TikTok
Login Kit- Permission
user.info.basic- We receive
- Account identifier and display name
- We store
- Both — nothing else
- Why
- To recognise the account, stop it being added twice, and label it in your dashboard
§ 01
What connecting actually does
Step 01
You authorize on their screen
You tap Connect, and the platform's own authorization page opens. You approve there, not here. Your password is typed on their site and never passes through Cyduck.
Step 02
We read two things
An account identifier so we can recognise the account, and the display name so you can tell your accounts apart in the dashboard. That's the whole read.
Step 03
You answer, we score
The account appears in your dashboard. You tell us what's switched on — two-factor, password age, login alerts — and we turn those answers into a score and a next step.
§ 02
Platform by platform
Cyduck supports two platforms today. On neither of them do we post, comment, send messages, follow accounts, or take any other action on your behalf.
- Permission
public_profile,email- We receive
- Account identifier, name, profile link, and the email address on the account
- We store
- All four
- Why
- To recognise the account, and to check that email address against known breach databases
About the Facebook email
Facebook hands us the email address on your account. We add it to your dashboard as its own entry and check it against known breach databases — that's the point of connecting. If that address is already in your dashboard we link the two instead of creating a duplicate, and you can remove it at any time without touching the Facebook connection.
§ 03
What we never touch
A connected account gives us a narrow window, not a key to the house. Everything below is outside what we ask for and outside what we could reach even if we wanted to.
- Your password
- Your videos, photos, and posts
- Your comments and replies
- Your private messages
- Your followers and following list
- Your viewing and search history
Access tokens
When you authorize, the platform issues an access token. Cyduck uses it once, in memory, to read the fields above — then discards it. No access token and no refresh token is written to our database. Because nothing is kept, we hold no standing access to your account.
§ 04
The whole flow
Three screens, start to finish.
§ 05
Leaving is one tap
Open the account in your dashboard and choose Remove. The account identifier, the display name, and every answer you gave about that account are deleted from our database within 24 hours.
You can also revoke Cyduck from the platform's own app permission settings at any time. Since we store no token, revoking there changes nothing about what we hold — removing the account in your dashboard is what deletes it.
The full picture, including account deletion and the legal basis for everything above, is in our Privacy Policy and Terms of Service.
See it on your own accounts
Connecting is optional. You can use Cyduck without ever linking one.