Privacy Policy

1 Overview & Who We Are

This Privacy Policy explains how KingKode ("we", "us", "our") — the sole operator of KodeCryptX, KodeVault, CipherCast, NexusPlayer, LifeOps, and all associated editors, tools, and community features (collectively, the "Platform") — collects, uses, stores, and discloses your personal information.

We are committed to handling personal information in accordance with the Australian Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles (APPs). If you access the Platform from the European Economic Area (EEA), United Kingdom, or another jurisdiction with data-protection legislation, we honour the spirit of those laws in addition to our Australian obligations.

2 Information We Collect

We collect information you provide directly, information generated through your use of the Platform, and limited technical data from your device or browser.

3 How We Use Your Information

We use the information we collect solely for the following purposes:

• Platform operation: Authenticating your session, serving your repositories and uploaded media, processing marketplace transactions, enabling chat and community features, and providing API access.
• Transactional communication: Sending password-reset emails and critical service announcements. We do not send marketing or promotional emails without your explicit opt-in.
• Security & abuse prevention: Detecting, investigating, and preventing fraudulent activity, unauthorized account access, spam, and violations of our Terms of Service.
• Platform improvement: Understanding aggregate usage patterns (e.g., popular repositories, download counts, search trends) to improve performance and features. We do not build individual user profiles for advertising.
• Legal compliance: Meeting obligations under applicable law, responding to lawful requests from government authorities, and protecting our legal rights and the rights of our users.

4 Legal Basis for Processing

Under the Australian Privacy Principles, we collect and handle personal information only when there is a legitimate purpose and individuals would reasonably expect it. Our legal bases for processing are:

• Contract performance: Processing necessary to provide the services you registered for — account management, content hosting, API access, and wallet features.
• Legitimate interests: Platform security, fraud prevention, aggregate analytics, and product improvement — balanced against your privacy interests. Where we rely on legitimate interests, we conduct a balancing test to ensure your interests are not overridden.
• Legal obligation: Complying with Australian law and responding to valid, lawful legal process from competent authorities.
• Consent: Where you have explicitly opted in to specific processing (e.g., optional email notifications or beta programmes). You may withdraw consent at any time.

5 Sharing & Disclosure

We do not sell, rent, or trade your personal information. We share information only in the following limited circumstances:

• Infrastructure providers: Cloudflare, Inc. acts as our network, CDN, and secure tunnel provider. Your IP address and request metadata are processed by Cloudflare's global network subject to their privacy policy and Data Processing Agreement.
• Email delivery: Your email address is shared with our SMTP provider solely for the purpose of delivering transactional emails you request (e.g., password reset). The provider does not use this data for any other purpose.
• Public content: Content you publish publicly — public repositories, CastComm posts, EternalCast videos, EternalPix galleries, and marketplace listings — is visible to all users and may be indexed by search engines. You control the visibility of your content.
• Legal process: We may disclose information where required by a court order, subpoena, or other legally compelled process in Australia or another applicable jurisdiction. We will notify affected users of such requests unless prohibited by law.
• Business transfers: If KingKode undergoes a merger, acquisition, or sale of assets, your information may be transferred to the successor entity. You will receive advance notice before any transfer takes effect, and the successor will be bound by this Privacy Policy.
• With your consent: We will share your information for any other purpose only where you have given explicit, informed consent.

6 Data Retention

We retain personal information for as long as your account is active or as needed to deliver our services. Specific periods:

• Account data: Retained for the lifetime of your account. Permanently deleted within 30 days of a verified account-deletion request, except where retention is required by law.
• User content: Retained until you delete it, your account is terminated, or we receive a valid deletion request. Publicly published content (repositories, media) may have a 7-day grace period before permanent deletion to allow collaborators to retrieve references.
• Session tokens: Session cookies expire after 7 days of inactivity or upon logout.
• Server access logs: IP-level access logs are retained for up to 90 days for security and abuse-prevention purposes, then automatically and securely purged.
• Transaction records: Wallet and ARK transaction references are retained for 7 years in compliance with applicable financial record-keeping obligations.
• Password-reset tokens: Expire after 30 minutes of issuance and cannot be reused.

When retention periods expire or data is no longer needed, it is securely deleted or irreversibly anonymised.

7 Your Rights & Controls

Under the Australian Privacy Act and applicable regulations, you have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you. We will provide this in a structured, machine-readable format where possible.
• Correction: Request correction of inaccurate or incomplete information. Most profile details can be updated directly in your account settings without contacting us.
• Deletion: Request deletion of your account and associated personal data. Certain data may be retained where legally required or for legitimate security and fraud-prevention purposes.
• Content export: Export your repositories, uploaded media, and published content at any time via the platform interface or by contacting us.
• Restrict processing: In certain circumstances, request that we limit how we process your data while a dispute is being resolved.
• Opt-out: Unsubscribe from any optional email communications using the unsubscribe link in each email, or by contacting us directly.
• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Lodge a complaint: If you believe we have breached the Privacy Act, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

To exercise any of the above rights, contact us at [email protected]. We will acknowledge your request within 5 business days and respond fully within 30 days.

8 Cookies & Local Storage

We use minimal, purpose-limited cookies and browser storage. No advertising or tracking cookies are used.

Browser Local Storage: Creative tools (Vidinator, Pixinator, Beatinator, ProtoX) store draft project data in your browser's Local Storage to preserve work between sessions. This data remains on your device and is never transmitted to our servers unless you explicitly save or publish a project.

We do not use advertising cookies, cross-site tracking scripts, fingerprinting, or third-party analytics platforms (e.g., Google Analytics, Meta Pixel).

9 Security Practices

We implement the following technical and organisational measures to protect your personal information:

• All passwords are hashed using bcrypt with a per-user salt — plaintext passwords are never stored, logged, or transmitted.
• All data in transit is encrypted using TLS 1.2+ via Cloudflare's secure tunnel infrastructure.
• API tokens are stored as hashed references — we cannot recover a token after it is issued.
• Session cookies carry HttpOnly, SameSite=Lax, and Secure flags to mitigate XSS, CSRF, and session-hijacking risks.
• Production server access is restricted to SSH key authentication — password-based SSH login is disabled.
• The codebase undergoes regular security reviews, and the server is kept patched against known vulnerabilities.
• The ARK wallet implementation stores only public addresses; private key operations occur exclusively on the user's device.

No system is perfectly secure. In the event of a data breach likely to result in serious harm, we will notify affected users and the OAIC as required by the Notifiable Data Breaches (NDB) scheme within 30 days of becoming aware of the incident, or as soon as practicable.

10 Children's Privacy

The Platform is not directed at children under 13 years of age (or a higher minimum age if required by your jurisdiction). We do not knowingly collect personal information from children under 13.

If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us immediately at [email protected]. We will investigate and delete the information promptly.

Users aged 13–18 must use the Platform with the knowledge and consent of a parent or legal guardian, who is responsible for their minor's use of the Platform.

11 Third-Party Services

The Platform integrates with the following third-party services. Each operates under its own independent privacy policy:

• Cloudflare, Inc.: Provides DNS resolution, DDoS protection, CDN acceleration, and secure tunnel services for our infrastructure. IP addresses and request metadata are processed by Cloudflare. See Cloudflare's Privacy Policy.
• ARK Ecosystem / Blockchain: The wallet feature interacts with the public ARK blockchain. Transactions on any public blockchain are visible to all network participants by design and are permanent. We store only your public ARK address — never your private key.
• Google Fonts CDN: The KingKode public landing page loads Inter typeface from Google Fonts CDN, which may result in your IP address being processed by Google. Authenticated app pages use only system fonts and do not load external font services.
• SMTP provider: Transactional email (password resets, service notices) is delivered via an SMTP service. Your email address is shared solely for delivery and not used for any other purpose by the provider.

We are not responsible for the privacy practices of third-party services. We encourage you to review their respective policies before using any integrated service.

12 International Data Transfers

The Platform's primary servers are located in Australia. If you access the Platform from outside Australia, your personal information will be transferred to and processed in Australia, which has its own privacy and data-protection framework under the Privacy Act 1988 (Cth).

Cloudflare's edge network operates globally and may cache or process request data in data centres worldwide. This processing is governed by Cloudflare's Standard Contractual Clauses and applicable data transfer mechanisms.

By using the Platform, you acknowledge that your information may be transferred internationally as described above.

13 Changes to This Policy

We may update this Privacy Policy as the Platform evolves or as legal requirements change. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Display a notice on the Platform dashboard for at least 14 days before the new policy takes effect.
• Send an email notification to registered users with a verified email address where the change materially affects their rights.

Continued use of the Platform after the effective date constitutes acceptance of the revised policy. If you disagree with a material change, you may request account deletion before the effective date.

14 Contact Us

For privacy enquiries, data access or deletion requests, or complaints, please contact us at:

If your matter is complex or requires additional time, we will notify you of the expected resolution date and keep you informed of our progress.

If you are not satisfied with our response, you have the right to escalate your complaint to the:

Office of the Australian Information Commissioner (OAIC)
oaic.gov.au/privacy/privacy-complaints
Phone: 1300 363 992