Privacy Policy

This Privacy Policy explains how LoopCash ("we", "us", "our") collects, uses, stores, and shares information when you use our AI-powered TikTok automation service at loopcash.polsia.app. By creating an account or connecting your TikTok profile, you agree to the practices described below.

1. Information We Collect

When you create an account and use LoopCash, we collect the following information:

• Account credentials — your email address and a bcrypt password hash (we never store your password in plain text).
• Niche selection — the content niche you choose during onboarding (e.g. personal finance, fitness, motivation). This drives script generation and topic targeting.
• TikTok OAuth data — if you connect your TikTok account, we store your open_id, access_token, refresh_token, granted scope, and your TikTok display handle in the users table.
• Payment information — Stripe payment intent ID for your $1 activation fee and subscription records for premium add-ons. LoopCash does not store full credit card numbers, CVC codes, or expiration dates. All sensitive payment data is handled directly by Stripe.
• Server logs — anonymized ip_hash values (SHA-256 with a server-side salt, truncated to 16 hex chars), request paths, user-agent strings, and referrers, captured by middleware/request-logger.js to power the /admin/analytics dashboard. We never store raw IP addresses.
• Support communications — any messages you send to support@loopcash.polsia.app.

2. How We Use Your TikTok Data

Your TikTok OAuth tokens are used exclusively by our background posting worker in services/tiktok-worker.js to publish rendered videos to your connected TikTok account via the official TikTok Content Posting API using the PULL_FROM_URL upload method.

Specifically, we use the tokens to:

• Initialize video uploads (video.upload scope).
• Publish rendered vertical MP4s as scheduled posts (video.publish scope).
• Refresh expired tokens using the stored refresh token (valid for 1 year per TikTok).

We never sell, rent, or share your TikTok data with any third party other than TikTok itself. We do not use your TikTok account data for advertising, retargeting, or any purpose unrelated to operating the LoopCash service.

3. AI-Generated Content

LoopCash produces two categories of AI-generated content, both stored on your behalf:

• Scripts — short-form video scripts generated by OpenAI's GPT-4o-mini model via the Polsia OpenAI proxy. Scripts are stored in the scripts table linked to your user account.
• Rendered videos — 1080×1920 vertical MP4 files composed of AI-generated voiceover (OpenAI tts-1 with the onyx voice), script text overlays, and background visuals. Rendered via FFmpeg (@ffmpeg-installer/ffmpeg) and stored in Polsia's Cloudflare R2 bucket.

You retain full ownership of every script and rendered video generated through your account. LoopCash receives only a limited, non-exclusive license to publish those videos on your connected TikTok account on the schedule you configure. See our Terms of Service for the full license grant.

OpenAI's API data usage policy applies: prompts and outputs may be retained by OpenAI for abuse monitoring for up to 30 days, after which they are deleted. OpenAI does not use API data to train models.

4. Payment Processing

All payments are processed by Stripe. LoopCash stores only the minimum metadata needed to verify a successful charge and to issue refunds:

• Stripe payment intent ID (column: users.stripe_payment_intent_id)
• Activation timestamp (column: users.activation_paid_at)
• Refund status (column: users.activation_refund_status): pending, connected, refunded, or skipped
• Stripe session IDs for any active premium add-on subscriptions

We do not see, receive, or store your full card number, CVV, expiration date, or billing address. These details are entered directly into Stripe Checkout / Stripe Elements and handled by Stripe under their own privacy policy.

5. Cookies & Sessions

LoopCash uses one cookie: connect.sid, which holds your express-session ID. This session is stored server-side in the session table (PostgreSQL, via connect-pg-simple) so it persists across restarts.

Cookie attributes (configured in server.js):

• HttpOnly — inaccessible to JavaScript, mitigating XSS-driven session theft.
• SameSite=Lax — prevents cross-site request forgery on state-changing endpoints.
• Secure — sent over HTTPS only when NODE_ENV=production.
• MaxAge — 30 days; the session is renewed on each login.

We do not use third-party advertising cookies, retargeting pixels that read personally identifiable information, or cross-site tracking cookies. The Meta Pixel (ID 890040604089076) and the Polsia Analytics beacon are both first-party and used solely to measure traffic to and conversions on LoopCash.

6. Data Retention & Deletion

We retain your account data for as long as your account is active, plus 30 days afterwards to allow recovery in case of accidental deletion. After that window:

• Your account record is anonymized so that aggregated analytics remain coherent.
• Your TikTok OAuth tokens are revoked by us and purged from the users table immediately upon deletion.
• Generated scripts and rendered videos in scripts / videos tables remain associated with the anonymized user record so that any third-party platform distributions (e.g. a published TikTok video) are not orphaned.
• Analytics records (page_views) are retained for 90 days, then rotated out.

To request account deletion, email support@loopcash.polsia.app from the address associated with your account. We will complete the deletion within 30 days and send confirmation.

7. Your Rights

You have the right to:

• Access — request a copy of all personal data we hold about you.
• Correction — update or correct any inaccurate information.
• Deletion — request permanent deletion of your account and associated data.
• Export — receive a portable copy of your scripts, generated video URLs, and account metadata.
• Disconnect TikTok at any time — from your dashboard or by revoking LoopCash's access at tiktok.com/settings/manage-app.

To exercise any of these rights, email support@loopcash.polsia.app. We respond to all verified requests within 30 days.

8. Children's Privacy

LoopCash is not directed at children under 18. TikTok itself requires users to be at least 13 (and in some jurisdictions 18+), and our service only adds capabilities on top of an existing TikTok account. We do not knowingly collect information from anyone under 18. If we learn we have, we will delete the account and purge the data within 7 days.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the revised policy at this same URL (/privacy) and update the "Last updated" date above. For material changes — anything that meaningfully expands the data we collect, the purposes we use it for, or the parties we share it with — we will also email active users at least 14 days before the change takes effect.

10. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or how your data is handled, please contact us:

• Email: support@loopcash.polsia.app
• Entity: LoopCash