Where the data lives, and who can reach it.
The Clip Farm is deliberately built with no central database. The design goal was that a breach of the hosted component leaks nothing, because the hosted component never holds anything worth leaking.
Local-first storage
Profiles, posts, snapshots, fields and grower records live in the application's private data folder on the operator's own computer. There is no Clip Farm account, no cloud sync, no shared database.
Encrypted credentials
Access tokens and platform client secrets are encrypted at rest using the operating system's secure storage — Keychain on macOS — not written to plain files.
No embedded tracking
The app contains no analytics SDK, no crash reporter, no telemetry. It talks to the platform APIs and to the invite relay, and nothing else. This website loads no third-party resources at all — even the display font is served from the same origin.
Read-only by design
Only read scopes are requested. There is no code path that posts, edits, deletes, messages, follows or reacts — the write permissions are never requested, so they cannot be misused.
The invite relay
A desktop application has no public address, so a platform cannot redirect a grower's browser back to it. The relay is the small hosted piece that solves this, scoped as narrowly as it can be.
| The relay does | The relay never |
|---|---|
| Receive the redirect after a grower approves on the platform's site | Receives or stores an access token |
| Hold a one-time authorisation code for up to 15 minutes | Holds a password — it never touches the login |
| Delete that code the instant the operator's computer claims it | Holds profile data, post data or statistics |
| Answer platform domain-verification requests | Holds the platform client secret |
Claim requests are authenticated with a shared key compared in constant time, so a wrong key cannot be narrowed down by timing. An unclaimed code expires on its own.
Permissions requested
| Platform | Scope | Why it is needed |
|---|---|---|
| TikTok | user.info.basic | Identify which account authorised, so posts attach to the right grower |
| TikTok | user.info.profile | Display name and avatar in the grower list, and handle verification against the invite |
| TikTok | user.info.stats | Follower count, for a field's account eligibility gate |
| TikTok | video.list | The posts and their public performance counts — the core of the product |
instagram_business_basic | Profile and media list | |
instagram_business_manage_insights | Per-media view counts, which Meta moved behind this permission in March 2025 |
Comment and message permissions are deliberately not requested on either platform. The app never reads them, so asking for them would be scope the product cannot justify.
Retention and deletion
- Data is kept until the account is disconnected or the operator deletes it.
- Removing an account deletes its stored profile, posts, snapshots and tokens from the computer immediately.
- An authorisation code held by the relay expires within 15 minutes, sooner if claimed.
- Anyone whose account was connected can request deletion directly — see data deletion.
Report a security concern to hello@theclipfarm.com with "Security" in the subject line.