Kartka Privacy Policy

Who we are

Kartka ("we", "Kartka") is a tool operated from Poland that generates and publishes social media slideshow content. Contact: star5pointer@gmail.com.

Data we collect

• Account data — email address and authentication data (via Supabase Auth).
• Content you create — the projects, topics, and AI-generated slideshows and images you produce.
• TikTok connection data — when you connect a TikTok account via TikTok Login Kit, we receive an OAuth access token, refresh token, your TikTok open_id, and basic profile information (nickname, username, avatar).
• Billing data — subscription status (payment is processed by Stripe; we do not store card numbers).

How we use TikTok data

We use your TikTok tokens and profile solely to (1) display which account a post will be published to, and (2) publish the specific photo carousel you explicitly confirm, using TikTok's Content Posting API. We do not read your TikTok feed or content, and we never post without your per-post action. Tokens are used only on our servers.

Storage & security

TikTok access and refresh tokens are encrypted at rest (AES-256-GCM) and are never exposed to your browser or to other users. Access to your data is restricted per-user via database row-level security. Our TikTok application secret is kept server-side only.

Retention & deletion

You can disconnect a TikTok account at any time from the Connections screen; this revokes the token with TikTok and deletes the stored connection. Deleting your Kartka account removes your associated data, including TikTok connections.

Third parties

We rely on the following processors: Supabase (database, auth, storage), Anthropic (AI slide generation), Pexels (background photos), Stripe (payments), and TikTok (publishing). We do not sell your data.

Your rights

Subject to applicable law (including GDPR), you may request access to, correction of, or deletion of your personal data by contacting star5pointer@gmail.com.