Where the data lives, and who can reach it.
The Clip Farm's measurement engine is deliberately built with no central database. The design goal was that a breach of the hosted component leaks nothing, because the hosted component never holds anything worth leaking.
Local-first storage
Profiles, posts, snapshots, campaign fields and clipper records live on our own operator machines, not in a cloud database. There is no public Clip Farm account system to attack, no shared multi-tenant store, no third party holding a copy.
Encrypted credentials
Access tokens and platform client secrets are encrypted at rest using the operating system's secure storage — never written to plain files.
No embedded tracking
Our tooling contains no analytics SDK, no crash reporter, no telemetry. It talks to the platform APIs and to the invite relay, and nothing else. This website loads no third-party resources at all — even the display fonts are served from the same origin.
Read-only by design
Only read scopes are requested. There is no code path that posts, edits, deletes, messages, follows or reacts — the write permissions are never requested, so they cannot be misused.
The invite relay
Our measurement engine has no public address, so a platform cannot redirect a clipper's browser back to it. The relay is the small hosted piece that solves this, scoped as narrowly as it can be.
| The relay does | The relay never |
|---|---|
| Receive the redirect after a clipper approves on the platform's site | Receives or stores an access token |
| Hold a one-time authorisation code for up to 15 minutes | Holds a password — it never touches the login |
| Delete that code the instant our machine claims it | Holds profile data, post data or statistics |
| Answer platform domain-verification requests | Holds the platform client secret |
Claim requests are authenticated with a shared key compared in constant time, so a wrong key cannot be narrowed down by timing. An unclaimed code expires on its own.
Permissions requested
| Platform | Scope | Why it is needed |
|---|---|---|
| TikTok | user.info.basic | Identify which account authorised, so posts attach to the right clipper |
| TikTok | user.info.profile | Display name and avatar in the crew list, and handle verification against the invite |
| TikTok | user.info.stats | Follower count, for a campaign's account eligibility gate |
| TikTok | video.list | The posts and their public performance counts — the core of the measurement |
instagram_business_basic | Profile and media list | |
instagram_business_manage_insights | Per-media view counts, which Meta moved behind this permission in March 2025 |
Comment and message permissions are deliberately not requested on either platform. The measurement never reads them, so asking for them would be scope the service cannot justify.
Retention and deletion
- Data is kept while the account is connected and the campaign's records are needed, then deleted.
- Disconnecting an account deletes its stored profile, posts, snapshots and tokens from our machine immediately.
- An authorisation code held by the relay expires within 15 minutes, sooner if claimed.
- Anyone whose account was connected can request deletion directly — see data deletion.
Report a security concern to hello@theclipfarm.com with "Security" in the subject line.