privacy notice and provider details

Disconnecting and reporting a concern.

An account owner can revoke Stillkind’s authorization in TikTok’s connected-app settings. Revocation stops the authorization but does not itself erase records already held by Stillkind. A separate deletion request removes eligible stored records.

For a suspected security issue, contact the operator using the contact page. Describe the affected feature and time of the incident. Do not send passwords, access tokens or other people’s private data.

• Contact & support
• Data deletion instructions