Privacy notice — draft

1. Data the current application uses

• Access and identity: email address, a password hash managed by the authentication service, user/session identifiers, invitation and membership status, and your chosen POST username, display name, and optional uploaded profile photo. Invitation and authentication records are distinct from TikTok identity.
• TikTok connection: app-scoped TikTok account identity and display name, granted permissions, connection status, token expiration and refresh state, and encrypted provider access/refresh credentials.
• Publication verification: public video identifiers and original publication timestamps, tracking starting point, pinned posting timezone, baseline/scan records, eligibility, corrections, and coverage information. The current video-list request asks for identifiers and creation times, not video files, captions, likes, views, or follower statistics.
• Creator progress: derived XP, level, daily quest results, streak/Momentum observations, achievements, reward receipts and acknowledgements, and personal weekly commitment choices/history, and tutorial completion.
• Friendship controls: chosen display names, private discovery codes, requests and accepted/removed relationship states, blocks, request-limit state, and separate competition-sharing choices.
• Service operation: authentication cookies, temporary OAuth verification state, and infrastructure request/error metadata needed to operate and protect the service. Infrastructure log fields and retention still need review.

These public pages do not show a real creator's profile or progress. The homepage's example values are labeled as a product illustration. No analytics script, advertising tracker, external font request, or public signup form has been added to these pages.

2. Why the application processes it

POST uses authentication and membership records to control beta access; TikTok identity and credentials to check the authorized account; publication metadata to establish a baseline and verify eligible work; and progression records to show consistent game results without duplicate credit. Friendship data supports requests, removal, blocks, and privacy choices.

Likes, views, followers, app visits, and time spent in POST do not determine XP. POST does not request permission to publish on TikTok and does not download or host your video files as part of this integration.

Founder/legal decision: approve the operator's purposes, applicable legal bases, any consent language, age/location eligibility, and restrictions on future uses. No advertising, data-sale, or legal-compliance assurance is inferred from this draft.

3. What other members can see

The current friendship flow can show your chosen display name and request/relationship state to the other person involved in that flow. Your email, sign-in identity, provider credentials, raw video metadata, and private game facts are not part of the Friends page's peer projection.

Competition sharing is separate from friendship and starts off. The integrated weekly standings require an accepted friendship, both members' current opt-in, active memberships, and no block before sharing approved progress. Shared views can include your display name and optional profile photo, weekly and monthly XP, rank and daily XP history for those periods, level and lifetime XP, streak information, and earned competition trophies. Your private reward-delivery history is not shared. Friendship alone is not consent to share game progress.

Removing a friendship, blocking, or turning sharing off stops future authorized peer reads. It cannot retract information another person already saw or copied. Live two-user acceptance remains pending.

4. Infrastructure and service providers

Railway hosts the web application, background worker, PostgreSQL database and self-hosted authentication software (Supabase Auth/GoTrue). This deployment does not use the managed Supabase database service. The application separates protected member data from private invitation, credential, and job state. Row-level security and server checks constrain ordinary member access; server-only processes use elevated credentials for specific operations.

TikTok handles your account authorization and returns the permitted identity/public-video metadata. Its own terms and privacy practices apply to your use of TikTok. POST currently requests user.info.basic and video.list.

Web/worker hosting and email delivery support website requests, background verification, and sign-in messages. Railway hosts the running services. Resend delivers transactional invitation and password-recovery emails over HTTPS using the sender accounts@mail.postbyship.com. Cloudflare manages domain DNS. AWS S3 in us-west-2 stores encrypted database backups and protected deletion history. These are service providers, not a claim of jurisdiction-specific compliance.

Founder/legal decision: confirm all processors, regions, contract terms, hosting/CDN and email log practices, transfer safeguards where applicable, and approved public disclosures. Using these providers does not establish a POST compliance certification.

5. Sessions and safeguards

POST's current server-managed authentication uses cookies to maintain sessions, and the TikTok connection uses temporary OAuth state and a browser nonce. Provider credentials are encrypted on the server; their encryption key is kept separately from database ciphertext. Public page content contains no credential values.

These safeguards reduce exposure; they are not a guarantee that every production deployment or recovery process has passed security acceptance. The operator must validate the deployed environment, access controls, incident handling, and backup recovery before admitting external participants.

6. Retention and backups

Progress depends on historical publication, tracking, correction, and receipt records. Some scan records are referenced by those facts and cannot be treated as disposable logs. Disconnecting TikTok does not automatically delete that history.

No complete, approved retention schedule has been set in this draft. The founder must decide how long active/inactive account data, invitations, OAuth state, operational logs, support messages, deletion records, and backups are retained. Actual infrastructure settings must match the approved policy.

Backups can retain earlier versions of account data. POST retains a minimal deletion marker outside database backups to prevent deleted identities from returning. Authentication security audit records can remain after identity deletion; their approved retention and access controls are still unresolved. A safe recovery process must reapply deletions and revocations before recovered access or worker processing resumes; otherwise an old backup could reopen deleted access. Protected recovery objects use 90-day COMPLIANCE retention; some recovery packages also have a legal hold and may remain longer. This retention is a minimum protection period, not a promise of automatic deletion at 90 days. Recovery must reconcile protected deletion history before access reopens.

Founder/legal decision: approve category-specific retention, backup expiration, deletion propagation, and any narrowly retained deletion/revocation record outside restorable snapshots. Do not promise immediate erasure from every backup.

7. Access, correction, revocation, and deletion

You can manage the application's existing name, friendship, block, and competition-sharing controls while signed in. You can revoke POST's TikTok access through TikTok's app permissions. Revoking access, signing out, and deleting a POST account are separate actions.

For access, correction, export, or deletion requests, a monitored official contact and authenticated handling procedure still need to be published and tested. The support page describes the current limitation and safe information to include. The public pages do not process deletion. Signed-in creators can use Account settings to disconnect TikTok or request permanent account deletion when the required lifecycle configuration is available.

Account deletion requires the current password and deliberate confirmation. POST reports a saved request, pending cleanup, or verified completion, removes owned application records and the sign-in identity, and retains a minimal restoration-prevention marker. Disconnecting TikTok stops local tracking while preserving earned history; remote token revocation can remain unconfirmed. Deployment, retention approval and the full restore rehearsal remain release gates.

Founder/legal decision: approve request verification, applicable rights and response obligations, the monitored privacy contact, and the completed deletion workflow. No response deadline or jurisdiction-specific right has been invented.

8. Approval and updates

The operator and monitored contact are stated above. Policy effective date, age/location scope, legal bases, processor list, retention, request handling, and policy-change notice procedure remain unresolved. This draft must be reviewed against the merged application and actual hosting configuration before publication as an approved Privacy Policy.

POST by SHIP is the product's name. It is not an assertion of a registered company, compliance certification, or TikTok production approval.