This policy explains how Starflow Extension (the “Extension”) handles account information, publishing content, comments and task data when connecting Starflow with content platforms. It also explains how you can manage authorization and your data. By installing and using this Extension, you agree to our collection and use of your information in accordance with this policy.
1. Overview and scope
The Extension works with Starflow to check platform login status, verify execution accounts, publish content, collect comments and engagement metrics, send comment replies, and synchronize task results. Supported platforms include Douyin, Xiaohongshu, Kuaishou, Zhihu, WeChat Official Accounts, Baijiahao and Toutiao. Availability depends on platform interfaces, account permissions and product configuration.
After authorization, the Extension can periodically retrieve Starflow tasks that match the execution account and run them in background tabs while the browser is running. Each task does not necessarily require a separate confirmation inside the Extension. Review the content, replies and execution accounts you configure in Starflow.
This policy covers the Extension’s data handling. Other Starflow website features and content platforms’ own processing are also subject to their respective policies. Reading this policy does not replace any authorization or consent required for a particular feature.
2. Information we handle
2.1 Starflow authorization and profile
When you authorize the Extension through Starflow or start a publishing operation from Starflow, the Extension reads the website’s stored access token to request Starflow services. The Extension’s authorization flow stores that token and selected profile fields returned by the service: user ID, nickname, email address, phone number, and subscription name, type and expiry information, where provided. The Extension does not read your account password.
2.2 Platform sessions and account identity
To check login status and avoid acting under the wrong account, the Extension uses the relevant platform’s cookies, session parameters and necessary request signatures. It reads available account IDs, names, avatar URLs, login status and check times. Account identity and status can be returned to the Starflow webpage for display and account binding; platform cookies are used to communicate with the corresponding platform.
2.3 Publishing content and media
The Extension processes titles, body text, topics, images, covers, media URLs, documents and content identifiers specified in your Starflow tasks. Some platforms use DOCX documents exported by Starflow to import content. Media URLs may contain temporary authorization parameters. Necessary content is submitted to the content platform you select.
2.4 Comments, replies and engagement
For works specified by a task, the Extension may read work URLs and IDs, comment and reply text, authors’ IDs and display names, timestamps, reply relationships, and available like, comment, share and favorite counts. Comment collection may include information about other users. Sending a reply also involves the target comment ID, target user ID, reply text and the result returned by the platform.
2.5 Task, page and technical information
To execute and verify tasks, the Extension processes relevant tab URLs, page elements and interface responses, task IDs, execution account bindings, progress, results, publishing times and errors. The Starflow webpage receives the Extension’s version and connection status. Some platform requests require browser identifiers or similar environment parameters. Task results and necessary error descriptions may be sent to Starflow.
The Extension has no advertising tracking or cross-site browsing analytics feature. Page scripts may load on declared platform pages and cache responses related to publishing, comments or metrics. This does not mean all visited page content is uploaded. Data returned to Starflow supports the tasks and status synchronization described here.
3. Browser permissions
The Extension requests the following permissions for the purposes described below. Read their scope together with the data practices in this policy.
Local storage storage
Stores Starflow authorization details, recent publishing status, and tasks, temporary media URLs and pending results for the current browser session.
Tabs and tab groups tabs / tabGroups
Finds relevant pages; opens, navigates and closes task tabs; and groups publishing, collection and reply tasks.
Scheduled work alarms
Wakes the background process while the browser is running to check pending tasks and retry incomplete result reporting.
Side panel sidePanel
Shows authorization controls, account information and platform login status.
Page scripts scripting
Runs scripts on relevant authorized pages to fill content, upload media, read information needed for tasks and verify results.
Cookies cookies
Reads session cookies for the corresponding platforms to check login status, identify accounts and make platform requests. This is a required permission in the current version, not a separate optional permission.
Request rules declarativeNetRequestWithHostAccess
Sets necessary cookie, origin and similar headers on specific platform requests to support session checks and task communication.
Website access
The Extension accesses Starflow’s official domains and relevant domains or subdomains of Douyin, Xiaohongshu, Kuaishou, Zhihu, WeChat Official Accounts, Baidu and Toutiao. Some permissions use domain wildcard patterns, while data use is limited to the functions described in this policy.
Media domains requested as needed
If a task uses a media source that has not been authorized, the Extension may request access to that HTTP or HTTPS domain. Declining can prevent the relevant image or document from loading. You can manage granted website access in Chrome.
4. How information is used
Validate Starflow authorization and display necessary account and platform connection information.
Check that the currently logged-in platform account matches the execution account bound in Starflow.
Retrieve and execute publishing, collection and reply tasks you configure in Starflow.
Return work links, comments, engagement metrics, task results and necessary error descriptions to Starflow.
Show progress, recover tasks within the browser session and retry result reporting.
The Extension’s data use is limited to these functions. It does not use user data for targeted advertising, sale or data trading. Its use of user data complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.
5. Storage and security
5.1 Persistent data on your device
The Starflow token and selected profile information are kept in browser extension local storage until authorization is disconnected, invalid authorization is cleared, or the extension data is removed.
5.2 Temporary data
Task content, media URLs containing authorization parameters, queues, execution account snapshots and pending results are mainly held in the Extension’s browser session storage. They are removed during task cleanup or when the session ends; failed result reports may remain temporarily for retry. Some platform pages also cache relevant responses in tab session storage, whose lifecycle is controlled by the page and browser.
5.3 Server-side data
Starflow servers retain business data such as comments, engagement metrics, publishing results and reply results for task management and result display. Content-platform cookies and similar session credentials are used to communicate with the relevant platforms and are not stored on Starflow servers. Uninstalling the Extension or disconnecting authorization does not automatically delete business data retained by Starflow or data held by content platforms or media services.
5.4 Security measures
The Extension communicates with Starflow over HTTPS and checks authorization page origins, authorization state and execution accounts. Browser local storage is not an additional encrypted vault implemented by the Extension. Transport security for external media depends on the source URL and protocol; HTTPS media sources are recommended.
6. Third-party services
The Extension connects to Starflow and the following content platforms. Your accounts, published content and data independently collected by these platforms are also subject to their own privacy policies and service rules.
Douyin: creator services and work pages.
Xiaohongshu: creator services, the web platform and related interfaces.
Kuaishou: creator services and work pages.
Zhihu: creator services, articles and comment pages.
WeChat Official Accounts: account administration and article pages.
Baijiahao: creator administration and related Baidu work pages.
Toutiao: creator administration and work pages.
Images, avatars and documents may also come from media services specified by a task or platform. When these URLs are requested, the provider may receive an IP address, browser request information and access parameters in the URL. This policy does not replace those providers’ own rules.
7. Data transfers and sharing
With Starflow
The authorization token is used to access Starflow interfaces, and profile information supports login checks and display. Platform account identity and status can be returned to the Starflow webpage. Publishing results, work identifiers, comments, engagement metrics, reply results and error descriptions can be sent to Starflow for task management. These workflows do not bind accounts by uploading the content platform’s full cookies to Starflow.
With your selected content platforms
To publish or reply, the Extension sends the required content, images or documents and target work or comment identifiers to the destination platform, using necessary session credentials in platform requests. Published content or replies may be visible to other users, depending on the platform and your settings.
With media services
The Extension sends requests and access parameters needed to retrieve files to the service hosting the media URL. Media domains may be determined by you or by Starflow task content.
If the operator engages other processors or discloses information as required by law, the relevant recipients, purposes and scope must be described under applicable rules.
8. Your rights and choices
Manage accounts and permissions
You can select “Disconnect authorization” (解除授权) in the Extension’s side panel to remove the local Starflow token and profile and stop subsequent scheduled task polling. This does not sign you out of content platforms or retract content or replies already submitted. You can also restrict website access, disable or uninstall the Extension in Chrome’s extension settings.
Manage local and transferred data
Removing the Extension normally removes its browser extension storage. It does not remove websites’ own login cookies, records already uploaded to Starflow or content already published on a platform. Use the relevant platform’s controls to remove works or comments.
Request access, correction or deletion
To request access to, correction, export or deletion of personal information held by the operator, use the privacy contact in Section 10 and identify the relevant Starflow account, data or tasks. Reasonable identity verification may be needed. The scope and any exceptions depend on applicable law and the information actually retained.
9. Policy updates
We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal or regulatory reasons. We will notify you of any material changes by updating the “Last updated” date at the top of this policy and, where appropriate, through the Extension or other means.
We encourage you to review this Privacy Policy periodically to stay informed about our data practices.
10. Contact us
For questions about this policy or personal information handling, please contact us using the details below.