# TikTok App Review Notes — Internal

Internal working notes for TikTok Developer App review. This file is for repository maintainers and app reviewers only. It is not a public website page and must not include secrets.

## Security rule

Do **not** commit any of the following to this repository:

- TikTok client secrets
- TikTok access tokens
- TikTok refresh tokens
- OAuth credentials or callback secrets
- YouTube tokens
- Cloudflare tokens
- OpenAI keys
- GitHub tokens
- Any production credentials, private keys, or local credential files

If credentials are accidentally added, remove them from the repository, rotate them immediately, and review commit history exposure.

## TikTok Developer App purpose

TrueTraceShorts creates short educational videos about scam red flags, suspicious messages, and everyday online safety. The TikTok Developer App is intended to help the channel owner upload already-approved educational short videos into TikTok for review and manual posting.

## Product and scope

- Product: Content Posting API
- Requested scope: `video.upload` only
- Not requested: `video.publish`
- No direct public publishing through the app
- No comment access
- No analytics access
- No messaging access
- No user contact feature
- No collection or storage of viewer personal data

## Review flow explanation

The app is used by the channel owner or an authorized maintainer to upload approved educational short videos about scam red flags and online safety. Uploaded videos are intended to go through TikTok's draft or in-app review flow so the channel owner can inspect the final post inside TikTok before publishing manually.

The app does not publish videos directly to the public feed. It does not read or write comments, does not access analytics, does not send messages, and does not contact viewers or other users.

## Demo video checklist

A TikTok review demo should show:

1. The channel owner or maintainer selecting an already-approved educational short video.
2. The app initiating a `video.upload` flow for that approved video.
3. The uploaded video appearing in TikTok's draft or in-app review flow.
4. The reviewer/owner manually checking title/caption/content inside TikTok.
5. No automatic public publishing.
6. No comments, analytics, messaging, or user-contact features.
7. The content topic: educational scam red flags and online safety.

Do not show secrets, tokens, client secrets, refresh tokens, OAuth credential files, private dashboards, or unrelated internal automation screens in the demo.

## App Description options

Max 120 characters:

```text
Uploads approved short videos for review and manual posting by the channel owner.
```

Alternative:

```text
Helps manage educational short videos about scam red flags and online safety.
```

## Review Explanation — max 1000 characters

```text
TrueTraceShorts creates educational short videos about scam red flags, suspicious messages, and everyday online safety. The app uses TikTok's Content Posting API with the video.upload scope only. It uploads approved videos owned by the channel so they can be reviewed in TikTok before manual posting by the channel owner. The app does not request video.publish and does not directly publish videos to the public feed. It does not read or write comments, does not access analytics, does not use messaging, and does not contact users. No viewer personal data is collected by the app. The purpose is limited to uploading approved educational video content for owner review and manual posting.
```

## Explain how each product and scope works

```text
Product: Content Posting API.

Scope: video.upload.

The app uses video.upload to upload an already-approved educational short video created for the TrueTraceShorts channel. The uploaded video is intended for TikTok's draft or in-app review flow so the channel owner can inspect it before manual posting. The app does not request video.publish and does not publish videos directly. It does not access comments, analytics, messages, user contact data, or viewer personal data.
```

## Public website wording boundary

Public Terms and Privacy pages should describe TrueTraceShorts generally as an educational website and content brand. They should not mention TikTok implementation details, OAuth scopes, tokens, upload IDs, draft workflows, app-review internals, or internal automation systems.