Withanell LLC Information Security Policy

1. Purpose and scope

Withanell LLC protects TikTok Shop data by keeping it on the seller's own computer, collecting only what the live sales board needs, and encrypting the credentials that reach the shop.

BreakBoard XStream is a desktop app for Mac and Windows. It shows a live sales board in OBS for sellers who run live breaks and sales. When a seller connects their TikTok Shop, the app reads their product listings, orders and promotions so it can mark spots sold and show flash sales on stream.

This policy covers:

• the BreakBoard XStream app and any online service it uses,
• all data received through the TikTok Shop Open API,
• the developer's own computers, accounts and credentials used to build, sign and support the app.

It applies to everyone who works on BreakBoard XStream, including contractors.

2. Data we access and keep

The app requests only the TikTok Shop permissions the board needs, and it keeps less than it reads.

We never store buyers' addresses, phone numbers, email addresses or payment details. If an API response contains them, the app discards them in memory and never writes them to disk.

We do not sell TikTok Shop data, share it for advertising, or use it for anything except running the seller's board.

3. Storage and protection

TikTok Shop data stays on the seller's own computer; we run no database that holds it.

• Local storage. Board and sales data is saved in the app's data folder on the seller's computer. Its settings files can be read only by that computer's user account.
• Encrypted credentials. The shop's access and refresh tokens, and any app secret on that computer, are encrypted with the operating system's own protection: Keychain on macOS, DPAPI on Windows.
• Encryption in transit. All requests to TikTok Shop use HTTPS (TLS), and every API request is signed with HMAC-SHA256.
• Local-only by default. The app's built-in server listens only on the computer itself (127.0.0.1). The optional setting for OBS on a second computer shares a read-only view of the board on the local network, protected by a random access key the seller can replace at any time.
• Request checks. The local server rejects requests from other websites, including cross-site and DNS rebinding attempts.

4. Access control and secrets

Only the people who build and support BreakBoard XStream can reach its developer accounts and secrets, and each account is protected by two-factor authentication.

• Least access. Access to the TikTok Shop Partner Center, payment, email and code accounts is limited to people who need it for their work. It is removed the same day someone no longer needs it.
• Two-factor authentication is required on every developer account, including TikTok Shop Partner Center and email.
• Developer computers use full-disk encryption (FileVault or BitLocker), an automatic screen lock and current operating system updates.
• The TikTok app secret is never placed in source code, installers, email or chat. It is stored only in encrypted storage on approved computers, or on a BreakBoard online service when one is used.
• Seller accounts. We never ask for a seller's TikTok password. Sellers connect their shop through TikTok's own authorization page and can revoke access there at any time.
• Rotation. If a secret or token may have been exposed, it is replaced right away and the old one is revoked.

5. Secure development and updates

Every release is tested before it ships, and security fixes ship as soon as they are ready.

• Testing. Automated tests run before each release, including tests that check credentials are encrypted on disk and that Free and Pro features are enforced.
• Dependencies. Third-party packages are kept to a small set, pinned to exact versions, and updated when a security advisory affects them.
• Releases. Installers are built only on the developer's own computers and distributed through our store. Developer and test builds are never given to customers.
• Vulnerabilities. Reported or discovered security issues are fixed in priority order: critical issues within 7 days, others in the next release.
• Reporting. Anyone can report a security issue to the contact in section 8.

6. Retention and deletion

Order details are kept only for the current break, and sellers can delete everything at any time.

• Sales on the board are cleared when the seller starts a new break.
• Disconnecting the shop in the app deletes its access and refresh tokens and shop details from the computer straight away. Sellers can also revoke access from TikTok Shop Seller Center.
• Uninstalling and removing the app's data folder deletes all remaining BreakBoard data from that computer.
• Sales records the seller chooses to export (a spreadsheet file, or their own Google Sheet) belong to the seller and are kept under their control.
• Support requests. If a seller sends us data for support, we use it only for that request and delete it when the request is closed.

7. Security incidents

We notify TikTok and affected sellers within 72 hours of confirming any incident that affects TikTok Shop data.

1. Contain. Revoke or rotate any exposed secret or token, and stop the affected feature or release if needed.
2. Assess. Work out what data, sellers and versions are affected, and how it happened.
3. Notify. Tell TikTok through the Partner Center and tell affected sellers, within 72 hours of confirming the incident, or sooner if the law or TikTok's terms require it.
4. Fix. Ship a corrected release and tell sellers how to update.
5. Review. Record what happened and change this policy or our practices to prevent it happening again.

8. Third parties, review and contact

No third party receives TikTok Shop data from us.

• Payments and licensing. Lemon Squeezy handles purchases and license keys. It receives the buyer's purchase details for BreakBoard itself, never TikTok Shop data.
• Google Sheets. If a seller turns on Google Sheets sync, sales go directly from their computer to a sheet in their own Google account. We have no access to it.
• Responsibility. Withanell LLC owns this policy and is accountable for following it.
• Review. This policy is reviewed at least once a year and whenever the app changes how it handles TikTok Shop data.
• Contact. Report security issues or questions to les@withanell.com.