Privacy Policy

1. Scope and operator

Zhenhua Meng operates Rillora as an individual developer. Rillora is a product brand. Privacy contact: mengzhenhua0620@gmail.com.

Effective date: 2026-10-18. This policy covers rillora.app, its Web account dashboard and voluntary contact enquiries. The TikTok connection currently uses the new Rillora Sandbox and is available only to authorized Sandbox users while the application is awaiting Production review.

The earlier local Desktop pilot and its existing data and authorizations remain separate. Connecting to Rillora Web does not import that installation or its business records.

2. Information processed

When you connect TikTok

TikTok handles sign-in and your choice of permissions. Rillora receives an authorization code, exchanges it on the server for access and refresh tokens, and receives the account identifier and granted scopes. Rillora never asks for your TikTok password. The permissions are used as follows:

Rillora stores the connection, granted scopes and the latest successful profile, account-statistics and public-video snapshot, together with read times and a short safe synchronization status. It does not collect private messages, comment text, unpublished videos or your local business workspace. Videos are linked to TikTok; their video files are not downloaded or stored.

Website requests and essential session cookie

Hosting systems process your IP address, requested address and ordinary browser headers to deliver and protect the service. The Web app uses a first-party Secure, HttpOnly session cookie to maintain sign-in and protect authorization actions. Its maximum lifetime is 24 hours; logout invalidates that session. A service restart requires sign-in again. Short-lived session, authorization-state and IP rate-limit records are held in server memory. The static information pages do not create a session until the Web app is opened.

There are no advertising or analytics trackers and no application tokens stored in browser local storage. Routine Nginx visitor access and website-request error logs are disabled. Separate system and hosting infrastructure records may exist.

Voluntary correspondence

Emailing support provides your address, chosen name, message, attachments and ordinary mail metadata. Send only what is necessary. Do not send passwords, verification codes, authorization codes, tokens, cookies or private databases.

3. Purposes and choices

Account information is used to identify your connected account, show your own dashboard and retrieve the profile, statistics and public videos you authorize. Tokens enable those requests and can be refreshed when you ask to synchronize. A successful connection starts an initial read; later synchronization is initiated from the dashboard. Information is also used to maintain service security, answer requests and meet applicable legal obligations.

Providing the requested service and your authorization support this processing; security and support also serve the legitimate interests of operating the service where that legal basis applies. You can decline permissions or end access. Missing permissions or unavailable provider values may limit features. Information is not sold, used for advertising or added to marketing lists, and is not used for automated decisions with legal or similarly significant effects.

4. Hosting, recipients and security

The website and independent Web backend run on an OVHcloud VPS in Singapore over HTTPS. Web tokens and saved account snapshots are encrypted at rest in server storage with restricted operating-system access. Tokens and the app secret are not returned to browser scripts. Each Web session can read only its own authorized account.

TikTok receives authorization and API requests. When you view profile pictures or video covers, your browser requests those images from TikTok CDN services, which receive your IP address and browser request information. Opening a profile or video link takes you to TikTok. TikTok applies its own terms and privacy policies.

OVHcloud processes hosting, network and infrastructure data under its privacy policy. Contact mail is handled through Google Gmail under Google’s Privacy Policy. Hosting, TikTok and email processing may occur outside your country; no claim is made that all providers process information only in Singapore.

The operator and relevant service providers use information for these purposes and appropriate support and security needs. Information may also be disclosed as required by applicable law or to protect legal rights. No security measure guarantees that unauthorized access or loss is impossible.

5. Retention and deletion

The Web connection and latest successful snapshot remain while needed to provide the connected service. Refresh replaces the saved snapshot after a complete successful read; a failed or incomplete read retains the last successful snapshot. This version does not build a daily history in the Web service. Logging out ends the browser session but retains your connection and saved snapshot for later sign-in.

Disconnect & remove Web data in the Web dashboard removes that account’s tokens and saved snapshots from the active Web store, invalidates its Web sessions and attempts to revoke the new Rillora application’s access at TikTok. If TikTok revocation cannot be confirmed, the result tells you to remove Rillora through TikTok’s app-permission controls too. Revoking access only inside TikTok does not itself erase a snapshot already saved by Rillora; use the deletion action or contact us.

Server backups may retain earlier encrypted records until they expire under the provider’s backup arrangements. Active-store deletion is not a promise of immediate erasure from every backup or provider record. Backups are restricted to recovery and security purposes; data deletion requests must also be considered before a backup is restored into use.

Contact messages are kept while reasonably needed to resolve the enquiry, perform necessary follow-up or meet legal obligations or legitimate dispute needs, then reviewed and deleted. Provider email and infrastructure records follow their own deletion and backup procedures. No fixed automatic email deletion period is represented as implemented.

Web deletion affects only the new Web connection. It does not delete the earlier local Desktop pilot, its grants, business data or backups.

6. Requests and your rights

Use the dashboard to disconnect and delete active Web data, or email mengzhenhua0620@gmail.com for applicable access, correction, deletion, restriction, objection, portability or other privacy requests. Depending on applicable law and the processing, you may withdraw consent or complain to a competent data-protection authority.

We request only the information reasonably necessary to locate your data and verify authority, then explain the action taken or an applicable limitation. Do not send identity documents or account exports unless a necessary and appropriate verification method has been specifically agreed. Applicable legal deadlines and mandatory rights remain unaffected; no separate fixed support SLA is promised.

7. Changes and contact

Material changes to data use or service availability will be explained before changed processing is introduced, with additional consent where required. Contact Zhenhua Meng at mengzhenhua0620@gmail.com. The current guide explains the authorization and deletion controls.