Kukan Ops · Privacy Policy

Kukan Ops Privacy Policy | Updated October 21, 2026

Kukan Ops is a YouTube channel authorization and video publishing management tool for channel owners and their teams, maintained by the Kukan Ops project team. This policy explains how the website at https://yt.kukancc.com and its Google / YouTube authorization relay access, collect, use, store and share user data. Privacy contact: kukantech88@gmail.com.

1. Service scope and how data is obtained

The homepage, this policy, terms and deletion instructions are public and require no login. We process Google authorization data only after you start a connection from a publishing workspace and authorize it on Google's website. You may decline. We use YouTube API Services; see the Google Privacy Policy for Google's own practices.

The authorization relay provides channel connection, identity verification, authorization-result delivery and token refresh without receiving media. A separate access-code-protected publishing demo at /demo/ supports private test uploads, thumbnails, captions and metadata editing. User-selected media passes through the Hong Kong demo backend to YouTube. Production LAN workspaces must explain their own features and storage. The workspace receiving credentials is identified by name on the connection page; review its operator, features and storage practices before connecting.

2. Data we collect or access

• Google authorization data: the one-time authorization code, access token, refresh token if issued, granted scope, token type and expiry. These complete the connection and refresh access under the permission you granted.
• YouTube channel identity: the channel ID, channel title and public handle/custom URL, when returned by YouTube Data API v3. These identify the actual connected channel and allow verification against the expected channel.
• Demo publishing data: your selected video, thumbnail, UTF-8 SRT file, title, description, audience and publishing settings; returned video ID, owner channel, upload/processing/privacy/schedule and caption-track status. Used only to carry out and verify your requested actions; unrelated videos are not imported.
• Connection session data: the originating workspace ID and name, optional expected channel ID, non-sensitive correlation ID, registered browser return URL, authorization status, expiry and temporary browser-session cookie. These deliver the result to the correct workspace and prevent forged or replayed requests.
• Essential operation data: servers necessarily process network addresses and HTTP headers. Our application logs contain only random request IDs, fixed endpoint names, request method, status, safe error codes and duration. Our site does not log full URLs, query strings, IP addresses, request bodies or Google authorization data. Hosting and network providers may process infrastructure information under their own practices.
• Information you send to support: your sender email, workspace name, channel ID, issue description and any material you voluntarily send, used only to resolve support, privacy or abuse reports. Do not send passwords, authorization tokens or client secrets.

We do not request access to Gmail, Google Drive, contacts, phone numbers, location or YouTube Analytics revenue data. The relay does not read media. The demo manages only videos uploaded in the current session and does not read comments, ratings, watch history or unrelated video lists. Google handles account selection and sign-in; we do not collect Google passwords.

3. How and why we use data

Google data is used only for the channel connection and publishing operations you request: exchanging the authorization code, verifying channel identity, delivering credentials to the authenticated originating workspace, and refreshing tokens on its request. Access tokens call Google / YouTube; refresh tokens obtain new access tokens under the same authorization.

We request https://www.googleapis.com/auth/youtube.force-ssl because the intended publishing workflow includes video uploads, thumbnails, captions, and post-upload changes to titles, descriptions and publishing times. Google's permission description also covers modifying or deleting videos, captions, ratings and comments. Permission breadth does not mean every capability is used. The relay only queries channel identity. On your request, the demo uploads videos and thumbnails, uploads/replaces captions, edits titles, descriptions, privacy and publication times, and reads actual status. It does not manage comments, ratings or video deletion. Production workspaces perform the actions supported by their own features.

4. Sharing, transfers and recipients

• Google / YouTube: receives authorization-code exchanges, token refreshes and channel queries. For publishing, the demo or your original workspace submits your selected content and actions to YouTube.
• The workspace where you started: receives channel identity and credentials through a separately authenticated backend interface. We do not deliver credentials to arbitrary return URLs or make requests from Hong Kong directly into your private network.
• Infrastructure and support providers: Alibaba Cloud hosts the site in Hong Kong; hosting and network services process necessary network traffic. Our contact mailbox's email service processes support messages you choose to send.
• Necessary human support or legal processing: authorized personnel handle only necessary data with your consent for a specific issue, to investigate security abuse, or as legally required. We do not use channel tokens for staff to browse your channel content.

We do not sell Google user data, disclose it to advertising platforms, data brokers or information resellers, use it for targeted advertising, credit assessment or lending, or use or transfer it to train, develop or improve generalized or non-personalized AI / machine-learning models.

5. Storage locations and retention

• Temporary public-relay sessions: stored only in process memory and valid for at most 10 minutes. Exchanged credentials are encrypted using AES-256-GCM and valid for at most 2 minutes, within the original session deadline. Credentials are removed when the workspace acknowledges storage; restarting also clears memory. Expired data is immediately unavailable for retrieval and is normally removed by background cleanup within 30 seconds.
• Refresh requests: refresh tokens and returned access tokens pass through the public service only while it processes and returns that request; they are not written to a long-term database or file.
• Hong Kong publishing demo: channel credentials, identity and the current video list are held only in the separate process memory. Each login session lasts up to 8 hours; sign-out, expiry or restart clears it, and removing a channel clears its credentials/list. Closing the browser does not immediately clear server state. Video (20 MiB), thumbnail (2 MiB) and SRT (1 MiB) files use bounded request buffers only and pass to YouTube, not application files or a database; proxy disk buffering is disabled for this route. We do not promise absolute absence of operating-system traces. The access code and service credentials are restricted startup configuration, separate from channel-token retention. Clearing demo data does not delete YouTube content.
• The receiving backend: saves tokens and channel identity to maintain the connection you authorize. Our current authorization-validation tool stores these in an access-restricted configuration file on the administrator's computer, managed manually; there is no automatic deletion interface. Before using another workspace, its administrator must identify its storage location, retention period and deletion process. Public-relay expiry does not describe the retention of backend copies.
• Cookies and logs: relay authorization cookies last at most 10 minutes; demo session cookies last at most 8 hours, contain no Google tokens and bind the initiating browser. Minimal operation logs are retained for at most 14 days, subject to a storage cap. Support messages are kept only as needed to resolve the request, with deletion handled below; legally required retention is limited to what is necessary.

6. Data protection

Browser and backend interfaces use HTTPS. Google callbacks validate random state, browser binding and replay protection, with PKCE. Integrations have separate service credentials and registered return URLs. Tokens do not appear in browser return URLs, frontend code, ordinary logs or public files. Temporary exchanged credentials are encrypted in memory. The validation backend's files use operating-system access controls restricted to authorized administrators; file permissions are not represented as disk encryption.

7. Revoking access and requesting deletion

Find Kukan Ops in Google Account third-party security permissions or Google third-party connections and revoke access to stop future Google API access. You can also contact kukantech88@gmail.com to disconnect or delete channel identity, tokens and support information held by this service. Provide your workspace name, channel ID and deletion scope, without sending tokens. After verifying the request, an administrator performs deletion of the requested user data under our control as soon as possible and within 7 calendar days, consistent with YouTube API policy, and confirms the result.

For the workspace that received credentials, also use its disconnect/delete function or contact its administrator. We help identify the recipient, but the public relay cannot directly delete files in independently operated workspaces. Unclaimed public data expires as described above. Deleting our data or revoking access does not delete videos, captions or comments on YouTube; use YouTube or an authorized application supporting that action. See our deletion instructions.

In /demo/, use Remove from demo or Sign out & clear session to clear the corresponding temporary credentials and lists. These actions do not revoke Google access or delete YouTube content.

8. Cookies, advertising and third-party content

Only necessary authorization and demo-session cookies are used, with HttpOnly, Secure and SameSite=Lax protection. Public pages require no cookies or login. This site has no advertising, third-party analytics scripts or embedded YouTube player, and does not use advertising-tracking cookies.

9. Google API Limited Use commitment

Kukan Ops's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide or improve the user-facing features you request. Human access and transfers are limited to circumstances permitted by that policy. We use YouTube API Services and follow the YouTube Terms of Service.

10. Changes and contact

If data purposes or sharing change materially, we update this policy and obtain renewed consent when required. For access, correction, deletion or privacy complaints, contact the Kukan Ops project team at kukantech88@gmail.com. This policy is public and requires no Google sign-in.