Trust

Security

How account access, tokens and content safety actually work.

Account authorization

Viral Ops connects a platform account using that platform's own official authorization mechanism (OAuth) — TikTok Login Kit, Google/YouTube OAuth, or Meta Login. Viral Ops does not request or ever see your TikTok, Google or Meta password. The platform itself authenticates you and returns Viral Ops a limited authorization, scoped to what you approved.

Access tokens

Authorization tokens are used only to perform the actions you authorized, within the scopes granted for that connection. They are encrypted at rest and are never exposed in the application's public responses, logs, or frontend. Tokens are not sold and are not shared with advertising networks.

Revocation

You can end a platform connection at any time, in either of two independent ways:

• From Viral Ops. Disconnecting a platform connection revokes the token and removes the stored authorization.
• From the platform itself. Every supported platform lets you revoke a connected app's access directly from its own account-security settings, independent of Viral Ops.

After revocation by either route, Viral Ops can no longer act on that account. See the Privacy Policy for the deletion timeline that follows a revocation.

Data minimization

Viral Ops processes only the data needed for the functionality you have actually requested — for example, the account identifiers needed to bind a connection, or the metrics a platform's own analytics API returns for content published through that connection. It does not collect platform data speculatively "in case it becomes useful."

Platform boundaries

Each platform's own capability and permission state is authoritative and is read directly from that platform at the time it matters, immediately before any publishing action. Viral Ops narrows what it will attempt based on that state; it never widens it, and it never invents a capability a platform has not actually granted.

Content safety

Rights and claims clearance, and quality-control checks, are separate from — and run independently of — ranking and any automated ("autonomous") decision-making. A high ranking score can never substitute for a passed rights, claims, or quality check; a piece of content that fails one of those checks is not eligible for publishing regardless of how it ranks.

No credential sharing

Viral Ops does not share platform login credentials, and does not ask you to share yours with it. It does not use browser automation to operate a platform's own web or app interface on your behalf, and does not scrape authenticated platform pages — every platform action goes through that platform's official API.