This Privacy Policy explains how Noffer (“Noffer”, “we”, “us”), a productivity product published by Simplibot, collects, uses, stores and protects information when you use the Noffer mobile application (iOS and Android) and the Noffer web application (available at noffer-app.vercel.app/app) — together, the “Service”. Both surfaces are built on the same backend and perform the same processing: connecting TikTok accounts, storing OAuth tokens, importing content and publishing it. Noffer lets content creators and businesses connect and manage their own TikTok accounts. By using the Service you agree to this Policy. We are committed to transparency and to the EU General Data Protection Regulation (GDPR).
Introduction
Simplibot is the data controller. We limit collection to what is strictly necessary to run the service, we never use your data for advertising, and Noffer contains no ads.
Information we collect
2.1 · Noffer account data
To create your account and sync your data across devices:
| Data | Purpose | Source |
|---|---|---|
| Email address | Account identification & sign-in | Sign-up / Google / Apple |
| Display name | Personalisation | You / Google / Apple |
| Unique identifier (UID) | Linking your data | Supabase Auth |
2.2 · TikTok account data (via TikTok's official APIs)
When you connect a TikTok account using TikTok's Login Kit, you authenticate directly on TikTok — Noffer never sees your TikTok password. You authorize Noffer to access, through TikTok's official APIs, only the data covered by the scopes you approve:
| Scope | What it lets Noffer do |
|---|---|
user.info.basic, user.info.profile | Read your profile (display name, avatar, open ID) to show the connected account. |
user.info.stats | Read account statistics such as follower, like and video counts. |
video.list | List your videos and their public metrics to display them in your dashboard. |
video.upload, video.publish | Upload and publish, at your request, the videos you prepare in the Service to your connected account. |
2.3 · Content you provide
Videos, captions, hashtags and schedule details you prepare in the Service in order to publish them.
2.4 · Usage data
We collect anonymised technical data (screens viewed, errors, performance) to improve the stability of the Service. No personal identifier is attached to this analytics data.
How we use information
- To authenticate you and let you sign in to Noffer.
- To display your connected TikTok accounts, their statistics and recent videos inside the Service.
- To schedule and publish, at your request, the videos you prepare to the TikTok account you connected.
- To operate, maintain and improve the Service.
What we never do
We do not sell your personal information. We do not use TikTok data for advertising or profiling. Your content is never used to train any model.
TikTok data, tokens & storage
To keep your accounts connected, we store the OAuth access and refresh tokens issued by TikTok in our secure database (Supabase, hosted in the European Union). Tokens are encrypted at rest and transmitted only over secure connections (TLS); they are never exposed on the client or shared with third parties. TikTok profile data and statistics may be cached to display them in the Service and are refreshed periodically.
Your TikTok OAuth tokens are held server-side on both surfaces. What is stored locally differs by surface: the mobile app uses the operating system's secure storage, while the web application uses your browser's standard storage, which is not encrypted — anyone with access to your browser profile can read it. Sign out on a shared computer.
| Surface | Location | Data | Protection |
|---|---|---|---|
| Both | Supabase (EU) | Accounts, content, OAuth tokens | Encryption + TLS, per-user access control |
| Mobile | SecureStore | Session tokens | Keychain / Keystore |
| Mobile | Local device | Temporary cache | OS secure storage |
| Web | localStorage | Supabase Auth session (access & refresh token), last e-mail used to sign in, selected app and account handle, cached statistics snapshot, language preference | Browser origin isolation (HTTPS), cleared on sign-out |
| Web | sessionStorage | Pending TikTok OAuth context (anti-CSRF state and target account) during the redirect | Erased as soon as the redirect completes, and when the tab closes |
Third-party services
We rely on trusted providers to run the service:
- Supabase — database and authentication, hosted in the European Union.
- TikTok — official OAuth connection (Login Kit), statistics (Display API) and publishing (Content Posting API).
- n8n — secure orchestration of the backend automations and TikTok token exchange.
Revoking access
You can remove any connected TikTok account from within the Service at any time — on mobile and on the web application, from the Accountsscreen — which revokes and deletes the corresponding token and stops Noffer from accessing that account. You can also revoke Noffer's access directly from your TikTok account settings under “Manage app permissions”. Our use and transfer of information received from TikTok APIs adheres to the TikTok Developer Terms and Policies.
Data retention & deletion
We keep your data for as long as your Noffer account is active. Deleting your Noffer account — and all associated data, including stored TikTok tokens and cached TikTok data — is done by e-mail request: neither the mobile app nor the web application currently offers a self-service “delete my account” screen. Write to contact@simplibot.fr from the address associated with your account. We acknowledge within 48 business hours and server data is purged within 30 days.
Delete your account
Step-by-step instructions and an email request option are available on our dedicated page: noffer-app.vercel.app/delete-account.
Security
We use industry-standard measures to protect your data, including encrypted transport (HTTPS/TLS), encryption of tokens at rest and per-user access controls. No method of transmission or storage is completely secure, but we work to protect your information.
Your rights (GDPR)
- Access & rectification — on request, by writing to us.
- Disconnect a TikTok account — from the Accounts screen on either surface; revokes the corresponding token.
- Erasure — by e-mail request (irreversible). See Delete account.
- Portability — export of your data on request.
Children
Noffer is not directed to children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect data from them.
Contact
contact@simplibot.fr
Data controller: Simplibot (France). For any privacy question or data deletion request, write to contact@simplibot.fr. We reply within 48 business hours.