Privacy Policy

Last updated 18 October 2026

This policy explains what Krunc ("we", "us") collects when you use https://krunc.com and the services connected to it, why we collect it, who it is shared with, and the choices you have. It applies to everyone who visits the site, creates an account, buys from a store hosted here, joins a community, plays on a game server that reports to us, or advertises through a sponsor portal.

The short version: we store what the platform needs to run, we never store identity documents, player locations are never public unless both the server and the player opt in, and payments are handled by Stripe so we never see your card number.

1. Who is responsible

Krunc operates the platform and is the data controller for platform-level data such as your account, sessions and support messages. Each creator, community or business that runs a workspace on Krunc ("workspace") is responsible for what it collects from its own members and buyers through its store, community pages and game servers. We process that data on the workspace's behalf under our Terms.

Questions or requests about this policy: use the contact form.

2. What we collect

Account

Email address, display name, password (stored as a salted hash, never in plain text), time zone and avatar.
Two-factor authentication secrets and recovery codes if you turn 2FA on, stored encrypted.
Login sessions: a random session identifier, the IP address and browser user agent at sign-in, and the last time the session was used. You can see and revoke sessions from your account page.
Your privacy settings (section 7) and notification preferences.

Profiles and content

Anything you put on a public creator profile or community page: handle, bio, banner, links, creator type, audience description.
Posts, media, captions, scheduled publishing times and the result of each publish attempt.
Blog articles, comments, event listings and other content you create inside a workspace.

Connected platforms

When you connect Twitch, YouTube, Kick, Discord, X, Facebook, Instagram, TikTok, Reddit or LinkedIn we receive the account identifier, username, avatar and the scopes you granted, plus access and refresh tokens so we can act on your behalf (publish, read live status, read follower and viewer counts). Tokens are encrypted at rest with AES-256-GCM. We request only the scopes a feature needs and we read only what you have authorized. Disconnecting an account deletes its tokens immediately.

Krunc's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. YouTube data is used only to show your live status, publish content you asked us to publish and display channel statistics to you and to advertisers you have opted in to.

Live streams and viewership

We poll connected platforms while you are live and record the stream title, category and concurrent viewer count. Raw samples are kept for 3 days and then rolled up into daily totals.
If you stream through Krunc ingest, video passes through our relay to the destinations you chose. We do not record or store the video. We keep session metadata: start and end time, bytes received, bitrate and which destinations were used.
Browser go-live sessions use your camera and microphone only while the page is open and only after you grant permission in your browser.

Store, payments and entitlements

Orders: what was bought, price, currency, status, and the Stripe identifiers for the checkout session, payment and customer.
Subscriptions mirrored from Stripe: plan, status, renewal date.
Entitlements: the perks you are owed (Discord role, server priority, credits) and the delivery log for each one.
We never see or store card numbers. Payment details are entered on Stripe's pages and handled under Stripe's privacy policy. A purchase is only confirmed when Stripe tells us by signed webhook.
Workspace owners and creators who receive payouts go through Stripe Connect. Stripe collects the identity and bank details required by law. We store only the Stripe account identifier and payout status.

Game servers and player sessions

When a community installs the Krunc FiveM resource, the server reports to us:

Server status, player count, slot count and queue length (every 30 seconds by default).
Per player: in-game name, the identifiers the server has available (FiveM licence, Discord ID, Steam ID), connect and disconnect times, and optionally the character name and job from the server's framework.
Optionally a coarse zone (for example "Vinewood"). Exact coordinates are sent only if the server administrator has enabled the admin map, and are visible only to that server's administrators.

If a player identifier matches a linked Discord ID or FiveM licence on a Krunc account, the session is attached to that account so the player's own privacy settings apply. Server administrators can restrict visibility further for everyone on their server. The effective visibility is always the more restrictive of the player's and the server's settings.

Verification

Some communities and products require age or identity verification. Verification is performed by a third-party provider on their own pages. We store only the outcome: status, the age band (for example "18+"), the date, the provider name and the provider's session reference. We never store document images, document numbers, dates of birth or selfies, and we discard the provider's webhook payload after processing. The provider's own privacy policy governs what they collect.

AI features

When you use the copilot, content generator or graphics generator, the text you type and the platform data you ask it to use (your profile, posts, products, server description) are sent to our AI providers: Anthropic for text and OpenAI for images. These providers process the request to return a result and, under their API terms, do not use it to train their models. We keep a usage record per request (feature, model, cost and a short summary) for plan limits and billing. Everything the AI creates is saved as a draft and is marked as AI-generated.

Sponsors and advertisers

Advertisers give us a company name, website, logo and contact details, and the creatives they upload.
Impressions are counted server-side per creative, creator and time slot using the viewer count at that moment. We do not identify or track individual viewers of a stream.
Creators who opt in to sponsorship share their audience profile with advertisers: follower counts, measured viewership and the region, age band, languages and category they declared themselves.

Support and contact

Messages sent through the contact form are stored with your name, email and the message so we can reply. They are also emailed to our support inbox.

Technical and security data

Server logs record request paths, response codes, timing and IP addresses for security and debugging. Tokens, passwords and payment data are never written to logs.
An audit log records who did what for money, permission and administrative actions, including the IP address, so workspace owners can review changes.
Rate limiting uses IP addresses and account identifiers temporarily in memory.

3. Cookies

We use one essential cookie: a signed session cookie that keeps you logged in for up to 30 days. It is marked HttpOnly, Secure and SameSite=Lax. We do not use advertising cookies, third-party analytics scripts or tracking pixels on the site. Stripe sets its own cookies on its checkout pages. Overlay pages that creators load in OBS use no cookies at all.

4. Why we use it

To provide the service you asked for: running your account, publishing your posts, delivering purchases, showing your server's live page. (Performance of a contract.)
To keep the platform secure: sessions, 2FA, rate limiting, audit logs, fraud and abuse detection. (Legitimate interest and legal obligation.)
To meet legal duties: tax and accounting records for orders and payouts, age gating where required. (Legal obligation.)
With your consent: connecting a social account, enabling location sharing, opting into sponsorship, using the camera for browser go-live. You can withdraw consent at any time by disconnecting or switching the setting off.
To improve the service: aggregated, non-identifying usage figures. We do not profile individuals or sell data.

5. Who we share it with

Workspaces you interact with. If you buy from a store, join a community or play on a server, that workspace's owners and staff see what is needed to serve you: your display name, email for the order, the perk you bought, your membership and, subject to your privacy settings, your play sessions.
Connected platforms (Twitch, YouTube, Kick, Discord and the others listed above) receive the content you publish and the actions you take through Krunc, under their own terms.
Stripe for payments, subscriptions, refunds, disputes and payouts.
Anthropic and OpenAI for AI features, only when you use them.
Our verification provider when you start a verification.
Our email provider to send transactional email (receipts, password resets, notifications).
Advertisers see aggregated audience and impression figures for creators who opted in. They never see member lists or individual viewers.
Authorities when the law requires it, and a successor if the business is sold, under the same commitments.

We do not sell personal data and we do not share it with data brokers.

6. Public information

Creator profiles, community pages, live server pages, blog posts and store pages are public by design and may be indexed by search engines. The public map for a game server shows only aggregated counts per zone with a minimum threshold so nobody can be singled out. Workspaces can make a profile private, which removes it from listings and the sitemap.

7. Your controls

Privacy settings on your account let you choose whether to appear online, show your username, show your character or role, show your coarse location (off by default) and show your server activity.
Export your account data as JSON from your account page at any time.
Disconnect any social account, which deletes its tokens.
Revoke all other login sessions from your account page.
Delete your account by contacting us. We remove your profile and personal data within 30 days, keeping only what we must retain (section 8).
Email notifications can be switched off in your preferences. Transactional messages such as receipts and security alerts are still sent.

Depending on where you live you may have rights to access, correct, delete, restrict or port your data and to object to certain processing. We honour these for everyone, not only where the law requires it. Contact us and we will respond within 30 days. If you are in the EU, UK or a similar jurisdiction you also have the right to complain to your data protection authority.

8. How long we keep it

Data	Retention
Account and profile	Until you delete the account, then removed within 30 days
Login sessions	30 days from last use, or until revoked
Social tokens	Until you disconnect the account or the token is revoked by the platform
Orders, invoices, payouts	7 years for tax and accounting law, with personal data minimised after account deletion
Player sessions	Controlled by the workspace; detached from your account when you delete it
Live viewer samples	3 days raw, then daily aggregates
Ingest session metadata	12 months
Verification outcome	While your account exists
Audit and security logs	12 months
Contact messages	Until resolved, at most 12 months
Backups	Encrypted nightly backups kept 14 days, then overwritten

9. Security

All traffic is encrypted in transit with TLS. Passwords are hashed, tokens and secrets are encrypted at rest, API keys are stored only as hashes and shown once, and every inbound webhook is signature-checked. Access to production systems is limited to the people who run the service and is key-based. If we discover a breach affecting your data we will tell you and the relevant authorities as the law requires.

10. Children

Krunc is not directed at children under 13, and we do not knowingly collect their data. Connected platforms have their own age requirements. Workspaces that are age-restricted must enable verification, and we do not let unverified accounts into them. If you believe a child has created an account, contact us and we will remove it.

11. International transfers

Our servers are in the United States. Connected platforms and processors listed in section 5 may process data in other countries. Where required we rely on standard contractual clauses or the provider's equivalent safeguards.

12. Changes

We will post updates here and change the date at the top. For material changes we will also notify account holders by email or an in-app notice before they take effect.