Security and data handling

Orion Studio runs on your own computer and talks to each platform's official API on your behalf. This page describes exactly what that means: what is stored, where, which permissions are requested, and what the application will never do.

Where your data lives

Orion Studio is a desktop application. There is no Orion Studio account, no sign-up, and no server of ours that receives your videos, your scripts or your credentials. Everything the application produces is written to folders on your own machine.

What	Where it is stored
Scripts, narration audio, subtitle files, rendered videos	In a folder per video, on your computer
Access and refresh tokens for connected accounts	A configuration file inside that account's folder, on your computer
Titles, descriptions and publication status	A metadata file alongside each video
Your account password for any platform	Never stored, never requested, never seen by the application

Because the tokens live on your machine, anyone with access to that machine can use them. Treat the application's folders like you would treat a saved browser session.

How an account is connected

You connect each account from inside the application. Orion Studio opens the platform's own authorization page in your browser — TikTok's or Google's, on their own domain — where you log in and review the permissions being requested. Orion Studio never sees what you type there.

If you approve, the platform sends back an authorization code, which the application exchanges for an access token. That token is what allows it to upload the videos you choose. If you decline, nothing is stored and nothing changes.

What the authorization uses

The exchange uses PKCE, so the authorization code cannot be reused by anything that intercepts it.
A random state value is generated per attempt and verified when the platform responds, which is what prevents a forged callback from connecting an account you did not authorize.
The response is received on localhost, on your own machine — it never passes through a server of ours.

Permissions requested

The application asks for the narrowest set of permissions that lets it do what it does. It does not request permission to read your feed, your followers, your messages, or other people's content.

Platform	Permission	Used for
TikTok	`user.info.basic`	Showing you which account is connected before you publish
TikTok	`video.publish`	Uploading a video you selected, after you confirm
YouTube	`youtube.upload`	Uploading a video you selected

Before a TikTok post is created, the application queries the creator information endpoint so that the privacy options it offers you are the ones your account actually allows, rather than a guess.

What it never does

It never posts anything without an explicit action from you. Every upload starts with you selecting a video and confirming a dialog that shows the account, the caption and the privacy level.
It never asks for your password to any platform.
It never reads, collects, or stores other users' content, profiles or personal data.
It never sends your videos, scripts or tokens to us. We operate no server that receives them.
It does not track your usage, set cookies, or run analytics on you.

Revoking access

You can cut the application off at any time, from the platform's side, without needing the application at all:

TikTok — in the TikTok app, under Settings and privacy, in the security and permissions section, remove Orion Studio from the list of authorized apps.
YouTube — at myaccount.google.com/permissions, remove Orion Studio's access.

Revoking takes effect immediately and the stored token stops working. Deleting the token file on your computer disconnects the account locally as well.

Reporting a problem

If you find a security issue, write to orionluciogame@gmail.com with enough detail to reproduce it. Please do not post it publicly before it is fixed.