Privacy Policy
Last updated: 15 September 2026
What Krinio accesses
- If you sign in with Google: your Google account ID, email address, name and profile picture. Krinio requests only Google’s basic sign-in permissions for your email address and profile.
- If you connect a YouTube channel: with the read-only youtube.readonly permission, Krinio retrieves your channel ID, title, handle or custom URL, channel picture and subscriber count, unless you have hidden the count on YouTube. Krinio retrieves nothing else from your Google or YouTube account, such as videos, playlists, subscriptions, comments or analytics, and it cannot upload, change or delete anything on YouTube.
- The OAuth tokens Google issues when you grant access. Krinio stores only the YouTube refresh token on its servers, in encrypted form, so it can refresh your channel details every day. Other tokens are used only for your current sign-in session or connection.
How Krinio uses it
Krinio uses Google user data only to provide and improve features you use in Krinio:
- Creating your Krinio account, signing you in and keeping your session secure.
- Prefilling your profile name and username during onboarding, where you can edit them, and setting your profile picture from your Google account or your connected channel.
- Showing your connected channel with its title, handle, link and subscriber count on your public profile and next to your ideas.
- Refreshing your channel details, including the subscriber count, once a day while the channel is connected.
- Checking that a channel is connected where a feature requires one, for example before you publish an idea or redeem a membership code.
- Showing the automatic channel verification mark when your profile name and username match your connected channel, and letting you use your own channel’s name when Krinio checks new profile names against its list of protected creator names.
- Sending you emails about your account, your ideas, suggestions and Support payments.
- Prefilling your email address at checkout, and your email address and channel link when you set up payouts with Stripe.
With whom Krinio shares, transfers or discloses it
Krinio does not sell Google user data. Krinio shares, transfers or discloses Google user data only with the following recipients and only for the purposes described:
- Other Krinio users and the public
- Your profile name, username and profile picture are public, including when they were prefilled from Google or YouTube. If you connect a channel, its title, handle, link and subscriber count and your verification mark are public too. This information appears on your profile and your ideas, in Discovery, and in notifications and emails Krinio sends to people you interact with, such as a creator you support or the supporters of your ideas. When you choose anonymous Support, Krinio hides your name and profile from the creator and the public for that payment. Krinio never shows your email address, Google account ID or tokens to other users. The creator you support can see your payment email address in Stripe, as described below.
- Supabase (Supabase Inc.)
- Provides Krinio’s sign-in service, including sign in with Google, and hosts Krinio’s database and file storage. It stores your account and profile data, your connected channel details, the copy of your channel picture and the encrypted refresh token. Production data is stored in the EU (Stockholm).
- Vercel (Vercel Inc.)
- Hosts krinio.com and runs the server code that receives Google user data from Google and passes it to the services listed here. Vercel processes the data while it handles these requests.
- Stripe (Stripe Payments Europe Limited and Stripe group companies)
- When you make a Support payment or buy a membership, Krinio sends Stripe your account email address to prefill checkout. Support payments are processed on the receiving creator’s own Stripe account, so that creator can see the email address used for the payment in their Stripe Dashboard, including for anonymous Support. When you set up payouts, Krinio sends Stripe your email address and your connected channel link as your contact email and business website, which you can review during Stripe onboarding.
- Resend (Resend Inc.)
- Delivers Krinio’s emails. Resend receives your email address and the content of each email, which can include your profile name or username and the names of the creators or supporters involved.
- Receives the requests Krinio makes to sign you in, exchange and refresh tokens and retrieve your channel details.
- Authorities, security and business transfers
- Krinio discloses Google user data when applicable law, a court order or a binding request from a competent authority requires it, or when this is necessary for security purposes such as investigating fraud or abuse. Krinio would transfer Google user data as part of a merger, acquisition or sale of its assets only after obtaining your explicit prior consent.
Krinio never transfers or sells Google user data to advertising platforms, data brokers or information resellers. Krinio never uses or transfers Google user data to serve advertising, including retargeting, personalized or interest-based advertising, to determine creditworthiness or for lending purposes, or to develop, improve or train generalized artificial intelligence or machine learning models. Apart from the information that is public on your profile, nobody at Krinio reads your Google user data unless you have agreed to it for a specific request, for example when you ask us for help or request a verification review, it is necessary for security purposes such as investigating abuse, it is necessary to comply with applicable law, or the data has been aggregated and is used for internal operations.
How Krinio protects it
Krinio encrypts Google user data in transit with TLS and stores it in an EU-hosted database that is encrypted at rest. Database permissions and row-level security limit each account to the data it may read, and administrative access to production systems is limited to the operator. The YouTube refresh token is additionally protected with authenticated encryption in Supabase Vault, is decrypted only by the server-side code that needs it and is never sent to your browser. Krinio requests only read-only access to YouTube. Further measures are described under Data Security.
Retention, revocation and deletion
Krinio keeps Google sign-in data until your Krinio account is deleted. While a channel is connected, Krinio refreshes its details, including the subscriber count, every day. If Krinio can no longer read the channel, for example because you revoked access or Google ended the connection, it tells you in the app and by email and hides the subscriber count. Unless you reconnect, Krinio deletes the channel details, the refresh token and the imported channel picture 28 days after the last successful refresh. You can disconnect the channel at any time in Settings under Social accounts: Krinio then revokes its access at Google and deletes these immediately. You can also revoke Krinio’s access on the Google security settings page. To delete your Google user data or your Krinio account, email contact@krinio.com. We delete the requested Google user data as soon as possible and at the latest within 7 days. Records that Krinio must keep by law, such as payment records, are retained for the periods described under Data Retention.
Krinio’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
For questions or complaints about how Krinio handles Google user data, email contact@krinio.com.
Email address
Collected when you join the waitlist. After double opt-in confirmation, it is used for Krinio launch information and limited Ambassador membership release updates. Legal basis: consent (Art. 6(1)(a) GDPR). Stored until you unsubscribe, withdraw consent, or request deletion. We also record which of those announcements have already been sent to you, so a repeated send cannot reach you twice; that record is deleted together with your waitlist entry.
IP address
Stored at signup to prevent abuse (e.g. mass fake signups). A separate short-lived rate-limit event records the IP address for up to two hours to enforce five valid waitlist actions per hour. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). The signup IP address is retained for 90 days, then deleted. We also use the approximate country supplied by our hosting provider from the request IP address to display membership prices in an appropriate currency (Art. 6(1)(f) GDPR, legitimate interest in localized pricing). This value is processed for the request and is not saved to your profile or a pricing cookie.
Confirmation token
A random UUID generated at signup, used solely to verify your email address via a confirmation link.
Google sign-in data
If you choose Sign in with Google, Krinio receives your Google account identifier, email address, name, profile image, and authentication and session data through Google OAuth and Supabase Auth. We use this information to create and authenticate your Krinio account and prefill its profile. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). The account data is retained until you delete your Krinio account; session and authorization data is retained until it expires, you sign out, or the account is deleted. Who receives this data is described under Google User Data.
Connected YouTube channel data
If a creator explicitly connects a YouTube channel, Krinio uses the YouTube Data API with the read-only youtube.readonly scope to retrieve only the authenticated channel's ID, title, handle or custom URL, thumbnail, and public subscriber count. We store these values, the channel picture's address, when the channel was last refreshed and whether Krinio lost access, together with a server-side refresh token encrypted as described under Data Security. We use them to link and display the channel, refresh its details and subscriber count every day, and optionally copy the selected channel image into the Krinio avatar. Krinio does not upload, edit, or delete YouTube content. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). The channel record and refresh token are retained while the channel is connected. If Krinio can no longer read the channel, for example because access was revoked in your Google Account, we notify you and delete the record, the token and the imported picture 28 days after the last successful refresh unless you reconnect. Disconnecting the channel in Settings deletes them immediately, and we complete a deletion request within 7 days. Who receives this data is described under Google User Data.
Saved ideas
When you are signed in and save an idea, we store the link between your account and that idea to provide your private Saved list. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Retained until you remove the idea or delete your account.
Idea notifications you turn on
When you are signed in and ask to be notified about an idea, we store the link between your account and that idea so we can send you in-app notifications when its support window is about to close and when its finished content is posted. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Retained until you turn the notifications off, the idea is deleted, or you delete your account.
Community feedback, votes, and content reports
When you submit feedback or report an idea or feedback post, we store the feedback fields, report target, selected reason, optional explanation, moderation status, and the link to your account. Approved feedback and its author profile are visible to signed-in members; report reasons, explanations, voter identities, and reporter identities are not public. We process this to provide the feature (Art. 6(1)(b) GDPR) and for moderation, abuse prevention, and product improvement (Art. 6(1)(f) GDPR). Reports are retained while needed to review and document moderation decisions, then deleted or anonymized when no longer necessary.
In-app notifications
We store notification type, relevant resource identifiers, limited event details, creation time, and read time so we can notify you about important account, feedback, and support events. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Creators also receive an email when one of their ideas receives a support payment.
Language preference
We store the language you use in the app on your profile so we can send transactional email in that language, and the language you were reading in when you joined the waitlist so waitlist email reaches you in it. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) for the profile value, consent (Art. 6(1)(a) GDPR) for the waitlist value. Retained until you delete your account or unsubscribe from the waitlist.
Requested payout country
If payouts are not yet available in your country, we store the country code you select together with your account to measure demand and prioritize new payout countries. Legal basis: legitimate interest in product and market planning (Art. 6(1)(f) GDPR). Retained until you choose another country or delete your account.
Support payment and payout records
We store the amount and status of a support payment; its links to the idea, supporter and creator; the anonymity choice; Krinio commission, Stripe fee and creator net amount; and Stripe account, Checkout Session and PaymentIntent identifiers. We receive and validate the currency during payment processing but do not store it in Krinio's database. We process this to perform the payment service (Art. 6(1)(b) GDPR), prevent fraud and handle claims (Art. 6(1)(f) GDPR), and meet financial recordkeeping duties (Art. 6(1)(c) GDPR).
Creator payout onboarding
Krinio stores the connected Stripe account identifier and checks payout readiness directly with Stripe when needed to enable creator payments. Stripe collects identity, contact, business, bank, tax and verification information directly during onboarding under its own privacy terms. Krinio does not receive raw bank details or identity documents. Legal bases: performance of a contract (Art. 6(1)(b) GDPR), compliance obligations (Art. 6(1)(c) GDPR), and fraud prevention (Art. 6(1)(f) GDPR).
Membership purchases and billing
For a creator membership or lifetime license, Krinio stores the selected offer, entitlement and purchase status; Stripe Customer, Checkout Session, Price, Subscription, PaymentIntent and invoice identifiers where applicable; currency, subtotal, tax and total; billing period, cancellation and refund status; and the connected-account country used for eligibility. Stripe collects the billing address, payment method and any business tax ID directly. Krinio does not store complete card details or the raw tax ID. Legal bases: contract performance (Art. 6(1)(b) GDPR), financial and tax obligations (Art. 6(1)(c) GDPR), and fraud and claims prevention (Art. 6(1)(f) GDPR). In the signed-in membership overview, Krinio retrieves the payment-method type, card brand and last four digits from Stripe for display. These masked details are not stored in Krinio's database. For an active Ambassador lifetime membership, we derive a public avatar decoration from the entitlement record and display it wherever your account avatar appears (Art. 6(1)(b) GDPR, contract performance). This decoration indicates Ambassador membership; the release, price and billing details remain private. Anonymous support payments display no membership decoration. The decoration is removed when the membership is revoked or otherwise ceases to be active.
Membership codes and granted memberships
For the waitlist launch offer, Krinio stores a single-use redemption code linked to your waitlist entry, when it was emailed, and when and by which account it was redeemed. Redeeming it creates a record of the granted plan with its start and end date, kept after the grant expires so the same offer cannot be issued twice. A grant has no purchase behind it, so no payment data is involved. Legal bases: performance of a contract (Art. 6(1)(b) GDPR) and prevention of abuse of the offer (Art. 6(1)(f) GDPR).
Manual verification requests
When an eligible paid creator requests the reviewed verification mark, Krinio stores the request status, submission and review times, and an internal reviewer note. Payment does not guarantee approval. The data is used to provide and document the review process (Art. 6(1)(b) GDPR) and to prevent impersonation, abuse and disputes (Art. 6(1)(f) GDPR).
Creator video overlays
Overlay captions, appearance settings and video files are processed in browser memory to provide the export you request (Art. 6(1)(b) GDPR). Krinio does not upload or save these inputs or output files. The downloaded file remains on your device until you delete it. Each export sends your IP address, website origin, render type, environment and success or failure state to Remotion for license accountability (our legitimate interest under Art. 6(1)(f) GDPR). Video content, captions and profile handles are excluded from this telemetry. Remotion currently retains telemetry indefinitely; you may exercise your privacy rights with Remotion.
Supabase (Supabase Inc.)
Database and backend hosting. Production data stored in EU-region (Stockholm). Privacy policy: supabase.com/privacy
Google (Google Ireland Limited and Google LLC)
Google Sign-In and YouTube API Services, including the YouTube Data API. Google processes the account, authorization, network, and device data needed to authenticate you, present the consent screen, and grant the permissions you select, and provides the authorized data to Krinio. Google may act as an independent controller for activities it determines itself. Transfers outside Switzerland, the EEA, or the UK are governed by Google's applicable data-protection terms and safeguards, including Standard Contractual Clauses where applicable. How Krinio uses, shares and protects the data it receives from Google, including the Limited Use commitment, is described under Google User Data. Privacy policy: policies.google.com/privacy
Stripe (Stripe Payments Europe Limited and Stripe group companies)
Payment processing, creator identity and business verification, fraud prevention, connected accounts, payouts, creator membership billing, Stripe Tax, tax-ID validation, invoices and subscription management. Stripe receives payment, billing, contact, identity, business, bank, tax, device, and transaction data as needed for those services. Krinio itself sends Stripe your account email address to prefill checkout and, when you set up payouts, your email address and connected channel link. Support payments are processed on the receiving creator's Stripe account, so that creator can see the payment details Stripe shows there, including the supporter's email address. Transfers outside Switzerland, the EEA, or the UK are governed by Stripe's Data Processing Agreement and safeguards including Standard Contractual Clauses where applicable. Privacy policy: stripe.com/privacy. Data Processing Agreement: stripe.com/legal/dpa
Resend (Resend Inc.)
Transactional email delivery. Used for double opt-in confirmations, secure waitlist unsubscribe links, consented launch and limited Ambassador release updates, membership codes, and account emails such as Support payment confirmations, notifications to creators about received Support payments and suggestions, notices to supporters when a suggested idea's finished content is posted, confirmations of granted memberships, and notices that Krinio lost access to a connected YouTube channel. Resend receives the recipient's email address and the content of the email. Privacy policy: resend.com/legal/privacy-policy
Vercel (Vercel Inc.)
Web hosting and edge infrastructure. Also provides Vercel Web Analytics (aggregate, cookieless usage statistics) and Vercel Speed Insights (anonymous Core Web Vitals measurement, stored without an IP address). Privacy policy: vercel.com/legal/privacy-policy
Telegram (Telegram Messenger Inc.)
Delivery of privacy-minimized operational alerts about new feedback, idea reports and payment processing problems to the Krinio operator. Feedback alerts contain only the deployment environment, category, and aggregate moderation counts. Idea report alerts contain the deployment environment, public idea title and identifier, selected report reason, and optional explanation. Reporter identity is never sent. Payment alerts are sent when Krinio cannot process a Stripe notification about a Support payment or a membership. They contain the deployment environment, the affected Stripe endpoint, the Stripe event type and identifier, the creator's Stripe account identifier where one exists, live or test mode, and a technical reason code. They never contain names, email addresses, payment amounts or payment method details. Telegram receives the operator's chat identifier and these limited operational details. Telegram states that EEA user data is stored in the Netherlands and that transfers to group companies outside the EEA use Standard Contractual Clauses. Privacy policy: telegram.org/privacy
Browser video rendering and operational license verification. Remotion AG is based in Switzerland. Exports transmit the limited telemetry described above to its licensing service; Remotion determines the purposes and retention of this license data.