Effective September 16, 2026

Privacy Policy

Your little black book is yours. This page explains exactly what is stored, who processes it, and how the optional TikTok connection works.

What the app stores

Account name, email address and hashed password; sessions; imported contact details and message excerpts; relationship notes, stages and reminders; photos and gallery/sharing tokens; and wait-list entries submitted through your public link. Each account only ever sees its own book — data is never shared across accounts.

How information is used, and who processes it

Floot hosts the application and database.
Stripe processes billing and subscription checkout; the app never receives your full card number.
Microsoft is an optional connection for mail, calendar or drive, only if you choose to link it.
Square is an optional connection to sync customers or bookings, only if you choose to link it.

TikTok integration

Connecting TikTok is entirely optional and starts only when you tap Connect TikTok in Connections.

Authorization uses TikTok's own Login Kit (OAuth 2.0) at tiktok.com. You sign in on TikTok's site, and the app never sees or stores your TikTok password.

The app requests exactly two permissions: user.info.basic and video.upload. It does not request video.publish and cannot publish anything to your TikTok profile.

From TikTok, the app receives only: your TikTok user identifier (open_id), display name and avatar image URL, plus OAuth access/refresh tokens and the granted scope list. It receives nothing else — no email address, no followers or follower lists, no direct messages, no existing videos, and no analytics or engagement data. The app does not read your TikTok inbox.

Why: to show which TikTok account is connected, and to let you send a video you choose to your own TikTok drafts/inbox for review.

Token handling: tokens are stored server-side in the app's database, used only to call TikTok on your behalf, and are never exposed to the browser or included in exports or shared links. They are never sold or shared with third parties. The TikTok client secret stays server-side. Access tokens are refreshed automatically using the refresh token as needed; if authorization expires, you'll need to reconnect.

Uploads: a video you select for a TikTok draft is stored briefly in the app's private file storage only to transfer it to TikTok, then deleted after transfer. The app keeps a small log of draft uploads (title, file reference, TikTok publish id, status, time). Nothing is published automatically — the draft lands in TikTok, and you choose in the TikTok app whether to post it.

Disconnecting: go to Connections → Disconnect TikTok. This asks TikTok to revoke the access token and deletes the stored tokens, TikTok profile details and draft-upload log from the app. You can also revoke the app directly in TikTok's own settings (Settings and privacy → Security and permissions → Apps and services / Manage app permissions). Deleting your whole account in Your data removes this data too.

Sharing and public links

Private notes, relationship history, reminders, deposits and imported conversations are not included in ordinary contact cards by default. You choose which fields go into a shared card. Anyone with an active contact-card, wait-list or gallery link may view the information approved for that link and may save a copy. Revoke links you no longer want active; copies already saved by another person cannot be recalled.

Exports, deletion & retention

You can export or delete your account through Your data, including after subscription access ends. Deletion removes account records from the active app database and invalidates its public links. Provider backups, Stripe records, and copies previously downloaded or shared may remain under separate retention practices.

Security

We take reasonable steps to protect your data, including hashed passwords and account-scoped access to your book. We do not claim any specific encryption standard, certification or compliance framework beyond what is described on this page.

Children

This service is not intended for children under 13, and use by anyone under 16 requires appropriate consent where applicable. Contact us if you believe a minor has created an account so we can review and remove it.

Changes to this policy

We may update this policy as the service changes. Material changes will be presented before they take effect where required.

Contact

For privacy requests, questions or concerns, email support@littleblacktatbook.app. Please do not include passwords, payment-card numbers or sensitive contact records in email.