Privacy Policy

Last updated: 17 August 2026

1. Who we are

dystrocast (dystrocast.com) is a browser-based live streaming studio. The data controller is the operator of dystrocast. For anything in this policy, contact privacy@dystrocast.com. You will be asked to agree to this policy when you create an account; if we materially change how we use your data — including YouTube data — we will ask you to agree again before the change applies to you.

2. Data we collect

• Account — your email address, display name, and a hashed password (email sign-up) or your Google account id (Google Sign-In). Email verification codes are short-lived and stored only as keyed hashes.
• Platform connections — when you connect a streaming platform, the account/channel id, name and avatar, plus encrypted access tokens. YouTube specifics are in section 3.
• Broadcast content — show and broadcast titles, descriptions, scenes, brand assets and poster images you upload.
• Live media and recordings — the audio and video of you and your guests is processed in real time to composite and deliver your broadcast; when recording is enabled, the MP4 is stored until you delete it.
• Participants — guests’ display names, their role, and their voice consent choice.
• Technical — IP address and browser details in server logs and error reports, and the essential cookies in section 12.

3. YouTube data (YouTube API Services)

dystrocast uses YouTube API Services to provide the YouTube integration.

What we access and store. When you connect your YouTube channel we access and store: your channel id, channel title and channel thumbnail; OAuth access and refresh tokens (encrypted with AES-256-GCM); and, for each broadcast you create, the live broadcast and live stream ids, the ingest address and stream name (encrypted), the watch URL and the event status.

How we use and share it. We use this information solely to provide the features you ask for: creating and managing live events on your channel, delivering your broadcast to YouTube, setting thumbnails, and showing you event status. It is shared only with YouTube itself to perform those actions. We never sell it, never use it for advertising, and no person reviews it except to support you at your request. dystrocast does not allow third parties to serve content or advertisements in the product.

dystrocast’s use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. (See the Google API Services User Data Policy.)

Google’s handling of this data is described in the Google Privacy Policy at http://www.google.com/policies/privacy.

Deleting and revoking. Disconnect your channel at any time from the Connections page: we revoke our access with Google and immediately delete the stored channel data and tokens. In addition to disconnecting in dystrocast, you can revoke dystrocast’s access to your data at any time via the Google security settings page at https://security.google.com/settings/security/permissions. Where access is revoked on Google’s side, we delete the associated stored data within 30 days. Records of past broadcasts (event ids and watch links) are deleted when you delete those broadcasts or your account.

Questions or complaints about our privacy practices, including YouTube data: privacy@dystrocast.com.

4. Google Sign-In

If you sign in with Google, we receive your name, email address and Google account id to create and secure your dystrocast account. We only accept Google accounts with a verified email address.

5. How we use data, and our legal bases

• To provide the service (contract) — accounts, broadcasts, streaming, recordings.
• To keep it safe and working (legitimate interests) — abuse prevention, rate limiting, error monitoring.
• Platform connections (consent) — you choose to connect each platform and can disconnect at any time.

We do not profile you, make automated decisions about you, or use your data for advertising.

6. Who we share data with

• Destinations you choose — the platforms you stream to (for example YouTube (Google), Twitch, or your own RTMP endpoints) receive your broadcast and its metadata at your direction.
• Stripe— our payment processor for paid plans. Stripe receives the billing details you enter at checkout (card details go directly to Stripe and never touch our servers); we store only your Stripe customer/subscription identifiers, plan and billing status. See Stripe’s privacy policy at stripe.com/privacy.
• Processors that run dystrocast — LiveKit (real-time media and composition), Microsoft Azure (hosting, storage, database), Resend (transactional email), Sentry (error monitoring), and Cloudflare (network, DNS and Turnstile bot protection).
• AI-dubbing processors (when dubbing is enabled) — when a broadcast enables dubbing, its live audio is sent to the following third-party processors: Soniox (for speech-to-text transcription), Azure OpenAI (for translation and quality checking), and Cartesia (for voice synthesis to create dubbed audio in selected languages).

We do not sell personal data and do not share it for advertising.

7. International transfers

We operate from the United Kingdom; some processors above run services in the EU and the United States. Where data leaves the UK or EEA, we rely on the providers’ appropriate safeguards (such as the UK IDTA or EU Standard Contractual Clauses).

8. How long we keep data

• Account data — until you ask us to delete your account (email privacy@dystrocast.com); we complete deletion within 30 days, and delete data linked to a connected YouTube channel within 7 days.
• Connected platform tokens and channel data — until you disconnect (deleted immediately) or revoke access at the platform (deleted within 30 days).
• Recordings, posters and brand assets — until you delete them or your account.
• Verification codes — minutes (they expire after 15 minutes).
• Server logs and error reports — short operational windows.

9. Your rights

Under UK GDPR you can ask for access to, correction of, deletion of, or a copy of your data, and you can object to or restrict certain processing. Email privacy@dystrocast.com and we will respond. You can also complain to the Information Commissioner’s Office (ico.org.uk) or your local supervisory authority.

10. Security

Data moves over TLS. OAuth tokens and stream keys are encrypted at rest with AES-256-GCM. Access to production systems is restricted to the operator.

11. Children

dystrocast is for adults 18 and over and is not directed at children.

12. Cookies

We use essential cookies only: session authentication, security (CSRF), and Cloudflare Turnstile bot protection during sign-up. We do not use advertising or analytics cookies.

13. Changes to this policy

We will post updates here with a new date above, and for material changes we will notify you and, where required, ask for your agreement again.

14. Contact

Privacy: privacy@dystrocast.com · Legal notices: legal@dystrocast.com