The short version
- Your TikTok tokens are encrypted with AES-GCM before they touch our database. We never see or store your TikTok password.
- Your password is never stored. Only a salted PBKDF2 hash, which cannot be turned back into your password.
- Two step sign in. Your password, then a six digit code sent to your email.
- No API keys to leak. Your AI connects through OAuth: you approve it once and can cut it off with one click.
- Delete everything, instantly. One button removes your account, your content and your TikTok connection, and tells TikTok to revoke our access.
- Your content never trains AI. Not ours, not anyone else's.
Where your data lives
Slidemate runs on Cloudflare, the network that protects a large share of the internet. The app, its database and its storage run on Cloudflare Workers, D1 and KV. Every connection is encrypted with HTTPS, and there are no servers of ours sitting somewhere to forget to patch.
Signing in
- Passwords are hashed with PBKDF2 and a unique salt per account.
- After your password, we email you a six digit code that works once and expires in ten minutes.
- Sign in and sign up are protected by Cloudflare Turnstile, which stops bots without annoying puzzles.
- Every sign in attempt, code and sign up is rate limited, so nobody can guess their way in.
- Your session lives in a Secure, HttpOnly cookie that scripts cannot read. We only store a hash of it.
- Settings shows every place you are signed in, and one click signs out all the others.
- You can also continue with Google. Google only shares your name, email and profile picture.
Your TikTok account
You sign in on TikTok itself, never on Slidemate. TikTok hands us tokens that let Slidemate read your profile and video stats and post what you ask it to post. Those tokens are encrypted with AES-GCM before they are saved, and we refresh them the way TikTok requires.
- Slidemate only posts when you click Post, Schedule or Send to drafts, or approve a campaign.
- You choose privacy, comments and disclosure on every post, as TikTok requires.
- Slide images are kept only until TikTok has received them, then deleted.
- Remove the account on the Brand page and its tokens and stats are deleted on the spot, and TikTok is told to revoke our access.
Your AI assistant
Claude, ChatGPT, Grok and Cursor connect to Slidemate with OAuth, the same standard behind "Sign in with Google". There is no API key to copy, paste or leak. You approve each assistant once, you see every connected app on the MCP page, and you can disconnect any of them in one click.
Payments
Payments run on Stripe, which is certified to PCI DSS Level 1, the highest level in the payments industry. Your card number goes straight to Stripe and never touches Slidemate.
What we never do
- We never sell your data.
- We never show ads or use third party tracking pixels. Our own analytics only run if you accept cookies.
- We never use your slideshows, photos or TikTok data to train AI models.
- We never post to TikTok without your action or your approval.
Found a problem?
If you think you found a security issue, email hello@slidemate.app and we will get back to you fast. Please give us a chance to fix it before sharing it publicly.
Updated October 1, 2026