Privacy Policy

Mizkif Global (browser extension) · Last updated 31 August 2026

This policy explains what the Mizkif Global browser extension ("the extension") does with your data. It applies only to the extension, not to the rinaudoglobal.com website or any other service.

What the extension does

The extension lets you earn tickets in Mizkif's game by engaging with his content. It notices when you like, comment on, like a comment under, watch, repost, or send one of his promoted posts and videos on YouTube, TikTok, Instagram, and X (the site at x.com, which also answers to twitter.com), and it tells the game so the action can be credited. The game decides what each action is worth and those rates change from season to season: as of this update, comments earn nothing on any platform. The extension also shows the live poll from Mizkif's Kick stream so you can vote, checks in while that stream is playing so your watch time counts, and notifies you when he goes live or posts. Tickets are credited to the account you link once with "Connect with Kick."

Which sites it runs on

The extension loads on these sites and nowhere else:

• kick.com, on Mizkif's channel page: to show the live poll and vote card, and to check in about once a minute while his stream is playing so your watch time there can earn.
• youtube.com and m.youtube.com: to spot your like, comment, comment like, or watch on one of his promoted videos.
• tiktok.com and m.tiktok.com: the same, for his promoted posts.
• instagram.com (and instagr.am): the same, for his promoted posts, including when you share one.
• facebook.com (including web.facebook.com and m.facebook.com): the same, for his promoted reels.
• reddit.com (and old.reddit.com): to spot your upvote or reply on one of his promoted posts, and, on his own profile page only, to notice the addresses of his newest posts so the game learns about them promptly. Which posts of his you happen to see elsewhere on Reddit is never read or sent.
• x.com and twitter.com: to spot your like, reply, comment like, or repost on one of his promoted posts. The next section covers exactly how the repost check works.
• s2.jsolutions.dev/extension/connect: the single page where "Connect with Kick" finishes and hands the extension your account token.

On every other site the extension is not loaded at all, so it cannot see the page.

How the repost check works on X

A repost earns tickets only when X itself confirms the repost happened. A button click on its own is not proof, so on x.com and twitter.com the extension watches the requests the X page sends while you use it. Here is the whole of what that means:

• It checks the web address of each request. Nearly every request X makes is left alone at that point and never looked at again.
• Only when the address is X's own "create repost" call does the extension look any further, and the only thing it takes from that request is the id of the post you reposted.
• It notes whether X accepted the request. That is a yes or no, not content.
• It never reads what X sends back. The reply is handed straight to the page untouched: the extension does not open it, change it, delay it, or block it.

It does not read your timeline, your posts, your drafts, your direct messages, or your followers, and it does not read the words you type. This check runs on X only. It does not run on Kick, YouTube, TikTok, Instagram, Facebook, or Reddit, and it does not run on any other site.

What we store

• Your account token. When you choose "Connect with Kick," a single authentication token is stored locally in your browser (chrome.storage.local). It is used only to authenticate your requests to s2.jsolutions.dev, never leaves your browser except in the Authorization header of calls to that server, and is deleted when you remove the extension or clear its storage.
• An anti-fraud device token. A random identifier the extension generates the first time it runs and stores locally (chrome.storage.local). It is not derived from your hardware and contains no personal information. It simply lets the game tell one browser install apart from another so a single person can't farm tickets across many accounts. You can reset it by clearing the extension's storage or reinstalling.
• A device fingerprint, and three coarse device traits. The extension computes a one-way hash of general device characteristics (graphics renderer, a canvas drawing, browser/timezone/CPU details) and caches that hash locally. The values behind the hash are not kept; the hash is what travels with your requests. Alongside it, each authenticated request also carries three coarse traits as plain values: the name your browser reports for your graphics renderer, your CPU core count, and your memory size. The server keeps those three next to the hash. All of it is used only to detect duplicate accounts and automated abuse, where a virtual machine gives itself away by reporting a software renderer on a two core box.
• Local state only. The extension also keeps small bookkeeping values locally (e.g. the last poll/video/post already shown, so you aren't notified twice, and where you dragged the on-page card). These stay on your device.

What we send, and to whom

The extension sends your account data to only two servers. It also makes a few read-only requests to YouTube, listed last, which carry nothing about you:

• https://s2.jsolutions.dev (the game API): to exchange your Connect-with-Kick login for an account token; to record when you like, comment on, like a comment under, watch, repost, or send one of Mizkif's promoted posts or videos; to check in while Mizkif's Kick stream is playing; to fetch the active poll and submit your vote; to fetch the public reward-rate list; and two kinds of troubleshooting note, both of which carry no page text: when a reply on X does not register, which button was clicked and how many characters your draft was (never the words themselves); and, when a page stops looking the way the extension expects, which platform, which control it could not find, and on which post, so a site redesign is caught in days rather than by user reports.
• https://rinaudoglobal.com (public status feed): the extension periodically checks whether Mizkif is live or has posted, to power notifications. This requires no login and sends none of your data.
• https://www.youtube.com and https://i.ytimg.com: when Mizkif uploads a new video, the extension asks YouTube whether it is a Short and fetches the video's thumbnail so the notification can show it. Both are ordinary public requests about a video that was just published. Neither carries your account token, and neither says anything about you.

When an engagement is credited, three things go out: which site and which post (its id, the same one you can read in the post's public web address), which action it was (like, comment, comment like, watch, repost, or send), and your account token, so the tickets land on your account. While a video plays, the extension also sends periodic "still watching" signals. Every one of these requests carries the anti-fraud device token, fingerprint, and coarse device traits described in the next section.

What never leaves your browser: the contents of the pages you visit, the text of your comments (we send only that you commented on a given post, never what you wrote), the text of any comment you like or the name of whoever wrote it (we send only that comment's public id, the same id in its own permalink, so the same comment is never paid for twice), your direct messages, your passwords, your browsing history, and anything at all from a site the extension does not run on.

Preventing duplicate accounts and bots

Because tickets have real value, we take basic steps to stop one person from farming them with many fake accounts or bots. With each authenticated request to s2.jsolutions.dev, the extension includes the anti-fraud device token, device fingerprint, and the three coarse device traits described above. The server additionally records a one-way, salted hash of your IP address (your actual IP address is never stored, only a hash that can be compared for a match, not reversed) and the name of the network operator that address belongs to, which tells a home connection apart from a rented server. These signals are used only to group accounts that appear to share a device or network for manual review before payouts. They are never sold, shared with third parties, used for advertising, or used to track your browsing, and they are never shown to other users.

What we do not do

• No analytics or behavioral tracking of how you use the web. The only device and network signals we collect are the anti-fraud identifiers described above, used solely to keep the ticket economy fair.
• No advertising, and no selling or sharing of data with third parties.
• No tracking of your general browsing. The extension runs only on the sites listed above, and only to detect your deliberate engagement with Mizkif's promoted posts and to show its own on-page card. It does not collect the contents of those pages. The one place it looks inside anything is the X repost check described above, which takes a post id out of a request the X page was already sending. The words you type in a comment stay on your device and are never transmitted; only the character count is, and only in the troubleshooting note described above.
• No collection of names, emails, payment details, or other personal information by the extension itself.

Permissions, and why

• storage: to store your account token and local state.
• alarms: a periodic timer to check for open polls and new content.
• notifications: desktop alerts when a poll opens or Mizkif goes live or posts.
• host access to s2.jsolutions.dev and rinaudoglobal.com: to talk to the game API and the public notifications feed, and to finish the "Connect with Kick" sign-in.
• host access to kick.com: to show the vote card on Mizkif's stream.
• host access to youtube.com, tiktok.com, instagram.com, and facebook.com, including their mobile addresses: to detect your likes, comments, comment likes, shares, and watches on Mizkif's promoted posts, reels, and videos there, so the game can credit them.
• host access to reddit.com: to detect your upvotes and replies on his promoted posts, and to notice his newest posts from his own profile page, so the game can credit and announce them.
• host access to x.com and twitter.com: to detect your likes, replies, comment likes, and reposts on his promoted posts there, so the game can credit them, including the repost check described above.

Open source

You do not have to take any of this on trust. The extension's code is public and you can read every line of it at github.com/SolutionsCMD/rinaudo-extension. The X repost check is the file content/observe.js.

Your choices

There is no disconnect button in the popup today. To stop the extension, remove it from your browser: that deletes the account token and everything else it stored on your device, and the on-page cards stop appearing. The token stays valid on the server until it is revoked, so if you want it killed as well, email the address below and we will revoke it. You can also switch off any of the notifications and the on-page vote card from the popup at any time, which stops those without removing anything.

Contact

Questions about this policy? Email privacy@rinaudoglobal.com.