This policy covers mcp-studio (the “tool”), a desktop tool that posts videos to your own TikTok account. It is separate from the privacy policy for this website, which describes what abd3lraouf.dev collects when you read it — a different question with a different answer.
1. Who is responsible
The controller of any personal data described here is Abdelraouf Sabri, an individual trading as Abdelraouf Studios in Egypt. The contact form reaches the person who wrote the tool, including for every request in section 7.
2. What it integrates with
mcp-studio is an independent tool that uses TikTok’s public developer APIs. It is not affiliated with, endorsed by, or operated by TikTok or ByteDance. Two TikTok products are used:
- Login Kit — so you can authorise the tool against your own TikTok account and revoke it whenever you like.
- Content Posting API — so a video you choose can be uploaded to that account.
Your use of TikTok itself remains governed by TikTok’s own terms and privacy policy. This tool cannot change them and does not sit between you and them.
3. What TikTok data it handles, and why
Only what the composer needs to show you before you press Post:
- Access and refresh tokens, issued by TikTok when you authorise the tool. They are what let it call TikTok on your behalf. Without them there is no integration.
- Your creator profile — nickname, username and avatar URL — so the composer can show which account is about to receive the post. Posting to the wrong account is the mistake this display exists to prevent.
- Your posting settings — the audience options your account offers, whether comments, Duet or Stitch are switched off, and your maximum video length. TikTok requires the composer to reflect these rather than guess them.
- The video and caption you choose, which are sent to TikTok to be posted, and the
publish_idTikTok returns so the tool can report whether the upload succeeded.
Nothing here is used for any other purpose. There is no profiling, no advertising, no training of any model on it, and no combination of it with data from anywhere else.
4. Where it is kept: your machine only
The tokens are written to a single file in your home directory, ~/.config/tiktok-studio-mcp/credentials.json, created with file mode 0600 — readable and writable by your user account and no other. TikTok rotates the refresh token on each use, and the new one replaces the old one in that same file.
Your creator profile and posting settings are fetched fresh each time the composer opens and are never written to disk; they exist in memory for as long as the window is open. The composer itself is served on 127.0.0.1, a loopback address that only your own computer can reach.
Your video is read from wherever it already sits and uploaded directly from your machine to TikTok’s servers. It is never copied to any server operated by this studio, because no such server exists — the tool has no backend, no account system and no hosted component of any kind.
5. Who else sees it: no one
Personal data handled by mcp-studio is not sold, rented, shared or disclosed to any third party. The only network destination the tool contacts is TikTok’s own API at open.tiktokapis.com, and the only reason it does so is to carry out the action you asked for. There are no analytics, no telemetry, no crash reporting and no third-party SDKs.
6. How long it is kept
The tokens remain in that file until you delete them or TikTok expires them. The creator profile is discarded when the composer window closes. Your video is your own file and the tool never takes a copy of it, so there is nothing of it to retain.
7. Deleting your data, and revoking access
Because everything lives on your machine, deletion is something you can carry out yourself and verify:
- Delete the tokens — remove
~/.config/tiktok-studio-mcp/credentials.json. The tool immediately loses all access and cannot regain it without you authorising again. - Revoke at TikTok — in the TikTok app, go to Settings and privacy → Security and permissions → Manage app permissions and remove the app. This invalidates the tokens at TikTok’s end as well.
Should you want confirmation, or wish to exercise any right you hold under the GDPR or other applicable law — access, rectification, erasure, restriction, objection or portability — use the contact form. There is no server-side copy to retrieve or erase, and the reply will say so plainly rather than performing a process that has nothing to act on.
8. Security
The measures are the ones the design allows rather than a list of intentions: the credential file is created 0600; the composer binds only to the loopback interface and is not reachable from your network; every call to TikTok goes over HTTPS; the tokens are never printed to a log, never sent to a language model, and never leave the machine except back to TikTok. The residual risk is honest and worth stating — anyone with access to your user account can read that file, exactly as they could read your browser’s cookies.
9. Creator protections
mcp-studio does not remove, obscure or alter watermarks, attribution or any other copyright mechanism on content, and it does not download or re-upload other creators’ videos. It uploads a file you already have to an account you already control.
Nothing is posted without you: the composer requires you to choose the audience yourself, leaves comment, Duet and Stitch switched off unless you turn them on, and keeps the Post button disabled until you have made those choices. An automated agent can prepare a post, but a person confirms it.
10. Children
The tool is not directed at children and is usable only by someone who already holds a TikTok account meeting TikTok’s own minimum age requirements.
11. Changes
The date at the head of this page is the only signal that it changed, which is why it is printed there rather than buried. Material changes will move that date.