Home / Security and data handling
Security and data handling
Chuhai Cloud holds two things that matter: the access tokens a customer granted for their own accounts, and the business data those accounts produce. This page says where both live, who can reach them, and how to have them removed.
What we hold
| Category | Examples | Why we hold it |
|---|---|---|
| Account credentials | OAuth access and refresh tokens for the platform accounts a customer connected. Never a platform password — we never receive one. | To call the platform on the customer's behalf when they ask us to. |
| Content | Videos, images and captions the customer uploaded, and the posts made from them. | To publish, and to show what was published. |
| Performance data | Followers, views, likes, comments and ad spend read back from the customer's own accounts. | To show trends over time in the dashboard. |
| Conversations | Direct messages and comments on the customer's own accounts, and the replies sent from Chuhai Cloud. | To run the shared inbox and keep a history of what was said. |
| Workspace data | Teammates, roles, leads and activity logs. | To run the account. |
How it is protected
In transit
The application is served over HTTPS only, with TLS 1.2 or higher. Calls to platform APIs are made server to server over TLS.
Tokens stay server-side
Platform access tokens are stored on the server, are never returned to the browser, and never appear in an API response. The front end holds only a session token for the signed-in user.
Tenant isolation
Every request carries the signed-in user's session token and is scoped to that user's workspace. A customer's tokens are never used to call a platform for another customer.
Passwords
User passwords for Chuhai Cloud itself are stored only as a salted hash. Sign-in is rate limited by both account and source address.
How platform data is used
Data pulled from a platform is used only to provide the features the customer is using, to the customer it belongs to.
It is not sold. It is not shared with third parties. It is not pooled or aggregated across customers. It is not used to train machine-learning models, ours or anyone else's.
We do not read, publish to, or collect data from any account that has not been connected by its owner through the platform's own consent screen.
Retention and deletion
- Disconnect an account. Removing a connected account in Chuhai Cloud deletes the stored access tokens for it and stops all further calls to that platform on the customer's behalf.
- Revoke from the platform. A customer can independently revoke our access from the platform's own settings. For Google accounts that is myaccount.google.com/permissions. Revoking there takes effect immediately, regardless of what is in our product.
- Delete a workspace. A customer can ask us to delete their workspace and everything in it. Write from the address on the account; see Support.
- Platform deletion callbacks. Where a platform provides a data deletion callback, we honour it for the data covered by that platform's grant.
Where it runs
Chuhai Cloud runs on servers in Hong Kong, on the public internet, reachable from anywhere. The company behind it, 1583523 B.C. LTD., is incorporated in British Columbia, Canada, and is the data controller for the workspace data described above.
The full legal terms are in the Privacy Policy and the Terms of Service. If anything on this page and those documents disagree, the legal documents govern.
Reporting a security problem
If you believe you have found a vulnerability, write to hanzili02177@gmail.com with enough detail to reproduce it. Please give us a chance to fix it before publishing. We will confirm receipt and tell you what we found.