Legal · 法律文本
Privacy Policy
中文说明：本服务是团队内部工具，仅用于让团队成员授权自己的广告账户（Meta、TikTok、Google Ads），令牌加密保存，只供授权者本人及团队内部工具使用，不出售、不共享、不用于广告定向。以下英文版本为正式文本。
1. Who we are and what this service is
quantumoauth.com (the "Service") is an internal tool operated by Quantum OAuth ("we", "us") for members of our own marketing / user-acquisition team. It is not offered to the general public. The Service lets an authorized team member connect advertising accounts they own or are permitted to manage on Meta (Facebook / Instagram), TikTok for Business and Google Ads using each platform's official OAuth authorization flow, so that the team member can use their own access tokens with our internal tooling, including an internal AI assistant, to read reports and manage campaigns for those ad accounts.
2. Information we collect
2.1 When you connect an advertising platform
You are redirected to the platform's own consent screen; we never see your platform password. After you approve, the platform returns credentials to us and we store:
- OAuth credentials: access tokens and, where the platform issues them, refresh tokens, plus their expiry times.
- Account identity: the platform user ID returned by the platform (for Meta an app-scoped user ID), and your display name and/or email address as returned by the platform.
- Granted permissions: the list of scopes you approved.
- Ad account information: IDs, names, currency, status and (for Google Ads) the manager-account hierarchy of the ad accounts you granted access to.
- Operational metadata: when the connection was created, refreshed or last failed, and an error message if a refresh failed.
2.2 Permissions (scopes) we request
| Platform | Scopes | Why |
|---|---|---|
| Meta | ads_read, ads_management, business_management | Read ad account performance and insights; create and manage campaigns, ad sets and ads; access ad accounts owned through Business Manager. |
| Google Ads | https://www.googleapis.com/auth/adwords, openid, email | Access the Google Ads API for reporting and campaign management; identify which Google account authorized the connection. |
| TikTok for Business | The advertiser permissions enabled for our app in the TikTok developer portal (e.g. ad account management, ads management, reporting) | Read reports and manage campaigns for the advertiser accounts you authorize. |
2.3 When you sign in to the Service
- Team members sign in with a shared team access code, or (if enabled) with Google Sign-In restricted to our company email domains, in which case we receive your Google email address (
openid emailonly). - We set strictly necessary cookies: a signed session cookie (valid for up to 12 hours) and a short-lived cookie (10 minutes) that protects each OAuth flow against cross-site request forgery. We use no analytics, advertising or third-party tracking cookies or scripts.
2.4 Technical logs
Our hosting infrastructure records request logs (IP address, time, requested path, user agent, response status) for security and troubleshooting. We deliberately exclude query strings, OAuth authorization codes, tokens and credential headers from our application logs.
3. How we use information
- To complete the OAuth authorization you started and to show you, and only you, the resulting tokens so you can use them with our internal tools.
- To keep connections working: automatically refreshing access tokens before they expire and periodically re-listing the ad accounts you granted.
- To let our internal tooling (including our internal AI assistant), authenticated with an internal API key, obtain a valid access token for a connection in order to read reports and manage campaigns for the ad accounts you authorized, on your behalf and on behalf of our team.
- To secure and troubleshoot the Service.
We do not sell, rent or share your information with third parties, do not use it for advertising, ad targeting, profiling or building audiences, and do not use platform data to train generalized AI or machine-learning models.
4. Google API Services — Limited Use
Quantum OAuth's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Google APIs (including the Google Ads API) is used only to provide the features described in this policy to the user who authorized it; it is not transferred to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with notice to users; it is not used for advertising; and humans do not read it except with your consent, for security purposes, to comply with law, or for internal operations when the data is aggregated and anonymized.
5. Where and how data is stored; security
- The Service runs on Google Cloud (Cloud Run). Connection data is stored in Google Cloud Firestore in the asia-east1 (Taiwan) region; requests may pass through Google's global edge network.
- Tokens and other secrets are encrypted at rest with per-record AES-256-GCM keys that are themselves encrypted with a key held in Google Cloud KMS (envelope encryption). Application secrets are kept in Google Secret Manager.
- All traffic uses HTTPS. Tokens are displayed only to the signed-in session (or Google account) that authorized the connection; other team members can see only that a connection exists and its status, never its tokens.
- Access to internal APIs requires an internal API key or an authorized Google Cloud service identity.
No method of transmission or storage is perfectly secure, but we use industry-standard measures appropriate to the sensitivity of the data.
6. Retention
- Connection data (including encrypted tokens) is kept until you disconnect it, you request deletion, or the connection is no longer needed for our team's work.
- Temporary records used during an authorization flow expire automatically (typically within 10 minutes; other short-lived onboarding records within 7 days).
- Infrastructure request logs are retained according to our Google Cloud logging retention settings (by default about 30 days).
7. Your choices: revoking access and deleting data
- Disconnect in the Service: under "My connections", choose Disconnect. We delete the connection and, where the platform supports it, revoke the token at the platform.
- Revoke at the platform: Meta — Settings & privacy → Settings → Business integrations (or Apps and websites) → remove the app; Google — myaccount.google.com/permissions; TikTok for Business — revoke the app's authorization in TikTok Ads Manager / Business Center. Revoked tokens stop working immediately.
- Request deletion: see our Data Deletion page, or email privacy@quantumoauth.com.
You may also ask us what information we hold about you, or ask us to correct it, by contacting us at privacy@quantumoauth.com.
8. Children
The Service is a business tool for our team members and is not directed to children. We do not knowingly collect information from anyone under 18.
9. Changes to this policy
We may update this policy as the Service changes. We will update the effective date above and, for material changes, notify team members who use the Service.
10. Contact
Quantum OAuth · Email: privacy@quantumoauth.com