Privacy Policy
In short: Soc_bot is a desktop application that runs on your own computer. It stores its data locally on that computer. It sends your content to the platforms you choose to publish to, through their official APIs, and, for Instagram only, to the temporary media storage you configure (see section 4). The Soc_bot project runs no servers, receives none of your data, and does not sell data or use analytics or tracking.
1. How Soc_bot works
Soc_bot is a desktop application that allows users to publish their own prepared content to connected social media accounts using official platform APIs. You install and run it yourself. Soc_bot has no user accounts of its own and no cloud service. The Soc_bot developers cannot see anything you do with it.
2. Connecting accounts (OAuth)
You connect TikTok, YouTube or Instagram accounts through each platform's official authorization page (OAuth), opened in your web browser. Soc_bot never asks for or stores your platform passwords. After you approve access, the platform gives Soc_bot an access token, and on TikTok and YouTube also a refresh token, so it can publish on your behalf.
Soc_bot only requests the permissions it needs to identify your account and publish videos, for example TikTok's user.info.basic and video.publish.
3. What Soc_bot stores on your computer
Soc_bot keeps its data in a local database file on your computer (by default data/publisher.db in the Soc_bot folder). It stores:
- Account information needed for publishing: the platform, the account or channel ID the platform provides (for example TikTok's open_id), your username or display name, the permissions (scopes) you granted, and when the access token expires.
- OAuth tokens: access and refresh tokens are encrypted (Fernet symmetric encryption) with a key kept in your local configuration file (
.env). The rest of the database is not encrypted. - Publishing records: the location of your video file and of any cover image, the caption, the publishing options you chose (such as privacy level or title), the IDs the platforms return for uploaded posts, the status of each upload, and error messages. Soc_bot removes token-like text from error messages before storing them.
- Settings: your publishing profile (which of your connected accounts to publish to, and your options). It holds account references only, never tokens.
Your videos, captions and cover images stay in the folders where you put them. Soc_bot reads them locally to publish them. It does not copy them to any server of its own, and it does not re-encode your videos.
4. What Soc_bot sends to platforms
Soc_bot only connects to the official services of the platforms you use: TikTok (tiktok.com, tiktokapis.com), Google/YouTube (accounts.google.com, googleapis.com) and Instagram (instagram.com). It sends them:
- the authorization requests and tokens needed to act on your connected account;
- the videos, captions, titles, privacy settings and (YouTube only) cover images you choose to publish;
- status checks for uploads, and read-only account queries such as TikTok's creator information, which lists the privacy options available to you.
Instagram media delivery. Instagram only accepts videos it can download from a web address, so for Instagram Soc_bot first uploads the video to temporary storage that you configure, gives Instagram a temporary link, and deletes the copy after the publishing attempt. In automatic mode, Soc_bot chooses by file size (TempFile.org for smaller videos, your S3 bucket for larger ones) and shows which one it will use before you confirm:
- Your own S3-compatible bucket (for example AWS S3 or Cloudflare R2): the bucket stays private and Instagram gets a link that expires (15 minutes by default).
- TempFile.org (optional): a public third-party file host. While the copy exists (by default at most 1 hour; Soc_bot deletes it after publishing), anyone who has its link can download it. TempFile.org processes the upload under its own privacy policy.
- 0x0.st (optional): a public third-party file host run by an individual in Germany. While the copy exists (by default at most 1 hour), anyone who has its link can download it, and 0x0.st records the uploader's IP address and user agent under its own privacy policy. Only choose it if that is acceptable for your video.
Those platforms then process your data under their own privacy policies: TikTok, Google/YouTube (also the YouTube Terms of Service) and Instagram/Meta.
5. What Soc_bot does not do
- It does not sell, rent or share your data with anyone other than the platforms you publish to.
- It does not include analytics, advertising, telemetry or tracking.
- It does not intentionally collect personal information unrelated to publishing your content.
- It does not send your data to the Soc_bot developers, or to any server other than the platforms you publish to and the Instagram media storage you configure.
6. Disconnecting accounts and deleting data
- Disconnect in Soc_bot: Connected Accounts → Disconnect Account marks the account as disconnected so it is no longer used for publishing. For TikTok and YouTube, Soc_bot also asks the platform to revoke its access. Instagram does not offer this through its API, so for Instagram remove access in Instagram's settings (Apps and websites).
- Stored tokens: disconnecting does not currently delete the encrypted tokens or the publishing history from the local database.
- Delete everything: to remove all stored data, including tokens and history, delete the Soc_bot database file (by default
data/publisher.db). You can also revoke Soc_bot's access at any time in each platform's own account settings.
Soc_bot does not delete data automatically. Your data stays on your computer until you remove it.
7. Security
OAuth tokens are encrypted in the database, and the encryption key is kept outside the database in your local configuration file. The authorization callback listens only on your own computer (127.0.0.1). However, the security of this data also depends on your computer: anyone with access to your user account and to both the database and the configuration file could read the stored tokens. Keep your computer and the Soc_bot folder secure, and do not share your .env file.
No software is perfectly secure. If you find a security problem, please report it privately to ayushruchal83@gmail.com rather than in a public issue.
8. Children
Soc_bot is not directed at children. You must meet the minimum age requirements of each platform you connect.
9. Changes to this policy
This policy may be updated when Soc_bot changes. The effective date above shows when it last changed.
10. Contact
Privacy questions: ayushruchal83@gmail.com