Privacy Policy

Last updated: July 25, 2026

This is a working draft prepared to match Kitscore's current product (accounts, evidence uploads, evaluations, Stripe billing, connected YouTube/TikTok/Instagram/Twitch/Discord accounts, and mutual campaign confirmation). It is not legal advice. Have a lawyer review it for GDPR, UK GDPR, and CCPA compliance before relying on it at scale, particularly around evidence retention, cross-border data transfer if you have EU/UK users, and Meta's Platform Terms for the Instagram integration.

1. Who we are

Kitscore is operated by GHG Consulting LLC, a New York State registered limited liability company. This policy explains what data we collect through kitscore.co and our app, why, and what choices you have.

2. What we collect

Category	Examples	Who it applies to
Account data	Name/company name, email, password (hashed), account role (creator or sponsor)	Everyone with an account
Profile data	Niche, location, business email, supported platforms	Creators
Evidence you submit	Screenshots, analytics exports, campaign documentation, brand safety questionnaire answers	Creators
Platform connection data	When you connect a YouTube, TikTok, Instagram, Twitch, or Discord account, we receive your channel/account ID, display name or handle, and public statistics (follower/subscriber count, view count, video/post count, or server member count, as available from that platform). For YouTube, this is read via the `youtube.readonly` scope, limited to the channel belonging to the Google account you sign in with. For Instagram, this is read via Meta's Instagram Graph API using read-only scopes tied to the Instagram professional account you authorize. For Twitch, this is read via the Twitch API using read-only scopes tied to the Twitch account you authorize. For Discord, this is read via Discord OAuth2's `identify` and `guilds` scopes, and is limited to confirming a server you own and its approximate member count. In every case we never request access to post, upload, edit, or delete anything on your connected account, and we never request a Discord bot installation or access to message content.	Creators who connect a platform account
Campaign & evaluation data	Campaign briefs, mutual confirmations, sponsor ratings/endorsements, evaluation requests and outputs	Creators & sponsors
Billing data	Payment processed by Stripe — we receive confirmation of payment and a Stripe customer reference, not your full card number	Anyone making a paid purchase
Usage data	Pages visited, session activity, basic device/browser info, via essential cookies and standard server logs	All visitors

3. How we use it

To create and run your account, and to generate Trust Scores, Reliability Scores, and evaluation reports.
To verify that you own the YouTube, TikTok, Instagram, Twitch, or Discord account (or, for Discord, server) you claim, and to pull public channel/account/server statistics that feed into your Trust Score and Reliability Score.
To process payments and manage subscriptions via Stripe.
To verify evidence and facilitate mutual campaign confirmation between creators and sponsors.
To detect fraud, fake evidence, or abuse of the scoring system.
To communicate with you about your account, evaluations, or billing.
To improve the product and understand usage patterns.

We do not sell your data, and we do not share it with advertisers.

4. How creator data is shown to others

If you're a creator, parts of your profile are designed to be visible to sponsors by nature of the product — this includes your Trust Score, Reliability Score, badge tier, niche, location, and (for verified campaigns) the fact that a campaign was mutually confirmed. Evidence files themselves are not made public; they back the score but aren't displayed raw. Self-reported, evidence-submitted, and live-verified data are labeled separately so sponsors can see the source.

If you're a sponsor, submitting endorsement feedback on a completed campaign (ratings, would-hire-again status, and any notes you write) may appear publicly on that creator's profile, visible to anyone browsing Kitscore — not only to the creator. By default this feedback is attributed to "Verified sponsor," not your company name. Your company name is shown alongside your feedback only if you explicitly opt in at the time you submit it.

5. Google and YouTube data specifically

If you connect your YouTube account, Kitscore's use of the resulting Google user data is limited as follows:

What we access: read-only access to the channel belonging to the Google account you authenticate with (channel ID, title, handle, subscriber count, view count, video count), via the youtube.readonly OAuth scope. We do not request write, upload, or delete access to your YouTube channel.
What it's used for: confirming you own the channel you claim, and computing the Trust Score and Reliability Score metrics shown on your profile. It is not used for any other purpose.
AI/ML training: Google user data obtained through this connection is not used to develop, improve, or train any AI or machine learning models, and is not transferred to any third-party service for that purpose.
Sharing: Google user data obtained this way is not sold, and is not shared with advertisers or data brokers. It is stored with our infrastructure provider (Supabase, see below) solely to operate the Service.
Retention: we retain the access/refresh tokens and channel statistics for as long as the connection remains active on your account, or until you ask us to remove it.
Revoking access: you can revoke Kitscore's access to your Google account at any time from your Google Account permissions page, and you can ask us to delete the connection and associated data from Kitscore by emailing hello@kitscore.co.

Kitscore's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Meta (Instagram) data specifically

If you connect your Instagram account, Kitscore's use of the resulting Meta/Instagram data is limited as follows:

What we access: read-only access to the Instagram professional (Business or Creator) account you authorize via Meta Login and the Instagram Graph API — your Instagram user ID, username, account type, and public statistics (follower count, media count, and basic engagement metrics where the API makes them available). We do not request permission to post, message, or edit anything on your behalf.
What it's used for: confirming you own the Instagram account you claim, and computing the Trust Score and Reliability Score metrics shown on your profile. It is not used for any other purpose.
AI/ML training: data obtained through this connection is not used to develop, improve, or train any AI or machine learning models, and is not transferred to any third-party service for that purpose.
Sharing: data obtained this way is not sold, and is not shared with advertisers or data brokers. It is stored with our infrastructure provider (Supabase, see below) solely to operate the Service.
Retention: we retain the access token and account statistics for as long as the connection remains active on your account, or until you ask us to remove it.
Revoking access & deletion: you can revoke Kitscore's access at any time from your Instagram or Facebook account settings (Apps and Websites), and you can request deletion of the Instagram data we hold using the process on our Data Deletion Instructions page.

Kitscore's use of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies.

7. Twitch data specifically

If you connect your Twitch account, Kitscore's use of the resulting Twitch data is limited as follows:

What we access: read-only access to the Twitch account you authorize via Twitch OAuth — your Twitch user ID, display name, and public statistics (follower count, channel/account creation date, and stream/VOD metadata where the API makes it available). We do not request permission to stream, moderate, or post on your behalf.
What it's used for: confirming you own the Twitch account you claim, and computing the Trust Score and Reliability Score metrics shown on your profile. It is not used for any other purpose.
AI/ML training: data obtained through this connection is not used to develop, improve, or train any AI or machine learning models, and is not transferred to any third-party service for that purpose.
Sharing: data obtained this way is not sold, and is not shared with advertisers or data brokers. It is stored with our infrastructure provider (Supabase, see below) solely to operate the Service.
Retention: we retain the access token and account statistics for as long as the connection remains active on your account, or until you ask us to remove it.
Revoking access & deletion: you can revoke Kitscore's access at any time from your Twitch connected accounts settings, and you can request deletion of the Twitch data we hold using the process on our Data Deletion Instructions page.

Kitscore's use of information received from the Twitch API adheres to the Twitch Developer Agreement and Twitch Developer Services Agreement.

8. Discord data specifically

If you connect your Discord account, Kitscore's use of the resulting Discord data is limited as follows:

What we access: read-only access via Discord OAuth2, scoped to identify and guilds only — your Discord user ID and username, and the list of servers you belong to solely to identify a server you own and read its approximate member and online-presence count. We do not install a Discord bot, and we do not request access to messages, message content, or any server management action.
What it's used for: confirming you own the Discord server you claim, and computing the Trust Score and Reliability Score metrics shown on your profile from its member count. It is not used for any other purpose.
AI/ML training: data obtained through this connection is not used to develop, improve, or train any AI or machine learning models, and is not transferred to any third-party service for that purpose.
Sharing: data obtained this way is not sold, and is not shared with advertisers or data brokers. It is stored with our infrastructure provider (Supabase, see below) solely to operate the Service.
Retention: we retain the access token and server statistics for as long as the connection remains active on your account, or until you ask us to remove it.
Revoking access & deletion: you can revoke Kitscore's access at any time from your Discord Authorized Apps settings, and you can request deletion of the Discord data we hold using the process on our Data Deletion Instructions page.

Kitscore's use of information received from the Discord API adheres to Discord's Developer Terms of Service and Developer Policy.

9. Who we share data with

Provider	Purpose
Supabase	Database, authentication, and file storage for accounts, evidence, and evaluation data
Stripe	Payment processing for evaluations and subscriptions
YouTube Data API (Google)	Source of channel statistics when you connect a YouTube account — see Section 5. This is a data source we read from, not a party we share your Kitscore data with.
TikTok API	Source of account statistics when you connect a TikTok account. This is a data source we read from, not a party we share your Kitscore data with.
Instagram Graph API (Meta)	Source of account statistics when you connect an Instagram account — see Section 6. This is a data source we read from, not a party we share your Kitscore data with.
Twitch API	Source of account statistics when you connect a Twitch account — see Section 7. This is a data source we read from, not a party we share your Kitscore data with.
Discord API	Source of server ownership and member-count statistics when you connect a Discord account — see Section 8. This is a data source we read from, not a party we share your Kitscore data with.

Each processes data on our behalf under its own data processing terms. We don't share your information with any other third party except where required by law, to investigate fraud, or to protect the rights and safety of our users.

10. Cookies

We use essential cookies/local storage required to keep you signed in and to operate the Service securely. We do not currently use third-party advertising or tracking cookies. If that changes, we'll update this policy and add a cookie notice.

11. How long we keep data

Account & profile data: kept while your account is active, and for a reasonable period after closure for legal, tax, and fraud-prevention purposes.
Evidence & evaluation records: kept to preserve the integrity of historical scores and Verified Campaign records, even if a profile is later deactivated, unless deletion is legally required.
Billing records: kept as required for tax and accounting purposes.

12. Your choices

You can ask us to access, correct, or delete the data we hold about you by emailing hello@kitscore.co, or, for connected-platform data specifically, using our Data Deletion Instructions. Note that deleting evidence tied to a mutually confirmed campaign may affect the accuracy of your historical score, and we may be required to retain certain billing records regardless of a deletion request. If you're in the EU, UK, or California, you have specific rights under GDPR, UK GDPR, or the CCPA that we'll honor on request.

13. Children's privacy

Kitscore is intended for creators and sponsors who are 18 or older, and is not directed at children. We don't knowingly collect data from anyone under 18.

14. Security

We use reasonable technical and organizational measures to protect your data, including access controls on our database (row-level security) and encrypted payment processing via Stripe. No system is 100% secure, and we can't guarantee absolute security.

15. Changes to this policy

If we materially change how we collect or use your data, we'll update the date at the top of this page and, where appropriate, notify you directly.

16. Contact

General & privacy requests: hello@kitscore.co
Billing-related data: billing@kitscore.co
Platform data deletion requests: see our Data Deletion Instructions