PRIVACY POLICYLAST UPDATED · OCTOBER 3, 2026

Your data stays yours

THE SHORT VERSION
CreatorsKit is a suite of creator tools that runs in your browser. There is no sign-up, no account, and no profile. Your photos, videos, documents, and settings are processed on your device and stored on your device. We only receive data over the internet when a page loads or when you deliberately use a feature that needs it — and every one of those features is listed in sections 4 and 5 below, in plain words. You can see and delete everything the site has stored, any time, at /your-data. If anything in this policy is unclear, our contact details are in section 16.
01

Who we are and what this covers

The operator
CreatorsKit (creatorskit.win) is a free suite of browser-based tools for creators, freelancers, and small businesses, built and operated from Ghana. For the purposes of data protection law, CreatorsKit is the data controller for the little data this policy describes — and we have deliberately kept that "little" as small as the product allows.
What this policy covers
It applies to every page and tool on creatorskit.win, including the AI planner, the business suite (invoices, receipts, agreements, letterheads), video and image tools, and any public share links created with them. It explains what information is handled, where it lives, who else is involved, how long anything is kept, and the controls you have.
How to read it
Sections 3 and 4 are the heart: what never leaves your device, and what does when you choose a cloud feature. Sections 6–10 cover cookies, analytics, advertising, and the third parties we rely on. The rest covers your rights, retention, international transfers, and law.
02

What we never collect

No accounts
We do not collect names, emails, phone numbers, birthdays, or any identifier when you use the tools. There is nothing to register and nothing to log in with.
No files on our servers
Photos, videos, audio, invoices, plans, thumbnails, and exports are processed by your browser (canvas, WebAssembly, WebCodecs) and saved only to your device storage. Loading a file into a tool does not upload it anywhere.
No tracking of you
We set no tracking cookies, build no advertising profiles, do no cross-site tracking, and do no device fingerprinting. We do not know who you are, and we designed the product so we never need to.
No selling or sharing of personal data
We do not sell, rent, or trade personal data, and we do not share it with data brokers — there is no personal-data inventory to sell. That is the point of building local-first.
03

What stays on your device

Working files (IndexedDB)
Tools remember your work between visits — watermark queues and logo libraries, resizer sources and presets, thumbnail-lab candidates, carousel slices, compressor queues, teleprompter scripts, sync-slate take logs, quote-card decks, demystify plans — in your browser’s IndexedDB database ("ck_local_memory"). None of this ever leaves the device.
Settings and preferences (localStorage)
Tool settings, brand kits, watermark positions, remembered formats, and similar preferences live in your browser’s localStorage under keys beginning with "ck_". These are functional, not tracking: they exist so the tool greets you with your own setup next visit.
Your AI keys (if you use AI features)
If you choose to use Demystify with your own Groq, OpenAI, or Google Gemini API key, that key is stored in your browser’s localStorage and sent only with the requests you make (see section 5). It is never written to any server of ours.
App cache (PWA)
CreatorsKit is installable as an app (PWA). Its cached files — the site’s own code, images, and AI model files you have downloaded — live in your browser’s cache on your device, so tools work fast and some work offline.
See it, delete it, export it
The /your-data page lists every per-tool store on your device with sizes and dates. You can view contents, delete any tool’s memory individually, or export everything as one ZIP. Deleting it there deletes it permanently — there is no server copy to recover or to ask us about.
04

What the website itself sends

Just loading pages
Like any website, opening creatorskit.win sends standard technical requests to our hosting (edge/CDN on Cloudflare/Vercel): your IP address, browser type, the page requested, and timing. These are used to serve the page, keep the site secure, and rotate away in short-lived server logs. They are not used to profile or identify you.
Assets from CDNs
Pages load images, scripts, and fonts from content delivery networks — the same requests any website makes. Notably, some text tools load fonts from Google Fonts, so Google sees the font request from your browser.
05

Optional cloud features — what each one sends

The honest list
Almost everything in CreatorsKit works entirely on your device. The exceptions below only activate when you explicitly use them, and each one names exactly what is sent and where it goes.
AI planning with your own key (Demystify)
If you paste your own Groq, OpenAI, or Google Gemini API key, your idea text and that key are forwarded to the AI provider you chose so a plan can be generated. Your key is used for that request only — it is never stored, logged, or kept on any server of ours. The idea text is processed for the response and then discarded. Your provider’s own privacy policy governs how they handle the request.
Cloud transcription (optional engine)
Auto-captions can transcribe entirely on your device. If the cloud engine is used, your audio is sent over HTTPS to our transcription worker, converted to timed text for your job, and discarded after the job completes. We do not keep an archive of your audio or transcripts.
Video Grabber
When you ask it to fetch a video, the URL you enter is sent to our worker, which retrieves the file and streams it back to your browser. We keep no library of fetched videos.
AI background removal
The first time you use it, AI model files are downloaded from a content delivery network into your browser cache. After that, cutouts run entirely on your device.
YouTube reference import
Importing a YouTube reference into Thumbnail Lab fetches the video’s public title and thumbnail through YouTube’s oEmbed service. Only the video URL/ID you enter is used.
Bouquet gift pages
A bouquet is a gift page meant to be opened by its recipient — creating one and sharing the link is, by design, sending that page’s content (your message, flowers, card) to the person you are gifting.
06

Share links (invoices, receipts, agreements, bouquets)

Two kinds of link
When you share a business document or a gift page, there are two modes. In link mode, the entire document is encoded inside the link itself — that link never touches our servers, and whoever you send it to can open it directly. In short-link mode, the document is stored in our database (Supabase) so a tidy URL (like /r/ABC123) can be opened by anyone who receives it.
Only what you type
A shared document contains exactly the details you entered — your business name, contact email or phone, payment channels like MoMo numbers, line items, notes, and branding you chose to include. Check what a document contains before sharing it; do not share details you want to keep private.
Anyone with the link can view
A share link works like a document in an envelope: anyone holding the link can open it, including people your recipient forwards it to. Share links only with the client or person they are meant for.
Removing a stored link
Encoded links live wherever you sent them — we cannot revoke those. Short links stored in our database can be removed: contact us at [email protected] with the link and we will delete it.
The badge
Shared pages carry a small "Made with CreatorsKit — free creator tools" footer. That footer identifies the tool that made the document; it does not add tracking to the page.
07

Analytics & measurement

Count pages, never people
If site analytics is enabled, it is aggregate, cookie-free page counting only: how many times a page was opened, from roughly where, on what kind of device. No cookies, no individual visitor identities, no cross-site profiles, no replay recording.
Why even this is minimal
We need rough numbers to know which tools people find useful — that is all. Our operating principle, from the business plan this product is built on: count events, never people.
08

Cookies and local storage

No cookies of our own
We do not use cookies to identify, remember, or follow you across visits or sites. There is no "accept cookies" wall because there are no cookies to accept.
Functional storage only
The site’s storage (IndexedDB + localStorage, described in section 3) is strictly functional — remembering your work and settings between visits. It is readable by you (via /your-data) and removable at any time from your browser settings.
Do Not Track
Because we do not track you in the first place, Do Not Track and Global Privacy Control signals are respected by default — there is nothing on our side to switch off.
09

Advertising

Why ads exist here
Ads keep every tool free. Advertising appears only in reserved slots on free pages (such as side and footer banners) — never inside a tool’s workflow before an export, and never blocking your file.
Ad networks and their cookies
Ad slots are served by advertising networks (such as Google AdSense when live). Those networks may set their own cookies or similar technologies subject to their own privacy policies — including to measure or personalize ads. You can review and control Google’s ad settings at Google’s “Ads Settings” page, and most browsers let you limit third-party cookies entirely.
Sponsored screens on mobile
On mobile, occasionally a short sponsored screen appears before an external site opens, plus a once-per-session banner. These are house features to keep the service free; they collect nothing beyond what section 4 already describes.
Future rewarded ads
If we ever add “watch an ad for one extra AI use” flows, this section will say so plainly before it ships.
10

Third-party services we rely on

Hosting & delivery
Cloudflare / Vercel serve the site and its API routes globally. They process standard technical request data (IP, timestamps) to deliver pages and protect against abuse.
Share-link storage & background jobs
Supabase hosts the database that stores short share links and the edge functions that power Video Grabber jobs. It stores only what a share link itself contains (section 6) — never your device data.
AI providers (only if you bring a key)
Groq, OpenAI, and Google process your idea text when you use Demystify with your own key, under their own policies. We forward the request; we do not add anything to it.
Fonts and media CDNs
Google Fonts serves typefaces; CDNs serve images, scripts, and AI model files. These providers see standard web requests from your browser.
What each one gets
The pattern throughout: each third party receives only the minimum needed to serve the specific feature you used — a URL to fetch, an audio stream to transcribe, a document to host, a font to serve. No third party receives your identity from us, because we do not have it.
11

How we protect data

Encrypted transport
Everything travels over HTTPS. API keys forwarded for AI features are transmitted per request and never persisted or logged on our servers.
Nothing to breach
The most important security measure is architectural: because there is no central user database — no passwords, no profiles, no stored files — there is no honeypot for a breach. The data that matters most (your work) sits on your device, protected by your device’s own security.
Abuse prevention
Server-side rate limits and one-time upload grants protect the shared infrastructure (transcription, video grabbing) from abuse. These safeguards process request metadata only.
Honest limits
No system is perfect. If something ever goes wrong that affects information you shared with us (for example, a stored share link), we will say so plainly and fix it — you can hold us to that.
12

Children

Age requirement
CreatorsKit is intended for creators aged 13 and above. We do not knowingly collect personal information from children under 13 — and because the tools collect no personal information at all, there is normally nothing to collect from anyone.
If you are a parent or guardian
If you believe a child has shared personal information through a feature (for example, typing their phone number into a shared invoice), contact us at [email protected] and we will remove the stored document.
13

Your rights — self-serve by design

Access & portability
Open /your-data to see every stored item per tool, and click EXPORT ALL to download everything as a ZIP you can take anywhere.
Deletion & erasure
Delete any tool’s memory with its DELETE button on /your-data, or clear your browser storage — that is the only copy in existence. Erasure is instant because storage is yours.
Withdrawal & objection
Stop using a cloud feature and nothing further is sent. Uninstalling the site or clearing browser storage removes every trace from your device.
Stored share links
To remove a stored short link, email [email protected] with the link and we will delete it. Encoded links cannot be revoked (they live in the messages you sent) — share deliberately.
Complaints
If you believe we have mishandled information, contact us first at [email protected] and we will make it right. You also have the right to complain to Ghana’s Data Protection Commission.
14

Data retention

On your device
Your working files and settings are kept until you delete them (see /your-data) or clear your browser data. Nothing expires on a timer because nothing is on our side to expire.
In-transit features
Idea text sent for AI plans, audio sent for transcription, and video URLs sent to the grabber are processed for the request and then discarded. We do not build archives of user content.
Stored share links
Short links are kept until removed (section 6) so your recipients can keep opening them. Contact us to remove one.
Server logs
Short-lived hosting logs (IP addresses, timestamps, error traces) exist for security and abuse prevention and are rotated away. They are not used to profile anyone.
15

International transfers & Ghana data protection law

Where processors sit
Some providers we rely on (Cloudflare, Vercel, Supabase, Google, OpenAI, Groq) process data in data centers outside Ghana. When you use a feature that touches them, that feature’s data may be processed in those countries, under the safeguards described in this policy and their own policies.
Act 843, 2012
CreatorsKit is built and operated from Ghana. We handle data consistent with the Ghana Data Protection Act, 2012 (Act 843) — and go further than it requires: the fastest way to satisfy “delete my data” is a product that never collected it.
16

Changes & contact

Policy updates
If this policy changes, the new version with a new “last updated” date replaces this page. Material changes (new cloud features, new categories of processing) will be described here before or when they ship.
Contact
Questions, data requests, or share-link removal: [email protected] — or find us on X @creatorskit. We answer real messages from real people.
TERMS OF SERVICE →YOUR DATA — VIEW / DELETE / EXPORT →ALL TOOLS →
CREATORSKIT · CREATORSKIT.WIN · © 2026