Chroma Guard
👤Sign in Discord Download
Privacy Policy

Privacy Policy

What Chroma Guard collects, why, and what you can do about it.

Who we are

Chroma Guard ("Chroma", "we") runs guard.chroma-mc.net, the Chroma Guard Windows app, the Chroma Guard Minecraft plugins and the Chroma Discord bot.

What we collect

  • Account: your email, a hashed password if you set one, and your Discord ID if you link Discord.
  • Purchases: your license keys, plan and order history. Card details are handled by Stripe; we never see or store them.
  • App activation: a hashed fingerprint of the PC a key is activated on, not your hardware details.
  • Support: messages you send in tickets or live chat.
  • Creator Program: the details you put in your application, plus public stats from the channel you connect.

Google and YouTube data

If you apply to the Creator Program as a YouTuber, you can connect your channel with Google sign-in. We request read-only access (youtube.readonly) and your email address, and we use them only to:

  • confirm you own the channel;
  • read its public statistics (name, picture, subscribers, video count, total views, creation date) to check the program requirements;
  • email you about your application.

We do not post, upload, edit or delete anything on your channel. We do not keep your Google access token after the check, and we do not share or sell this data. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Chroma Guard uses YouTube API Services; see the YouTube Terms of Service and the Google Privacy Policy. You can remove our access at any time at myaccount.google.com/permissions.

Twitch data

If you connect Twitch, we read your public channel info, follower count and past broadcasts to check the program requirements. We do not chat, follow or change anything as you.

How we protect your data

We protect personal and sensitive data, including any data we receive from Google and YouTube, with these measures:

  • Encryption in transit: every page, form and API call uses HTTPS with TLS 1.2 or newer. Plain HTTP is redirected to HTTPS, and browsers are told to always use HTTPS (HSTS).
  • Encryption at rest: our database and file storage run on Cloudflare, where stored data is encrypted at rest. Two-factor secrets are additionally encrypted with AES-GCM before they are stored.
  • Passwords and codes: passwords are never stored, only a salted PBKDF2 hash. Sign-in codes, session tokens and recovery codes are stored only as one-way hashes and expire.
  • Google and YouTube data: the Google access token is used once, during the channel check, and is never stored. We keep only what the Creator Program needs (channel ID and name, public statistics and the email for decisions), never your Google password, and nothing is shared with or sold to anyone or used for advertising. You can remove our access at any time at myaccount.google.com/permissions, and ask us to delete the data by opening a ticket.
  • Access control: only the Chroma team can view account or application data, from developer accounts that support two-factor sign-in. Staff actions such as role changes, refunds and application decisions are logged. Secrets and API keys are kept in encrypted secret storage, never in our code.
  • Payments: card details go straight to Stripe (PCI DSS Level 1) and never touch our servers.
  • Abuse protection: sign-in and forms are protected by Cloudflare bot protection (Turnstile), rate limits and lockouts after repeated failed attempts.
  • Retention and deletion: data is kept only as long as described below, and you can ask us to delete your data at any time.
  • If something goes wrong: if a security incident affects your data, we will tell affected users without undue delay and fix the cause.

How we use it

  • To run your account, deliver keys and provide support.
  • To prevent fraud, key sharing and abuse.
  • To send emails you need (codes, receipts, decisions). No marketing lists.

Who we share it with

Only the services that make the site work: Stripe (payments), Cloudflare (hosting and bot protection), Resend (email) and Discord (if you use our server or bot). We never sell your data.

How long we keep it

Account and purchase records are kept while your account exists and as long as the law requires for receipts. Closed support chats are cleared. Creator applications are kept for 12 months.

Your choices

You can ask us to see, correct or delete your data at any time by opening a ticket. Deleting your account revokes its keys.

Children

Chroma Guard is not aimed at children under 13 and we do not knowingly collect their data.

Changes

If this policy changes, we will update the date at the bottom of this page.

Last updated 11 November 2026 · Questions: open a ticket or email chromaguardav@gmail.com