STORYCRAFT K-DROP / ENGLISH
Privacy, explained.
How we use information, keep records and handle your requests.
Updated: 29 September 2026 · Original adoption: 13 September 2026
Who operates this project
Storycraft K-Drop operates this independent editorial project and this website. For privacy questions, corrections or deletion requests, contact storycraft.hive@gmail.com.
The published policy was adopted on 13 September 2026. This update incorporates completed server migration and existing-connection observations through 29 September 2026. It does not establish continuing token validity, API public-upload audit approval or active automated publication.
What is connected today
The earlier owner-authorized desktop YouTube connection used read-only access and local macOS Keychain storage. A separate web-based YouTube connection was verified on 20 September 2026 with read-only and upload permissions. Its credentials were saved in encrypted storage on the project’s remote server, and one explicit token refresh was verified. These checks use account identifiers, channel and video metadata, granted permissions and connection credentials. The remote connection was refreshed and its intended channel and an existing public video were read back on 22 September 2026. The earlier desktop connection was not rechecked. Upload permission does not by itself mean that an API upload has occurred; no API upload was performed in the verified connection work.
The owner-authorized Meta web connection now has real account grants. The existing Instagram/Facebook connection has been used for account and Page identity, permissions and existing media read-only checks. Granted credentials are held in the protected server store. Supported account connections, an enabled publishing implementation and a real publication are separate; automatic publication remains held pending exact admission and current capability evidence; no real automated posts have occurred.
Separately, account-owner work in social platform interfaces has prepared drafts and published editorial content. Content handled directly by a platform is distinct from data obtained through an API connection. The existing published YouTube videos do not establish a successful API upload.
Information and purposes
The internal server has a six-hour source collection workflow and a connected preparation pipeline. Automatic AI execution remains disabled. Automatic publication remains held pending exact admission and current capability evidence; no real automated posts have occurred. The verified integration tests did not publish real test posts. The YouTube OAuth app is External/Testing, and API public-upload audit approval remains unverified. Existing Studio publications are not proof of API upload approval. The intended publishing scope for this activation is the owner’s existing English channel, not an active twelve-language public service. We are not operating viewer analytics or collecting personal comments for this audit.
We use connection information to check that the intended account is selected. Editorial content, source and rights records, approvals and action records support content preparation, review and checking what happened. We use request correspondence and the minimum account information needed to identify and resolve a privacy request.
A separately authorized account connection may use platform account or Page IDs, profile information, granted permissions and credentials. An individually approved publishing workflow may use owner-provided text, images, video and related metadata. The verified YouTube web connection includes upload permission, but the publisher implementation is connected but automatic publication remains held pending exact admission and current capability evidence; no real automated posts have occurred. The existing Meta connection supports owner-authorized identity, permissions and media read-only checks; its real account grants do not by themselves enable automated publication. We will describe a new connection’s data use and storage before asking for authorization. Read access, upload permission and an actual publishing action are separate.
Storage, sharing and service providers
The Mac preserves local development, review and historical records. The server workflow keeps its own content, source, operational and publishing records in PostgreSQL and server files; its operation does not require synchronizing the Mac databases. The web OAuth service holds its own connection records in a separate protected store. The earlier desktop YouTube connection used macOS Keychain; its remaining storage and validity have not been checked for this update. The separate web connection stores access and refresh tokens, granted scopes, issue and expiry information, and connection status and identity as encrypted credential payloads in a versioned SQLite store. Some record and version metadata remains outside those encrypted payloads; we do not claim that the entire SQLite or PostgreSQL database is encrypted. The service’s own credentials and encryption material are held separately in protected system credentials. Server access controls restrict credential access, but encryption does not guarantee protection against every server or administrator compromise. We do not include credentials in public pages or ask you to email them.
Cafe24 hosts this static website and may process connection information needed to deliver and protect it under its own service terms and privacy practices. The separate OAuth service runs on a remotely hosted server. The OAuth and automation service uses the Cafe24 VPS DEV A service on Linode/Akamai Cloud infrastructure in Osaka, Japan. OAuth tokens and automation data are stored and processed on that server. The provider does not supply automatic backups for this service. The exact legal entities and addresses of subprocessors, any logs or recovery copies outside Japan, and provider-specific retention and destruction practices remain under inquiry; we do not invent those details or promise that every provider operation stays in Japan. Email correspondence is handled through Gmail, and platform-hosted content and drafts are handled by the respective social platform under its own controls and policies.
We use information for the project and request-handling purposes described here. We do not sell connection data or use it for targeted advertising. The authorized YouTube web connection sends credentials and account queries to Google for token exchange, validation, refresh and channel verification. The existing owner-authorized Meta connection sends connection data to Meta for token exchange, validation and permitted account or Page discovery; its tokens and identity binding use the protected server storage described above. Approved API publication sends the selected text, media, links and supported metadata to the selected platform. Media requiring platform retrieval will be exposed at a public HTTPS address for that purpose. Sending content to a platform is a separate action requiring the relevant account owner’s authorization.
How long we keep information
The following rules use the purpose of each record and an event that ends or changes that purpose. They do not promise an automatic deletion service or a fixed processing deadline.
| Category | Purpose, ending event and handling |
|---|---|
| Connection credentials | Purpose: Maintain an approved connection while it is needed. Ending event: The connection ends or a valid deletion request is confirmed. Handling must cover the relevant local or remote credential store and platform authorization separately. Connection verification does not establish a completed provider revocation or deletion outcome. This update does not claim erasure of all stored record versions. Each requested action needs a reviewed procedure and a separately confirmed outcome. Limit: Stored-credential removal alone does not prove that platform authorization was revoked, or vice versa. A change to the active database record does not erase earlier encrypted versions, journal files or backups. Their handling must be included in a reviewed deletion procedure. We do not claim automatic deletion or secure erasure; we report what was completed and what remains. |
| Account and video metadata | Purpose: Verify the intended connection and check its operation. Ending event: Verification is no longer needed, the connection ends, or a valid scoped request is confirmed. We review and remove unnecessary local and remote copies or minimize identifying details. Exception: A minimal record may be retained to explain a completed action or unresolved issue; we describe its scope and reason. |
| Content, sources, rights, approvals and action records | Purpose: Prepare content, establish its rights basis, record approval and check integrity. Review event: A project closes, the record no longer serves those purposes, or a request concerns personal information in it. We review the relevant records individually and remove or minimize unnecessary personal links. Exception: Evidence still needed to explain content rights, approvals or actions may remain. We explain the retained scope and reason instead of promising to erase every project record. |
| Request correspondence | Purpose: Check, carry out and explain a request. Review event: The request and any follow-up are resolved. We remove unnecessary account-control evidence and keep only the minimum request and outcome record needed to explain the handling. Exception: Unresolved questions may require limited correspondence until resolved; we explain any relevant retention. |
| Backups | Purpose: Recover project records after loss or error. Handling event: When a backup is retired it is removed through the backup process. When it is restored, previously completed deletions or minimization are reapplied before restored data returns to active use. Limit: We do not promise immediate automatic erasure of every backup. A minimal record of completed deletion actions supports this reapplication. |
This website
These static pages contain no JavaScript, analytics, forms or externally loaded fonts. They do not collect passwords, authorization codes or tokens. Contacting us by email opens your email application; it is not a website submission form.
Google and YouTube policies
The owner-authorized YouTube connection uses YouTube API Services. Google handles information under the Google Privacy Policy. YouTube use is also subject to the YouTube Terms of Service. These links do not represent audit approval or a change to the current connection scope.
Questions, corrections and deletion
Email storycraft.hive@gmail.com. Include the platform, a public account identifier and the scope of your request. Do not send passwords, authorization codes, access tokens or refresh tokens. We may ask for a way to confirm control of the relevant account without collecting those secrets.
Read the data-deletion instructions for the steps, limits and how we report the outcome. We update this policy when practices change and show the adoption date of the updated policy.