Privacy Policy

Account data: email, username, password (stored only as a salted hash), and your self-attested date of birth (used to verify you are 18+). Profile data for creators: display name, bio, and connected platform handles. Payment data: card details are collected and stored by Stripe, not by us — we keep only non-sensitive references (e.g., card brand and last four), transaction records, and, if you use a wallet, your store-credit balance and top-up history. Usage and security data: pledges, ideas, IP address, device/user-agent, and cookies or similar identifiers used for login, sessions, and security events.

Creator identity verification (KYC) and payouts are handled by Stripe Connect. Stripe collects and verifies government identity information directly; Kamirin does not build or store its own government-ID verifier. We receive only verification status and the limited fields needed to operate payouts and tax reporting.

When a creator links a platform account (e.g., Twitch, YouTube, Kick, TikTok, Facebook, Instagram) via OAuth, we receive that account’s public identifiers — its canonical id, handle, display name, channel link, and, where the platform exposes one, that platform’s own verified or tier signal — to prove ownership and help prevent impersonation. For YouTube we request only the channel’s public profile and do not receive a subscriber count. Where another platform returns a follower count alongside those identifiers, we do not store it; channels connected before October 2026 may still carry a count we stored at the time. Access tokens are encrypted at rest and are never exposed to the browser.

You can disconnect a platform at any time. When you disconnect, we delete the stored access tokens and the connected-account record, and — where the platform offers a way to do it — we also ask that platform to withdraw our access; limited identifiers (such as the platform id and handle) may persist in our security and audit logs and, for creators, in the public creator directory, as described in Section 8. Each connected platform’s own use of your data is governed by that platform’s terms and privacy policy. For TikTok specifically, our use of TikTok data is subject to TikTok’s developer and privacy terms; you can review TikTok’s Privacy Policy and revoke Kamirin’s access at any time from your TikTok account settings, and disconnecting removes the TikTok tokens we hold.

To operate the marketplace (pledging, acceptance, delivery, settlement, refunds); to verify eligibility and identity; to provide notifications and security alerts; to prevent fraud, abuse, and money laundering; to comply with legal and tax obligations; and to improve the service. We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law. We currently send only transactional and security email, not marketing.

We share data with service providers that operate the Platform under contract — notably Stripe (payments and identity), our transactional email provider, the connected platforms you link, and our cloud hosting and infrastructure providers — and as required by law or to protect rights and safety. A current list of key sub-processors is available on request. Public information you choose to publish (e.g., a creator page or a pledge shown in the public Backers board) is visible to others according to your visibility settings.

We use cookies and similar technologies that are necessary to run the Platform — to keep you signed in, secure sessions, and complete OAuth logins. We do not use third-party advertising cookies or cross-site behavioral tracking. You can control cookies through your browser.

To protect the marketplace, we run automated checks — including fraud, velocity, and collusion signals — that can flag, hold, decline, or reverse transactions and route content or deliveries for human review. These checks inform decisions that may affect your account or a payment. You can contact us to ask about a decision and request human review.

You can access a portable copy of your data and delete your account from your account settings, and correct your profile details there. Depending on where you live, you may also have the right to know what we collect, to request deletion or correction, to opt out of any “sale” or “sharing” (we do neither, as defined above), to limit use of sensitive information, and not to be discriminated against for exercising these rights. You can exercise these rights, use an authorized agent, or appeal a decision by contacting privacy@kamirin.com.

When you delete your account, we scrub your personal data and close the account. For legal, tax, and financial-integrity reasons, money and audit records are retained (some may contain the limited identifiers described in Section 3), and deletion is blocked while you have active charged pledges or a held payout. We keep personal data only as long as needed for the purposes above or as the law requires; transaction and audit records are retained for the periods required by financial and tax law (generally at least seven years).

The Platform is for adults 18 and older. We require users to attest that they are 18+, and we may request verification. We do not knowingly collect data from anyone under 18, and accounts found to belong to minors are removed.

The Platform is intended for users in the United States and is not directed to the European Economic Area or the United Kingdom. Your data is processed in the United States. If you access the Platform from outside the United States, you consent to that processing.

We protect accounts with hashed passwords, authenticator-app two-factor authentication, revocable sessions, encryption of sensitive tokens at rest, signed and idempotent payment webhooks, and an immutable audit log of money and moderation events. No system is perfectly secure, but we design to minimize what we hold and to detect misuse. If a breach affects your personal data, we will notify you and the authorities as required by law.

Kamirin uses YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms), and Google’s use of your information is governed by the Google Privacy Policy (https://policies.google.com/privacy).

What we access. When you connect YouTube we ask Google for one read-only permission, youtube.readonly, and use it once — at the moment you connect — to read your channel’s public profile through the YouTube Data API. We do not ask for offline access, so Google issues us no refresh token and we cannot read anything after that first request. We never access your videos, playlists, comments, subscriptions, analytics, or private data, and we never post, message, or act on your behalf. We store no YouTube data on your device; the cookies we use on kamirin.com are described in Section 6.

What we keep, and why. From that single request we store your channel’s id, its title, its custom URL (your @handle) and a link to the channel. We use them to prove you control the channel, to show your connected channel on your creator page, to set your public Kamirin handle, and to match you with boards and directory entries for your channel. We do not receive or store your subscriber count. The access token is encrypted at rest, is never exposed to the browser, and expires about an hour after you connect.

How long we keep it. We delete stored YouTube data within 30 days, as YouTube’s developer policies require: a scheduled job clears your channel’s title, handle, link and any other channel details, together with the access token, once the connection is older than that. We keep your channel’s id and the date ownership was proved, so that you stay connected and your claim to your own channel survives. If you disconnect, we delete the YouTube data and tokens we hold at that point. We also delete them when you delete your Kamirin account.

Who we share it with. We do not sell YouTube data, do not use it for advertising, and serve no advertising on Kamirin. We share it only with the service providers that host and operate the Platform, and where the law requires it. We would transfer information received from Google APIs as part of a merger, acquisition, or sale of assets only with your explicit prior consent.

How to disconnect or revoke access. You can disconnect YouTube at any time on your creator connections page, which deletes the connection and asks Google to withdraw our access. Where that request cannot be completed — for example because the access token has already expired — you can withdraw it yourself at any time from Google’s permissions page at https://myaccount.google.com/permissions. Privacy questions about this section can be sent to privacy@kamirin.com, as described in Section 13.

Kamirin’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We may update this Policy; the version above will change for material updates. Privacy questions and data-rights requests can be sent to privacy@kamirin.com.