Privacy Policy
Effective date: 2026-10-28 · Version: 2026-10-28 · OZHUO US L.L.C.
1. Who is responsible
OZHUO US L.L.C., a Wyoming limited liability company, operates ozhuo and determines the purposes and means of the website’s personal information processing. Address: 312 W 2nd St, Unit #A8867, Casper, WY 82601, United States. Privacy contact: ozhuo9588@gmail.com. The company's sole member, who runs and supports the service, is located in mainland China (see section 6). This policy covers studio.nuopo.com, its in-browser preview and its connected posting service. It does not replace TikTok’s or Cloudflare’s independent policies.
2. Previewing without an account
Choosing a local file creates a temporary browser preview and reads its filename, size, duration and dimensions on your device. It does not upload the video. Writing or copying a caption does not submit it to TikTok or our server.
The browser does not save your video or caption. The only thing ozhuo stores in your browser is your Chinese/English language preference (see section 10).
3. Data processed by connected features
When you choose to connect TikTok, we process the application-scoped account identifier (open_id), granted scopes, access and refresh tokens and their expiry times. These enable your chosen API actions. Profile nickname/avatar and current creator settings are fetched to show the destination account and valid posting options; we do not maintain a separate stored profile directory.
Only after explicit sending consent do we receive the selected video and process the title, privacy, interaction, commercial and AI settings needed for that task. We keep task identifiers, request fingerprints, timestamps, status and returned errors/results for progress checks and duplicate prevention. The server receives a generic video extension rather than retaining the original local filename as the upload name.
Necessary cookies, session/state identifiers, consent version/time, request metadata, account locks and rate-limit counters protect sign-in, prevent cross-site requests and reduce abuse. Cloudflare necessarily receives connection metadata such as IP address and user agent. Our visitor rate limiter uses a hashed IP-derived key, which is pseudonymous rather than guaranteed anonymous.
4. Purposes and choices
We use data only to deliver the feature you request, authenticate the account you select, validate posting options, transfer content with consent, return status, prevent duplicates, secure the service and respond to verified support or rights requests. Depending on applicable law, the basis is your consent, performing the requested service/contract, required legal obligations, or a permitted security interest. Where separate consent is required, it is requested separately rather than inferred from browsing.
You can preview videos and write captions without granting TikTok access. Declining connected processing prevents the affected account/upload feature but does not disable local preview. We do not sell personal information, use your videos to train models, run targeted advertising or include third-party behavioral analytics scripts.
5. Service providers and recipients
Cloudflare, Inc. provides the network, HTTPS, Worker execution, D1 database and private R2 storage. It processes necessary network metadata and the service data hosted in those systems to operate and secure the infrastructure. See Cloudflare’s Privacy Policy and privacy contact channels.
When you authorize or send, TikTok receives the relevant authorization request, video and chosen publishing settings. The applicable TikTok entity and regional privacy contact are identified in TikTok’s Privacy Policy for your account region. TikTok independently handles its account service, content review and posts. We share no password with either provider.
We do not disclose your videos or authorization to unrelated recipients for marketing. Disclosure may occur when required by applicable law or a valid legal process, limited to what is necessary and subject to verification. If the business changes ownership, affected users will be informed before incompatible new processing, with fresh consent where required.
6. International processing
OZHUO US L.L.C. is registered in the United States. The service runs on Cloudflare’s global infrastructure, and TikTok processes data in the regions its services use, which may include the United States. The company’s sole member, who operates and supports ozhuo, is located in mainland China and may access the data described in section 3 from mainland China when needed to run the service, investigate faults or answer your requests; access is limited to those purposes and to the minimum needed. Data may therefore be processed outside your country. The recipients, purposes, categories and rights channels are described above. For questions or help exercising rights with recipients, contact ozhuo9588@gmail.com.
Before connecting, the interface asks for your separate consent to this processing outside your country, including access from mainland China, for your account authorization and, only after a further send confirmation, your selected video and posting settings. You can decline and still preview videos locally. Consent is not a substitute for any transfer safeguard or procedure required by law; we do not claim a completed regulatory assessment or certification. Where a required transfer condition cannot be met, the affected connected feature must not be used.
7. Retention and deletion
- Video caches: expire 24 hours after upload; hourly cleanup deletes expired R2 objects and their media indexes in batches. A busy account or service fault can delay cleanup. Signed delivery links expire after at most 12 hours and cannot extend the cache’s lifetime. Pending task status does not guarantee the cache is preserved.
- Authorization and task records: remain to maintain the account connection and your delivery history until you delete site account data or request verified deletion. Expired or revoked tokens may remain encrypted but cannot validly authorize new calls. Token expiry itself does not automatically erase the account’s task history.
- Sessions: expire after at most 24 hours; incomplete OAuth state after 10 minutes. Expired records are cleared by the scheduled cleanup. Rate-limit counters are cleared during cleanup, normally within about two hours.
- Support correspondence: if you email us, relevant messages are handled in the operator’s email service only for your request and any legally necessary follow-up. No mailbox connection is built into ozhuo.
Deleting site account data removes its authorization, stored tasks and temporary media. It does not remove TikTok’s copies. Provider backups or legally required records, if any, follow the applicable provider/legal lifecycle and are not promised to disappear instantly.
8. How we protect data
We use HTTPS; server-only application secrets; application-level AES-GCM encryption for stored authorization, session and task payloads; account separation; CSRF and OAuth-state validation; scoped rate limits; and private R2 objects with expiring signed delivery URLs. Operational indexes and media metadata are not all application-encrypted. We do not send access or refresh tokens to browser JavaScript.
These controls reduce risk but do not guarantee absolute security. Do not include unnecessary personal or sensitive information in captions, videos or support messages. If a personal data incident occurs, we will investigate, take reasonable containment steps and provide notices or regulatory reports where required by applicable law.
9. Your rights and how to request them
Subject to applicable law, you may request access, a copy, correction, deletion, explanation, restriction/objection or withdrawal of consent. Use the Account page for immediate site data deletion, and TikTok’s security/permissions settings to revoke ozhuo access. Withdrawal affects future processing and does not invalidate a lawful prior operation. TikTok posts must be managed in TikTok.
Email ozhuo9588@gmail.com with the subject “ozhuo privacy request”, the action requested and enough information to identify your account (for example your TikTok username). Do not email passwords or tokens. We may ask you to demonstrate account control using a proportionate method. We aim to acknowledge within 7 working days and respond within 30 days, or earlier where law requires; if an extension or refusal is legally necessary, we will explain the reason and available recourse. You may complain to a competent data-protection or other supervisory authority.
11. Children and sensitive data
ozhuo is intended for adults aged 18 or above. We do not knowingly offer connected services to children or request biometric, health, financial or government-ID data. A video may contain personal information you choose to include; obtain the necessary permissions before sending it. If you believe a child’s data or unnecessary sensitive data has been provided, contact ozhuo9588@gmail.com so we can verify and address it.
12. Updates and contact
The effective date and policy version are displayed above. Material changes in purposes, categories, recipients or choices will be explained in the workspace, and fresh or separate consent obtained where required before affected processing. Contact: OZHUO US L.L.C., 312 W 2nd St, Unit #A8867, Casper, WY 82601, United States; ozhuo9588@gmail.com. The English version controls if meanings differ, without overriding mandatory local rights.