§ 01

Information We Collect

Account Information

When you sign in via Google, Twitch, or YouTube, we receive basic profile information from the OAuth provider. We do not receive or store your password from any provider.

Display name & profile picture

Email address

Provider-specific user ID

Streaming Data

If you grant streaming permissions, we access your stream keys and broadcast settings on connected platforms (Twitch, YouTube) solely to forward your stream to those destinations. Stream keys are encrypted at rest and never logged in plaintext.

Usage Data

We collect service usage information and, with your analytics permission, use PostHog and any configured analytics providers to understand page and feature use. Analytics can be associated with a signed-in account; it is not necessarily anonymous. Declining optional analytics stops browser tracking. Research survey answers and follow-up contacts are stored separately and are never sent to analytics.

Technical Data

Our servers automatically log IP addresses, browser type, and request timestamps for security and debugging purposes. These logs are retained for up to 30 days and then deleted.

§ 02

Google User Data

TurboKast's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use Google account data exclusively to:

Authenticate your identity and create your TurboKast account

Display your name and profile picture within the app

Create and manage YouTube live broadcasts on your behalf (when you grant streaming permissions)

Read and send messages in your YouTube live chat while you are streaming

Update the title, description, and category of your broadcasts when you change them in TurboKast

Upload clips to your YouTube channel when you explicitly choose to publish them

Google access and refresh tokens are encrypted at rest and are used only to perform the operations listed above. We never delete your YouTube videos. You can revoke TurboKast's access at any time from your Google Account permissions page, and deleting your TurboKast account deletes the tokens we hold.

We do not sell, rent, or share Google user data with third parties for advertising or any purpose unrelated to providing the TurboKast service.

Google API Services User Data Policy

§ 03

Data Storage & Security

Encryption at Rest & In Transit

OAuth tokens and stream keys are encrypted at rest using AES-256-GCM. Stream keys are stored as SHA-256 digests — plaintext keys are never persisted. All connections use TLS (HTTPS) in transit.

Where your stream goes, and what we keep

Your stream passes through our servers so we can forward it to the destinations you have connected. Along the way we keep two things, both briefly: a short-lived copy of your live session, held so we can show you the preview in your browser, which expires after 24 hours and is then deleted automatically; and any clips — auto-clip is on by default and saves clips for you to review, and you can turn it off per stream from the Autoclip panel on your broadcast page. A clip you do not act on expires after 7 days and is then removed from your account on a rolling basis, and we ask our storage provider to delete the stored file at the same time; a clip you publish stays until you ask us to delete it. We do not keep a permanent archive of your broadcasts, we do not sell or licence your content, we do not publish it anywhere except to the channels you connect and ask us to publish to, and we do not use it to train our own models. Our servers run in London, United Kingdom, and in Ashburn, United States. Clips and preview segments are stored in Cloudflare's Western Europe region and served through Cloudflare's network, which keeps short-lived cached copies near whoever is watching. Some of the companies that help us run the service are based outside the UK.

Zero Plaintext Keys

Stream keys never leave our system in readable form.

§ 04

Data Sharing

We share information only in these limited circumstances:

Streaming platforms

Your stream data is forwarded to destinations you have connected (Twitch, YouTube, custom RTMP endpoints).

Payment processor

Stripe processes billing on our behalf and receives only the information required to complete transactions.

Infrastructure providers

Fly.io and Cloudflare host our services and may process requests in the course of providing infrastructure.

Legal requirements

We may disclose information if required by law, regulation, or valid legal process.

We do not sell your personal information to any third party.

§ 05

Data Retention

We retain your account data for as long as your account is active. Streaming session metadata is retained for analytics and history purposes. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law.

§ 06

Cookies

TurboKast uses a necessary session cookie for login and form security. If you allow analytics, configured providers may use cookies or browser storage. Research pages disable replay and automatic form capture; their optional analytics requires your permission.

§ 07

Your Rights

Revoke Access

You can disconnect any OAuth provider from your TurboKast Settings page at any time. You can also revoke access directly from your provider account:

Google Account Permissions Twitch Connections

Access Your Data

Contact us to request a copy of the personal data we hold about you.

Delete Your Data

Contact us to request deletion of your account and associated data.

Opt Out of Analytics

Use the analytics choice on the site to decline optional browser analytics, or contact [email protected] for help. See the research privacy notice at /research/streamer-workflow/privacy for survey-specific processing.

§ 08

Children's Privacy

TurboKast is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us so we can delete it.

§ 09

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by posting the updated policy on this page with a revised "Last updated" date. Your continued use of TurboKast after changes are posted constitutes acceptance of the updated policy.

§ 10

People We Contact About Our Services

If we have contacted you at work to offer our services, this section explains what we hold about you and why. The controller is TurboKast Ltd, a company registered in Scotland, company number SC881077, registered office 29 Commercial Street, Dundee, DD1 3DG, United Kingdom. Contact: [email protected].

What We Hold: Your name, job title, work email address and employer, the public source where we found each of them, and a record of our contact with you.
Where We Get It: Company websites, Companies House, public LinkedIn profiles, published articles that name you in your role, and Hunter.io, an email-lookup service.
Why We Use It: Only to offer our services to the organisation you work for.
Our Lawful Basis: Legitimate interests (UK GDPR Article 6(1)(f)): our interest in telling businesses about a service that is relevant to their work. We have weighed it against your interests and rights and concluded that they do not override it, because we contact you only in your work role at a company or other corporate body, use only your work contact details, send at most a first email and two follow-ups, do not track opens or clicks, and stop as soon as you ask.
Who Else Sees It: It stays with us and the services that help us run this outreach: our email provider, Zoho Mail (EU data centre); the AI service we use to help draft messages, Anthropic; and Hunter.io, which verifies email addresses. We do not sell it.
How Long We Keep It: We delete it 12 months after our last contact with you, unless we start working together. If you object, we keep your email address and your organisation's email domain on a suppression list for as long as we need to, so that we never contact you again.

Your Right to Object

You can object at any time. For direct marketing this right is absolute (UK GDPR Article 21(3)): once you object, we stop contacting you. Reply "no" to any of our emails, or write to [email protected].

Your Other Rights

You can ask to see, correct, restrict or delete the details we hold about you. You can also complain to us, or to the Information Commissioner's Office (ico.org.uk).