Privacy Policy for “Kronenglut Studio”

1. Overview

Kronenglut Studio is a privately operated tool that the operator named below uses to publish and analyse content on their own Instagram, TikTok, YouTube and Pinterest accounts. It is not a public service: there is no sign-up for third parties, and only accounts the operator has explicitly connected are accessed. Kronenglut Studio uses no tracking, analytics, advertising or third-party cookies.

2. Controller

3. Connected platforms and the data we access

A platform is only accessed after the account owner has authorised Kronenglut Studio on that platform's consent screen (OAuth). The following permissions are requested and used only for the purposes listed:

Purpose: displaying the operator's own accounts and statistics in the dashboard and publishing, scheduling and analysing content in these accounts at the operator's request. Legal basis: consent given on authorisation (Art. 6(1)(a) GDPR), revocable at any time (section 7), and the operator's legitimate interest in managing their own social media presence (Art. 6(1)(f) GDPR).

We do not sell or rent platform data, use it for advertising or profiling, combine it with other data sources, access data of other users, or use it to train AI models.

4. YouTube API Services and Google user data

Kronenglut Studio uses the YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service; Google's processing is governed by the Google Privacy Policy. Access can be revoked at any time on the Google security settings page.

Kronenglut Studio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. What is stored and for how long

• Access tokens of the connected platforms – until the connection is removed or the token expires.
• Account figures and lists of recent posts are fetched live and cached for at most one hour.
• Daily follower counts per platform (for the growth chart) – 24 months.
• Posts created in Kronenglut Studio (texts, chosen options, status, link to the published item) and the activity log – 12 months, then deleted automatically.
• Uploaded images and videos – until the operator deletes them in the media library.

6. Media library and media links

Uploads are stored on the web server outside the publicly accessible area. Instagram and TikTok fetch media for publishing from a URL; for this, Kronenglut Studio creates signed links that expire after six hours.

7. Revoking access and deleting data

Access can be ended at any time: in Kronenglut Studio under “Channels” → “Disconnect” (deletes the tokens immediately), or in the settings of the respective platform. Details and the deletion request procedure are described on the data deletion page. Content already published stays on the platforms and can be deleted there.

8. Login and cookie

The dashboard is protected by a password stored only as a hash. After login a technically necessary session cookie (kgstudio_session) with a random ID is set; it is deleted when the browser closes or after 12 hours of inactivity. Failed logins are counted without IP address. Legal basis: Section 25(2) No. 2 German TDDDG, Art. 6(1)(f) GDPR. No external fonts, scripts or tracking are loaded.

9. Hosting

Hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. The host processes technical access data (e.g. IP address, time, requested URL, browser type) in server logs to deliver and secure the website, under a data processing agreement (Art. 28 GDPR). Legal basis: Art. 6(1)(f) GDPR.

10. Images from the platforms

Profile pictures and post thumbnails in the dashboard are loaded directly from the platforms' servers, which receive the IP address of the person viewing the dashboard (the operator).

11. AI assistants (optional)

If the operator connects an AI assistant via MCP, it can – at the operator's request – read account figures, post texts, the media list and reduced image previews, and create or schedule posts. This data is processed by the assistant's provider: Anthropic (Claude), OpenAI (ChatGPT). Access is protected by a secret key and can be disabled or renewed at any time. Data received from Google APIs is only passed on in line with the Limited Use requirements (section 4).

12. Recipients and transfers to third countries

Published content and API requests go to the respective platform:

• Instagram: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Irland / Ireland – privacy policy
• TikTok: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Irland / Ireland – privacy policy
• YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland / Ireland – privacy policy
• Pinterest: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Irland / Ireland – privacy policy

Their parent companies may process data in the USA or other countries. Transfers to the USA are based on the EU-U.S. Data Privacy Framework adequacy decision (Art. 45 GDPR) where the provider is certified, otherwise on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). There are no other recipients.

13. Security

HTTPS throughout; tokens and uploads outside the public web area; CSRF protection; OAuth state checks; temporary lockout after repeated failed logins.

14. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21) and may withdraw consent at any time (Art. 7(3)). Contact the controller (section 2). You may lodge a complaint with a supervisory authority (Art. 77). Providing data is neither legally nor contractually required, but without connecting an account the respective platform cannot be used. There is no automated decision-making.

15. Changes

This policy is updated when functions or legal requirements change. In case of doubt the German version prevails.