KRNK ID Privacy Policy

KRNK ID lets you sign in to supported services with one account and manage payments and subscriptions. It handles information needed for sign-in and payments, along with records used to investigate problems.

KuronekoServer establishes this policy for information handled by KRNK ID. Our address and responsible operator are listed in our operator information.

1. Information and purposes

1. Account details: name/display name, email and whether it is verified, profile image, language, registration/change dates, an account identification number and suspension status. We use these to create accounts, save preferences and prevent misuse.
2. Sign-in information: information used to check your password, linked external account details and data confirming that you have signed in. Passkeys also use stored device verification information and usage records. We do not receive fingerprint or face images, or the secret key held only by your device.
3. Sign-in records: your connection IP address, device/browser type, sign-in time, login expiry, sign-in method, linked apps and what you agreed to share. These keep you signed in and help investigate suspicious access. For developers registering an app, we also manage contact details and the page URL to return to after sign-in.
4. Payment details: billing name/email, the person managing payment, purchased services/products, amounts, currency and payment/refund/renewal status. We also store Stripe customer, subscription and invoice reference numbers and card brand, last 4 digits and expiry. These support purchases, billing, contract checks, inquiries and accounting. Stripe processes full card numbers and security codes; KRNK ID does not store them.
5. Problem reports and inquiries: sign-in successes/failures, pages accessed, processing time, errors, IP addresses, transformed numbers used to match user records, activity history and inquiry content/attachments. These help investigate problems, prevent misuse, resolve disputes and answer requests to access or delete information.

2. Information sent to connected services

If you sign in with Google, GitHub or Discord, we receive confirmation of sign-in and details such as your name and email from that service. Company accounts may also provide information about your organization and job responsibilities. Features using your Discord server memberships send your Discord ID and server names/IDs to supported apps only when you agree to that connection. We do not retrieve Discord message bodies.

When you sign in to another service using KRNK ID, we send the details that service needs to recognize your account, such as user ID, name/image, email and verification status, and language. Dedicated company accounts may also share organization and job information. Purchased services receive contract/payment status. Unlinking does not necessarily erase information already sent. Ask the receiving service to delete it if needed.

3. External services and cookies

We use Cloudflare for service operation, data storage and abuse prevention, blastengine for email, Stripe for payments and Sentry for troubleshooting. Each handles connection information, stored data, email recipients and content, payment information or error and performance records as needed for its purpose. Troubleshooting settings limit collection of personal and sign-in information.

Cookies and similar storage keep you signed in, protect authentication and remember language preferences. You can delete or block them in your browser, but this may prevent sign-in or other features. We do not use collected information for advertising tracking or sell personal information.

The following official privacy policies also explain how these external providers handle information themselves. Cloudflare / Stripe

4. Retention

Temporary information used for sign-in, email verification and purchases is progressively deleted after use or expiry.

Account, connection, contract, payment, activity and inquiry records are retained as needed for service provision, legal obligations, accounting, abuse investigations and disputes. Unnecessary information is deleted or anonymized. Backups and records subject to legal retention may have different deletion times.

5. Processing partners, disclosure and overseas processing

We engage and supervise processors as needed for the stated purposes. Apart from user-directed connections, consent and legally permitted cases, we do not disclose personal data to third parties. Cloud, external authentication and payment infrastructure may process information outside Japan. We provide required information, obtain consent or implement legally permitted safeguards for overseas transfers. Merely using the service is not blanket consent to overseas transfers.

6. Security and choices

We encrypt connections, limit which staff can handle information, protect sign-in details and limit what we record. You can sign out logged-in devices, unlink external accounts or apps, and change payment methods or language. To avoid locking you out, some actions such as removing your last sign-in method may be unavailable.

7. Rights, changes and contact

Request notification of purposes, disclosure of your information or third-party provision records, correction, deletion, suspension of use or third-party disclosure at support[at]krnk.org (replace [at] with @). We verify identity as necessary, respond under applicable law and explain refusals. Minors must obtain required guardian consent. Material changes will be announced with their application date; legally required consent will be obtained separately.

Last updated: 2026/10/01