Security

Security and data handling

Merist HQ is designed so that platform access is granted by the account owner, limited to the scopes that owner and the platform approve, and revocable at any time.

Official authorization

Account connections use each platform’s official OAuth or equivalent authorization. Merist does not ask for, collect, or store platform passwords.

Scoped access (analytics and publishing)

Depending on the platform and the scopes granted, Merist may retrieve account identity and content performance metrics, and — where approved — upload or publish content to the connected account. Merist does not perform actions outside those granted permissions and does not act on accounts that never authorized the app.

Credentials and tokens

When a platform issues access and refresh tokens, those tokens are stored on Merist’s servers and encrypted at rest. They are not displayed on these public pages or in ordinary product screens. API keys, client secrets, and tokens are not published on this website.

Data obtained from platforms

Typical permitted fields include account identifiers, display names, and performance metrics such as views, likes, comments, and shares when the platform provides them. For publishing workflows, Merist may also handle content media and metadata the operator submits for upload or Direct Post to the connected account. Metrics a platform does not return stay missing. They are not filled with zero.

Disconnection and revocation

An operator can disconnect a platform inside Merist, which removes the stored tokens for that connection. The account owner can also revoke the app in TikTok, Google, Meta, or X account settings. After revocation, Merist cannot retrieve new analytics or perform publishing actions for that account using the revoked grant.

Ownership

Connecting an account does not transfer ownership of that account or its content to Merist. Merist provides tooling under the permissions the user granted.

Use of the data

Data is used to provide connected-account publishing and analytics functionality, to measure Merist content, and to inform later creative decisions. It is not sold. See the Privacy Policy and Terms of Service for the governing statements.