This Policy explains how Mainstage Review collects, uses, stores, and shares information through the public Mainstage website and private review workspace.
1. Information we collect
Account information
When you access a private workspace through ChatGPT Sites, we may receive an authenticated user identifier, email address, and display name.
TikTok information
If you connect TikTok, we receive an app-specific TikTok user identifier, display name, avatar URL, authorized scopes, and token-expiration information. Access and refresh tokens are stored server-side in encrypted form. We do not receive or store your TikTok password.
Videos and review content
We process video files chosen for the workflow, along with filenames, file type and size, event, performer and track metadata, trim and revision information, hook text, caption drafts, hashtags, mentions, engagement-comment options, approvals, feedback, and timestamps.
Photos intake information
The local Palmier Photo Inbox helper requires Apple Photos Full Access because PhotoKit requires that permission to fetch a named album. The helper is designed to read only the regular album named Palmier Inbox and does not use Photos write or deletion APIs. Optional capture time and coordinates can remain in a private local manifest for event research. Only derived context, such as an event, venue, or city, may enter review metadata or public-facing copy.
Technical and support information
Hosting and security providers may process IP address, browser type, device information, request timestamps, and diagnostic or security logs. Mainstage uses functional authentication and security cookies, including a short-lived TikTok OAuth state cookie. We also collect information included in support, privacy, or deletion requests. Mainstage does not configure advertising cookies or behavioral advertising trackers.
2. How we use information
We use information to provide video review, editing, feedback, approval, and download features; connect the TikTok account you authorize; send an approved MP4 to your TikTok inbox after explicit confirmation; prevent duplicate or unauthorized transfers; preserve approval and revision history; secure, maintain, and troubleshoot the Service; respond to support, privacy, and legal requests; and comply with law and platform requirements.
We do not use TikTok data to build advertising profiles or train facial-recognition systems.
3. TikTok inbox transfers
Mainstage uses TikTok Login Kit and the Content Posting Upload API. When you explicitly confirm a transfer, Mainstage sends the approved video bytes to TikTok using the video.upload permission.
The integration does not send the separate caption, hashtags, mentions, engagement comment, posting schedule, or privacy setting. The transfer does not publish the video. TikTok notifies you when the draft is ready, and you finish editing and decide whether to publish inside TikTok. TikTok processes information under its own privacy policy and terms.
4. How we share information
We may disclose information to TikTok for authorized login, basic account identification, token management, revocation, and inbox video transfer; OpenAI and ChatGPT Sites for authenticated site access and delivery; Cloudflare for hosting, network security, database storage, and video-file storage; service providers only when needed to operate, secure, support, or maintain the Service; authorities or other parties when reasonably necessary to comply with law or protect rights and safety; and a successor operator if the Service is reorganized or transferred, subject to appropriate notice and safeguards.
We do not sell personal information or share it for cross-context behavioral advertising.
5. Retention
TikTok connection data and encrypted tokens are retained while the account remains connected or as needed to provide the authorized integration. When you select Disconnect, Mainstage requests revocation from TikTok and removes the active connection record and stored tokens from its active database.
A TikTok transfer confirmation is short-lived and can be used only once. Transfer audit records may be retained as reasonably necessary to prevent duplicate transfers, investigate errors, document consent, and meet security or legal obligations. Videos, review metadata, approvals, and feedback are retained while needed to provide the Service or until a verified deletion request is completed, subject to limited backup, security, fraud-prevention, and legal retention needs.
6. Security
We use reasonable administrative, technical, and organizational safeguards. TikTok access and refresh tokens are encrypted at rest and kept server-side. No transmission or storage method is completely secure, so absolute security cannot be guaranteed.
7. Your choices and rights
You may decline to connect TikTok and use manual download; disconnect TikTok through the private workspace; revoke Mainstage access through TikTok account settings; remove items from the Palmier Inbox album to prevent future intake; and request access, correction, or deletion of information we control. Removing a video from Photos does not automatically delete an already staged or exported copy. We may verify identity before completing a privacy request.
8. Children
The Service is not directed to children under 18, and we do not knowingly collect personal information from children.
9. International processing
Information may be processed in the United States and other locations where service providers operate. Applicable safeguards will be used where required by law.
10. Changes
We may update this Policy to reflect changes in the Service, law, or platform requirements. We will update the effective date when changes are made.
11. Contact
Privacy and deletion requests can be submitted through the process on the Support page.