01. Operator and scope
ThongNguyen Publisher is operated by Thong Nguyen, based in Hanoi, Vietnam, who is responsible for the personal data described in this policy. Website: https://thongnguyen.online. Privacy enquiries: admin@thongnguyen.online.
This policy covers the current information website and separately describes the planned publishing application. Postiz, a backend and OAuth connections have not been deployed. The proposed postiz.thongnguyen.online subdomain is not an active service.
02. Current website
- Browsing: the website has no registration, submission forms, advertising pixels, analytics scripts or social media embeds.
- Theme preference:
tn-themein localStorage stores your light/dark choice on your device. It contains no identifier or token. Clear the site’s browser data to remove it. - Email: if you send a message, the recipient receives your email address, display name, message and any attachments so they can respond. Email links do not send messages automatically.
- Hosting: on deployment to Cloudflare Pages, Cloudflare may process IP addresses, HTTP requests, device information and security logs to serve and protect the site. Cloudflare handles this request and security data according to its service configuration and privacy policy; the application log periods below do not replace Cloudflare’s own retention practices.
Fonts are served locally. This website does not access social media profiles, videos, metrics or account tokens.
03. Planned OAuth access
No OAuth permissions are requested today. Future features will request only the access they need, on the provider’s official consent page. Declining permission may make that feature unavailable.
| Platform | Planned access | Purpose |
|---|---|---|
| TikTok | user.info.basic; video.publish for Direct Post or video.upload for draft upload. Video or metrics access only when needed and authorized. | Identify the connected account and carry out the publishing or draft upload you select. |
| Facebook Pages | Page list, Page information and post management. Candidate scopes include pages_show_list, pages_read_engagement and pages_manage_posts. | Select an authorized Page and publish approved content. Final scopes must be checked against the API version and App Review requirements. |
| Professional account information and publishing permission. Scope names depend on the chosen Instagram Login or Facebook Login flow. | Identify an eligible account and publish approved content. Insights access will be requested only for an implemented reporting feature. | |
| YouTube / Google | https://www.googleapis.com/auth/youtube.upload. Read access such as https://www.googleapis.com/auth/youtube.readonly or https://www.googleapis.com/auth/yt-analytics.readonly only when required. | Upload requested videos and, where authorized, read channel information or performance data. No Gmail, Drive or contacts access is planned. |
The application may also process access and refresh tokens, account/channel IDs, uploaded media, captions, drafts, schedules, post IDs, job status and returned metrics. Final disclosures must match the implemented application before consent is requested. Social media passwords, private messages and friends’ data are outside the planned scope.
04. Use and sharing
Planned data use is limited to the requested features: account connection, content preparation, confirmed schedules, publishing results and performance reports. Posting, editing or deleting platform content requires the user’s authorization.
Personal data will not be sold. API data will not be used for targeted advertising or to train general-purpose AI models. When Google integration is available, the use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including applicable Limited Use requirements.
Sharing is limited to the platform you select, necessary hosting/email providers, security purposes or valid legal obligations. Human access is limited to support you request and necessary security or legal handling permitted by the relevant policies.
Cloudflare Pages is the intended website host. Messages sent by email are processed through the mail services used by the sender and recipient. Providers may process data outside Vietnam according to their infrastructure and applicable safeguards. We will disclose additional application processors and relevant transfer arrangements before enabling account connections. Postiz is not currently processing user data for this product.
05. Retention periods
Contact email and device preferences apply to the current website. Periods for OAuth tokens, application content, logs and backups describe the future application and must be enforced before those features open.
| Data | Retention period |
|---|---|
| Theme preference | On your device until you change it or clear site data. |
| Contact and support email | Up to 90 days after the request is resolved, unless earlier deletion is requested or a specific legal obligation applies. |
| OAuth tokens | While the connection remains authorized and needed. Stop using immediately on disconnection; remove from active systems within 7 days. |
| Drafts, media and schedules | While the account is active and the data is needed. Target deletion within 7 days of a reasonably verified request. |
| API data and metrics | Refresh or delete within 30 days by default. YouTube data is subject to its specific refresh, authorization and deletion requirements. |
| Future application logs | Up to 30 days; minimize personal data and exclude tokens. Cloudflare log retention must be confirmed separately. |
| Future backups | Normal removal within 30 days. Shorter mandatory API deadlines also apply to backups; affected data must be removed or made irrecoverable within those deadlines. |
Requested deletion of YouTube data or an application account containing it must occur as soon as possible and within 7 calendar days. For revocation through Google, the YouTube limit is 30 calendar days; the internal target is 7 days. Backups must not restore deleted data.
Any legally required retention must have a documented basis, scope and expiry communicated to the requester. It must not be used to retain API data contrary to platform policies.
06. Security
The static website contains no client secrets, OAuth tokens or API keys. Planned backend controls include HTTPS, encryption of stored tokens, server-side secret management, least-privilege access, OAuth callback/state validation, PKCE where applicable and dependency updates. These backend controls have not been implemented or verified.
Security reports can be sent to admin@thongnguyen.online. Incident response and any required notification process must be established before handling live account data.
07. Your choices and requests
Email us to request access, correction, deletion, restriction of processing or withdrawal of consent, subject to applicable law. Verification should use only the information needed to establish ownership, never passwords or tokens.
Once OAuth is implemented, you will be able to disconnect in the application or revoke access with the provider. Revocation stops future access but may require a separate deletion request for stored copies. See the Data Deletion Instructions.
Google access can be managed at Google’s account permissions page. Deleting data held by ThongNguyen Publisher does not delete videos or other data held by YouTube or another platform.
08. Provider policies
Providers apply their own policies to data they process. The planned YouTube integration will use YouTube API Services.
09. Age requirements and policy updates
The product is not directed at children. The application is intended for people aged 18 or older who are authorized to manage the connected content and meet the relevant provider’s eligibility rules.
Before new integrations or material changes in data use, we will update this policy and its effective date, provide appropriate notice and obtain renewed consent when required.