Privacy Policy & Telemetry Transparency

To provide technician authentication, credit accounting, software license verification, and secure cloud operations, KG Killer collects the following minimal categories of data:

• Account Identification: Username, email address, password hash, registration timestamp, and account status (approved, active, or suspended).
• Session & Network Data: Client IP address, user agent headers, session token identifiers, and last authentication timestamp.
• Operational Diagnostics: Selected service code (e.g., FRP, EDL Sahara, MTK BROM, UBL), credit consumption values, and success/failure completion states.

When the desktop software client connects to our master licensing servers, it generates a unique cryptographic fingerprint (Hardware ID or HWID) based on machine architecture:

• Composition: Hashed combination of Motherboard UUID, Processor Serial, and Windows machine GUID.
• Purpose: Strictly utilized to prevent concurrent account sharing, unauthorized credential leakage, and software piracy across unlicensed computers.
• Modification: Users can request HWID resetting through the user portal or authorized resellers subject to account credit balance policies.

Connected Mobile Device Diagnostics: Device communication mode (Qualcomm 9008 EDL, Fastboot, MediaTek VCOM, or ADB sideload) and Anti-Rollback (ARB) index are analyzed solely during the active flashing session to ensure safety and prevent hard-bricking. These parameters are not linked to consumer identities.

All user balance deductions, credit top-ups, and automated API requests maintain an immutable financial ledger inside our database:

• Audit Records: Every operation generates an entry recording operation_id, username, credits_deducted, balance_after, machine, and transaction timestamp.
• Failed Operations & Automatic Refunds: In the event of an upstream server handshake timeout or Sahara protocol disconnect prior to flash completion, credits are automatically refunded or not debited.
• Log Retention: Operational credit records are preserved for dispute resolution and financial reconciliation with authorized distributors.

Our specialized Xiaomi Authorization gateway facilitates secure flashing and bootloader unlocking by interacting with upstream authorization infrastructure:

• Config Blob Transmission: The dynamic cryptographic blob required to sign Sahara or MediaTek firehose authorizations is processed in-memory and relayed over encrypted HTTPS.
• Zero Blob Storage: We do not store, archive, or inspect the private cryptographic certificates contained inside the handshake payload once the transaction terminates.
• Telegram Audit Channel: Automated administrative alerts notify technicians and management regarding tool status, remaining credit balance, and operation summaries via encrypted Telegram Bot webhook channels.

For automated wholesaler integration, our platform implements standard DHRU Fusion API protocol handlers (/api.php and /dhru-api):

• API Key Authentication: Requests from external GSM server systems must provide valid reseller credentials (username and hashed API key).
• Order Verification: Data transmitted via DHRU API (such as target user email and requested credit quantity) is processed solely to fulfill credit credits or activation licenses.
• Non-Disclosure: Customer lists imported through reseller integrations remain confidential and are never shared with competing suppliers.

We apply defense-in-depth methodologies across both our web portal and API microservices:

• Transport Layer Security: All web traffic and desktop tool handshakes are strictly enforced over TLS 1.3 / HTTPS encryption.
• Database Protection: Database connections are restricted behind firewall security rules with least-privilege credential scopes.
• Brute Force Shielding: Automated rate-limiting and IP throttling protect login endpoints and API gateways against credential-stuffing attacks.

Our web application uses essential cookies and client-side storage technologies to deliver optimal browsing experiences:

• Session Authentication: Secure HTTP-only cookies maintain authenticated user and reseller states across portal navigations.
• CSRF Protection: Cross-Site Request Forgery tokens protect forms and state-changing actions from unauthorized execution.
• UI Preference: Local storage preserves your selected visual mode (Dark Cyber or Clean Light theme) across page visits.

We do not utilize third-party ad-tracking cookies, tracking pixels, or cross-site behavioral telemetry.

Regardless of geographical location, all registered technicians enjoy rights regarding their personal and account data:

• Right to Access: View all current credit logs, account registration dates, and active HWID records directly inside the User Portal.
• Right to Rectification: Request corrections to registered contact email or account attributes.
• Right to Erasure (Account Termination): Request complete account decommissioning and de-linking of machine hardware identifiers by submitting a signed ticket to the Telegram Admin.

We reserve the right to revise this Privacy Policy periodically to reflect new software capabilities, upgraded encryption protocols, or changes in regulatory standards. Substantive updates will be highlighted via portal announcements and official Telegram channel broadcasts.

For privacy inquiries, data protection requests, or security vulnerability disclosures:

• Official Telegram Channel: t.me/Kg_killer
• Administrative Desk: https://t.me/Kg_killer
• Official Website: https://api.kgkiller.com