Privacy Policy
This English version is provided for convenience. If there is any difference, the Korean version prevails.
DesignFos ("we") operates the StanThat service (the "Service"). We comply with the Personal Information Protection Act of Korea and other applicable laws, and we set out this Privacy Policy to protect your personal information.
1. Information we process and how we collect it
We process only the minimum personal information needed to provide the Service.
| Category | Items | How collected |
|---|---|---|
| Sign-up and sign-in (required) | Google account identifier, email address, name, profile picture URL, Google authentication tokens (access token and refresh token), granted permission scopes | Received from Google when you sign in with your Google account |
| YouTube information (required) | Your YouTube subscriptions (channel ID, channel name, thumbnail, description) | Received from the YouTube API Services through the "View your YouTube account" permission you grant |
| Service usage records | Categories and channel sorting, STANs (saved videos) and tracking settings, watch history within StanThat (videos watched, watched segments, watch dates and counts), feature usage counts, plan level | Created while you use the Service |
| Writing comments (optional) | The text of comments you write | Received and posted to YouTube only if you grant the additional permission when writing a comment (we do not store comment text separately) |
| Patreon connection (optional) | Patreon user identifier, Patreon name, membership tier, patron status, pledge start date | Received from Patreon if you connect your Patreon account |
| DATA LIVE YouTube membership check | Your YouTube channel ID, membership tier | When you sign in, we check your channel ID through the YouTube API Services and match it with the DATA LIVE member list uploaded by the admin |
| Paid subscription (optional) | Paddle customer identifier, subscription identifier, plan, billing cycle and currency, subscription status, billing period, next payment date, scheduled cancellation | Received from Paddle, the reseller, when you pay for a paid plan |
| New video and live notifications (optional) | Browser push subscription address and encryption keys, browser information, channels with notifications on | Received from your browser when you turn on channel notifications (🔔) |
| AI search correction | The search words you enter when a search has no results | Entered when you search (corrections are kept for up to 30 days in a cache shared by identical searches and are not linked to you) |
| Inquiries | Name, email address, message, screen language (linked to your account if you are signed in) | Entered in the contact form (available without an account) |
| Collected automatically | IP address, browser information, access time, service logs, cookies | Generated automatically while you use the Service |
Payment method details such as card numbers and billing information entered at checkout (country, postal code, etc.) are collected and processed directly by Paddle, the reseller. We do not receive or store them.
2. How we use your information
- Identifying members, keeping you signed in, and preventing misuse
- Providing a feed of the latest videos from your YouTube subscriptions, channel categories, search and STAN features
- Showing you your own usage statistics, such as StanThat watch counts
- Applying plan levels and feature limits, checking Patreon and YouTube membership tiers, and managing paid subscriptions (plan changes, cancellation, billing information)
- Sending new video and live stream notifications for the channels you turned on
- AI category auto-sort and search correction
- Answering inquiries, sending notices, improving the Service and fixing errors
3. YouTube API Services and Google user data
- The Service uses the YouTube API Services. By using the Service, you agree to be bound by the YouTube Terms of Service. Google's handling of personal information is governed by the Google Privacy Policy.
- StanThat's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- We request the "View your YouTube account" permission (reading your subscriptions), and request permission to post comments only when you write a comment. We never change your YouTube account settings or subscriptions.
- We use information received from YouTube only for the purposes in section 2. We do not use it for advertising, sale or credit evaluation, and we do not sell it to third parties. No human reads your Google data unless you agree, it is needed for security, or the law requires it.
- Use of AI: To sort your subscriptions into categories, we send the names, handles, descriptions, keywords, recent video titles and tags, and YouTube categories of the channels you subscribe to (public YouTube information) to Anthropic's Claude AI (API). The results are used only to create your categories, and Anthropic does not use this data to train AI models. We do not use data received from Google APIs to develop, improve or train generalized AI and/or machine learning models.
- The DATA LIVE YouTube member benefit is a temporary event for the early period of the Service. To check whether you qualify, we read your own YouTube channel ID with the same "View your YouTube account" permission.
- Videos are played only through the YouTube player. We do not download or store videos.
- You can revoke the Service's access at any time in your Google Account connected apps settings. Revocation and deletion are handled as described in section 4.
Summary of how we handle Google user data
- Raw data we access: your Google account identifier, email address, name and profile picture URL; authentication tokens; your YouTube subscriptions (channel ID, name, thumbnail, description); your own YouTube channel ID; and the text of comments you ask us to post.
- Aggregated or anonymized data: We do not create data sets from Google user data for analytics, research or sale. To run the Service we use only information that decides which channels to collect (whether a channel has any subscribed member) and internal totals such as the number of channels. We do not publish or share this. Other users' watch counts shown on a video come from viewing activity on StanThat, not from Google user data, and do not identify anyone.
- How we use it: We use raw data only for sign-in, your feed of the latest videos from your subscriptions, channel categories and AI auto-sort, the DATA LIVE membership check, and posting comments you request. We use aggregated data only for the internal operation described above.
- Transfer and sharing: We transfer data only to Google Cloud (server and database processor), Anthropic (public information about your subscribed channels only, without your name, email or account identifier), YouTube (comments you post), Paddle (your email address when you pay) and browser push services (notification content for channels you turned on), within the scope of sections 5 and 6. We do not share it with any other third party unless the law requires it, and we do not transfer or sell it to advertisers or data brokers. We do not share aggregated data externally.
- Protection: All communication uses HTTPS, Google refresh tokens are stored encrypted, and data is kept in a database with Google Cloud encryption at rest. Secrets are kept in a separate secret management service, and access is limited to the minimum number of people.
- Retention and deletion: We keep raw data until you delete your account. When you do, we delete it without delay and return your Google tokens. See section 4 for details. Internal totals contain no information that identifies a person.
4. Retention and deletion
- We keep your personal information until you delete your account, and delete it without delay when you do. You can delete your account with [Delete account] at the bottom of the [My plan] page. When you do, we also return (revoke) your Google authentication tokens to Google.
- If you revoke access in your Google Account settings, we delete the Google authentication tokens we stored as soon as we detect the revocation (at the next token refresh) and stop receiving new Google information. To also delete the information already received, delete your account or contact the privacy officer below, and we will delete it without delay.
- Server access logs are kept for up to 30 days for security and troubleshooting, and then deleted automatically.
- Inquiries are kept for 3 years after they are resolved, and then deleted automatically. Inquiries from members are deleted when the account is deleted.
- Where the law requires retention, we keep the information for the period the law sets.
- Electronic files are deleted in a way that cannot be recovered.
- Public YouTube information shared by many users (channel and video titles, thumbnails, public statistics, etc.) is not personal information and is cleaned up separately under our operating rules.
5. Sharing with third parties
We do not provide your personal information to third parties, except as below when you ask to pay for a paid plan, with your prior consent, or when investigative agencies request it through lawful procedures.
| Recipient (contact) | Country | Items | Purpose | When and how | Retention |
|---|---|---|---|---|---|
| Paddle.com Market Limited (Privacy Policy, privacy@paddle.com) |
United Kingdom (and countries where Paddle operates) | Email address, StanThat member token (encrypted), chosen plan and billing cycle | As the reseller of paid plans: payment, tax handling, receipts, refunds and customer support | Sent over the network when you open the checkout | The period set by Paddle's Privacy Policy and applicable laws (tax, accounting, etc.) |
You may refuse this, but then you cannot pay for a paid plan. Using the FREE plan is not affected.
6. Processors and international transfer
We entrust the processing of personal information as follows to operate the Service, and your personal information is transferred to (stored in) other countries in the process.
| Recipient (contact) | Country | Items | Purpose | When and how | Retention |
|---|---|---|---|---|---|
| Google LLC (Google Cloud privacy inquiries: contact form) |
Japan (servers and database: Google Cloud Tokyo region), the United States and other countries where Google operates | All personal information in section 1 | Server operation, database storage, web hosting, log storage | Transmitted over the network whenever you use the Service | Until you delete your account or the processing agreement ends |
| Anthropic PBC (Privacy Policy, privacy@anthropic.com) |
United States | Search words entered when a search has no results (for category sorting we send only public YouTube information such as channel names, descriptions and video titles) | AI search correction, AI channel category sorting | Sent through the API when you use those features | Not used for AI training under Anthropic's commercial API terms, and deleted after a set period (up to 30 days) |
| Your browser's push service (Google Firebase Cloud Messaging, Mozilla, Apple, etc.) |
United States and other countries where they operate | Push subscription address, encrypted notification content (channel name, video title) | Delivering new video and live notifications | Sent over the network when a notification is sent | According to each company's policy after delivery |
You may refuse the international transfer, but because the Service runs on Google Cloud, you will not be able to use the Service if you refuse. In that case, do not sign up, or delete your account.
Transfers to Anthropic and browser push services happen only when you use those features, and you can refuse them by not using them (search, notifications).
Connecting Patreon is optional. We only receive membership information from Patreon (Patreon, Inc., United States); we do not provide your personal information to Patreon.
7. Cookies
- The Service uses cookies and browser storage to keep you signed in (up to 30 days), for security (CSRF protection), and to remember display settings such as your language. We do not use advertising or tracking cookies.
- You can refuse cookies in your browser settings, but features that require sign-in will not work.
8. Your rights
- You may request access to, correction, deletion or suspension of processing of your personal information at any time.
- You can delete your account immediately with [Delete account] on the [My plan] page. For other requests, email the privacy officer below; we will act without delay (within 10 days at the latest) and tell you the result.
- You may also exercise your rights through a representative, in which case we may ask for proof of authorization.
9. Children under 14
Children under 14 may not sign up for the Service. If we learn that we have collected personal information from a child under 14, we delete it without delay.
10. Security measures
- Important authentication information, such as Google refresh tokens, is stored encrypted.
- All communication is encrypted with HTTPS, and passwords and keys are kept in a separate secret management service.
- We limit access to personal information to the minimum number of people and manage access rights.
11. Privacy officer
| Privacy officer | Han Seokju |
|---|---|
| Contact | contact@stanthat.com |
For help with privacy issues, you may also contact the Korean authorities: Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972).
12. Changes to this policy
If we add, delete or change anything in this policy, we will announce it on the Service at least 7 days before it takes effect, or 30 days before for changes important to your rights.