Graplo Money Radar is a single-operator internal tool. It is used with one TikTok account, which belongs to the operator. There are no other users, no sign-up, and no account other than the operator's own is ever accessed.
01 Who operates this
Graplo, a sole proprietorship in Japan, operates the software for its own TikTok account. This is not a TikTok product and is not affiliated with, endorsed by, or operated by TikTok or ByteDance. It acts as a third-party API client under TikTok's terms.
02 What TikTok data is accessed
Authorisation happens through TikTok's own OAuth flow. Two permissions are requested and no others.
| Permission | Data | Why |
|---|---|---|
user.info.basic |
The account's open_id, display name and avatar. |
The open_id is the stable identifier TikTok issues
for the authorising account. It is checked before every upload so
a video cannot be sent to a different account. Username and email
are deliberately not used for this, because both can change. |
video.upload |
The video file, its caption and hashtags, and the upload status TikTok returns. | Sends the video to the operator's own TikTok inbox as a draft. The operator reviews and posts it inside TikTok. |
The software does not request video.publish and cannot post
publicly on anyone's behalf. Direct Post is switched off.
03 What is stored, and where
Everything is stored locally on the operator's own machine in Japan. There is no hosted backend, and no database reachable from the internet.
- The
open_id, the account's current username, and the status of each upload. - OAuth access and refresh tokens.
- The video files the operator produced, with their captions and the sources each claim came from.
- Metrics TikTok returns for the operator's own posts, once posted.
127.0.0.1. That is enforced in code, not by
configuration.04 What is never collected
- No data about any TikTok user other than the operator.
- No followers, no direct messages, and no other people's content.
- No advertising identifiers, and no third-party analytics or tracking SDKs — the software has no web front end for visitors at all.
- No payment information.
05 Third-party sharing
None. Data is not sold, rented, licensed, or disclosed to third parties. It is not used to train models. The only network destinations involved are TikTok's own API endpoints, the public sources the research step reads, and Microsoft's Edge text-to-speech service, which receives the Japanese narration text in order to synthesise the voice track.
06 Security
- Tokens are stored outside the source repository, are never committed to version control, never written to logs, and never passed as command-line arguments where another process could read them.
- The client secret is held only on the operator's machine.
- Access is limited to the operator, on a single machine.
No system is perfectly secure, and this is a small internal tool rather than a hardened service. It is described here as it actually is.
07 Retention and deletion
Records are kept while the account is operated, because the point of the tool is to learn from what was published. Tokens are kept only while the authorisation is live: revoking access in TikTok's settings ends the software's access immediately, and the stored tokens stop working at the same moment. On request, the operator deletes the stored tokens and account records.
08 Your rights
The only person whose data this software touches is the operator, who controls the machine it runs on. Authorisation can be withdrawn at any time from TikTok's own settings without asking anyone. Requests to access, correct or delete anything held about the account can be sent to the contact address below.
09 Changes
If the permissions requested or the data stored change, this page is updated and the revision date at the top changes with it. The current revision is 2026-08-27.