Security
How Farix Studio protects account access and content. This page describes practices that are actually in place; it does not claim any certification or compliance program.
Account access with OAuth
- Accounts are connected only through each platform's official OAuth consent screen. The Service never asks for, receives or stores platform passwords.
- Only the scopes needed to publish and to identify the connected account are requested.
- You can revoke access at any time from your platform settings; revoked tokens stop working immediately on the platform side.
Token handling
- Platform access and refresh tokens are stored in the operating system's credential store: the macOS Keychain or the Windows Credential Manager. The app's local database holds only a reference to each token.
- The TikTok and Meta application secrets never ship inside the app. They stay on the Farix Studio server, which completes code exchange and token renewal for signed-in users and does not store or log the codes or tokens it forwards.
- Tokens are sent only to the API of the platform that issued them (and, for TikTok and Meta exchange and renewal, through the token broker described above).
- Tokens are never shown in the app, written to log files or sent with diagnostics.
- All network requests use HTTPS.
Confirmation before publishing
- Every publication is created by the user in the app. The app shows the destination accounts and their settings, and uploads start only after the user confirms, either immediately or at the scheduled time the user chose.
- For TikTok, the app has no default privacy level, keeps Comment, Duet and Stitch off until the user turns them on, and shows TikTok's consent text before posting.
Destination checks
- YouTube: the app reads the channel that owns the token so you can see exactly which channel a connection belongs to.
- TikTok: before a post the app queries the creator's information and allows only the privacy levels, interaction settings and video durations TikTok permits for that creator.
- Facebook and Instagram: each connection is bound to a specific Page or Instagram professional account and its own token.
Preventing duplicate or lost posts
- Each destination of a publication is tracked separately, so retrying a failed destination does not post again to destinations that already succeeded.
- Uploads are resumable: after a dropped connection or a restart, the app continues the upload where it stopped.
- The number of simultaneous uploads is limited to respect platform limits.
Content handling
Video files stay on the user's computer and are uploaded directly to the selected platforms. Farix Studio's servers never receive videos, captions or publishing records.
Software updates
Installers are code-signed (and notarized on macOS). The app verifies the signature of the update information and the checksum of each installer before opening it.
This website
- Served only over HTTPS, with plain HTTP requests redirected to HTTPS.
- Static pages with no forms, cookies, analytics or third-party scripts.
- A restrictive Content Security Policy and standard security headers.
- The website pages never receive videos or tokens; the app's server endpoints are separate and described above.
Reporting a vulnerability
If you believe you found a security issue, email support@farixstudio.com with the subject “Security report” and enough detail to reproduce it. Please do not access other people's data or disrupt the Service while testing. We will acknowledge valid reports and work on a fix.