Privacy Policy
Last updated: 26 July 2026
Kornux Creators connects game developers with content creators. This page explains exactly what we store, why, and how to get rid of it.
What we store
- Your Google account: your email address, your first name and your profile picture. We use the email to send you notifications, and the first name only to show you that you are signed in. Your first name is never shown to other users.
- Your YouTube channel, if you are a creator and you choose to
verify it: the channel identifier, its name, its public address and its
public subscriber count. We ask Google for read-only access
(
youtube.readonly) for one purpose: proving that the channel really belongs to you. We never post, modify or delete anything on your channel, and we never read your private data, your analytics or your unlisted videos. - Games you list, if you are a developer: they come from the public Steam store page of the App ID you enter.
- Key requests: which game, which creator, the date, the key the developer chose to send, and the video link the creator delivered.
What we do NOT do
- We do not sell, rent or share your data with anyone.
- We do not use advertising, tracking pixels or third-party analytics.
- We do not store your Google password — we never see it.
- We do not keep the access token Google gives us: it is used once, to read your channel, and discarded.
What other users can see
Signed-in developers can see your creator page: your verified channel, how many keys you received, and the video delivered for each one. This is the whole point of the platform — a developer giving away a game is entitled to see what previous keys were used for. Your email address and your name are never shown.
Cookies
One cookie, to keep you signed in. Nothing else. No advertising cookie, no third-party cookie.
How we protect your data
- Encryption in transit. The whole site is served over HTTPS (TLS). Your data is never sent over an unencrypted connection, and neither is the exchange with Google when you sign in or verify your channel.
- No password to steal. We never create, receive or store a password: signing in is delegated entirely to Google.
- Access tokens are never stored. The token Google gives us to read your channel is held in memory, used once, then discarded. It is never written to disk or to our database.
- Restricted storage. The database is a file on a private server, readable only by the single system account that runs the service. The application is not reachable from the internet: it listens on the server's local interface only, behind an nginx reverse proxy.
- Restricted administrative access. Only the owner of Kornux Industries can reach the server, over SSH with a private key. Password logins and root logins are disabled. No one else has access to your data.
- Protected session cookie. It is signed, HTTP-only (scripts cannot read it), Secure (sent over HTTPS only) and SameSite, which stops another site from acting in your name.
- Up-to-date server. Security updates are installed automatically every week.
- Data minimisation. We ask Google for the narrowest access that makes the feature work (read-only), and only at the moment it is needed. What we no longer need is deleted.
If we ever became aware of a breach affecting your data, we would email the users concerned.
Deleting your data
Email contact@kornuxindustries.com and we delete your account, your profile and your history. You can also revoke our access to your YouTube channel at any time from your Google account permissions; the channel then stops being verified here.
Google user data
Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
Contact
contact@kornuxindustries.com