Privacy policy
What we store, why, and how you stay in control – in plain language.
In short
- We only store what we need to run your streams.
- With Google sign-in we get your name and email – nothing else.
- We use your email only for your account – password resets and service notices like low credit or a stopped stream. Never for marketing.
- If you connect YouTube, we can only read your channel name and stream keys. We never post, change or delete anything.
- We never sell your data, and you can disconnect Google or delete your account any time.
What we store
- Your account: username, a hashed password (if you set one), your email address and whether you've confirmed it, and your Google account ID if you log in with Google.
- Your streams: uploaded files, stream settings (including stream keys), stream logs and live-time statistics.
- Billing: credit balance, top-ups and the country of your card (for VAT). Card details are handled by Stripe – we never see them.
- Feedback: messages and screenshots you send us, with the page you were on and the status of your streams at the time.
Your email
We ask for your email when you sign up with a username and password, or when you add it on your Account page. If your account has no email, we save the one from Google sign-in, or the one you enter when paying with Stripe. We never replace an email you've already given us.
We use it only to run your account: links to confirm your email or reset your password, and service notices such as low credit or a problem with one of your streams. We don't send marketing or newsletters, and we never share your email with anyone except our email provider, Resend ↗, which delivers our messages. Links in our emails work once and expire after 1 hour (password reset) or 24 hours (email confirmation). You can change your email any time, and it's deleted together with your account.
Connecting YouTube
When you connect a YouTube channel, you give us read-only access (youtube.readonly) through the YouTube API Services. We use it only to:
- list your channel's stream keys, so you can pick one instead of copying it by hand;
- verify that the stream key you use belongs to your own channel; and
- find the link to your current live broadcast, so the stream can be checked.
We store a refresh token for this access, plus your channel's ID, name and handle. We don't store anything else from your YouTube account. Our use of information from Google APIs follows the Google API Services User Data Policy ↗, including the Limited Use requirements.
By connecting YouTube you also agree to the YouTube Terms of Service ↗. Google's handling of your data is described in the Google Privacy Policy ↗.
Verifying your channel with a code
To make sure nobody streams to someone else's channel, we ask you to put a short code in your YouTube channel description once. We then read your channel's public name and description through YouTube's public API – no sign-in and no access to your account. While you stream, we also look at your channel's public live page to confirm the stream shows up there. We store your channel's ID and name with your account, and a fingerprint of the stream key (never the key itself for this check). You can remove the code as soon as the channel is confirmed.
Your control
- Disconnect Google or YouTube on your Account page. We then revoke our access and delete the token.
- You can also remove our access at myaccount.google.com/permissions ↗.
- When your account is deleted, your files, stream settings and Google tokens are deleted too. Bookkeeping records are kept as long as the law requires.
Questions
Contact us via info@castloop.io.