Kratos-Sync Privacy Policy

Last updated 13 October 2026

This Privacy Policy applies to Kratos-Sync (the “Service”), available at www.kratos-sync.space and operated by P10X. Anyone can sign in with a Google account, connect their own TikTok or YouTube account, and upload, schedule and publish videos to it. P10X staff use the same tool to publish to the brand accounts our company owns. This policy covers both.

Nothing is ever posted on your behalf automatically. A post goes out only when you press Post or schedule it yourself, with the visibility and settings you chose.

What we store

When you sign in:

Your name, email address and Google account identifier, so we can recognise you next time.

When you connect a social account:

The account's identifier, display name and profile picture, so the composer can show which account a post will be published to.
The access token and refresh token issued by that platform, encrypted at rest. These let Kratos-Sync publish to that account when you ask it to. Tokens are sent only to the issuing platform for authorised requests and are not displayed to other users.

When you post:

The video or photos you upload, your caption, the schedule you set, and the link to the resulting post.
The public performance figures of posts made through Kratos-Sync — views, likes, comments and shares — so your dashboard can show how they did.

We also keep a log of actions taken in your account (for example "connected TikTok", "deleted a post") for security and support.

We do not read your direct messages or follower lists. When you sync YouTube channel history, we also retrieve the channel's existing videos and their available performance figures, including videos published outside Kratos-Sync. We do not sell your data, share it with advertisers, or use your videos to train AI models.

How we use it

We use an essential session cookie to keep you signed in. The posting workspace can keep an unfinished draft and selected media in your browser so you can return to it. On a shared device, clear your draft and sign out when you finish.

To publish and schedule the content you ask us to, to show you what was posted and how it performed, and to keep the service secure. Some captions may be drafted with the help of AI tools; you review them before anything is published.

TikTok

Kratos-Sync uses TikTok's Login Kit to connect your account, the Content Posting API to publish the videos you choose to post, and the Display API to read the view, like, comment and share counts of those posts. Before every post you choose who can see it, whether comments, Duets and Stitches are allowed, and whether it contains commercial content — Kratos-Sync never chooses these for you.

You can remove Kratos-Sync's access at any time inside TikTok under Settings and privacy, Security and permissions, Manage app permissions — or with Disconnect on the Connections tab in Kratos-Sync.

YouTube and Google data

Kratos-Sync uses YouTube API Services to upload videos to the channel you connect, to read the name of that channel, to delete a video Kratos-Sync uploaded when you ask, and to retrieve view and engagement figures for those videos. By connecting a YouTube channel you agree to the YouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy.

Kratos-Sync's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to provide the features described here, is not sold, is not used for advertising, and is not read by any person except with your consent for support, for security, or where the law requires.

You can revoke Kratos-Sync's access to your Google account at any time from Google's third-party access page, or with Disconnect on the Connections tab in Kratos-Sync.

Who can see it

Your connected accounts, posts and figures are scoped to your account in the application. Authorised operators may access stored data for support, security, service operation or legal obligations. Brand accounts owned by P10X are visible to the P10X team members who manage them.

Data is stored on servers operated by our infrastructure providers — Vercel for the application, Supabase for the database, Cloudinary and Cloudflare for media — each acting on our instructions and not for their own purposes.

How long we keep it

Access tokens are kept until you disconnect the account or revoke access at the platform. Disconnecting requests revocation at the platform and deletes our token copy, together with the performance figures collected with it and the record of posts made to that account from Kratos-Sync. Nothing already published on the platform is affected.
Deleting a post removes its application record. We attempt to remove its associated personal video from storage when the post is deleted or its last connected destination is disconnected. Shared media, image assets and backup copies can remain until storage cleanup; contact us to request removal of remaining uploads.
Performance figures retrieved from the YouTube API are refreshed for 30 days after a video is published and deleted once they are no longer refreshed, in line with the YouTube API Services Terms of Service.
To delete your Kratos-Sync account, open Profile and choose Delete account, then type DELETE to confirm. Existing logins end immediately and personal publishing is stopped. We wait for outstanding upload links to expire before erasing your personal profile, connections, uploads, drafts, posts, metrics, private generation work and assistant data. Cleanup normally completes within 48 hours; if a storage provider is unavailable, we retry and keep the account locked. Older media in shared folders may require an ownership check by support before cleanup can finish. Contact support if it takes longer than 48 hours. After cleanup, signing in again creates an empty account.
Published posts remain on their social platforms. Shared company work is retained with your account attribution removed. Security hashes used to invalidate old logins expire after 31 days. Provider backups and cached media may remain until their retention or cache expiry; they are not restored when you sign up again. Older uploads in shared storage that are no longer linked to a record may require support to identify and remove. You can also request deletion by email.

Children

Kratos-Sync is not directed at children. You must be old enough to hold the social media accounts you connect, and in any case at least 13.

Changes

If this policy changes we will update it here and revise the date above.

Contact

Questions about this policy, or a request to delete your data: info@p10x.my.