Privacy Policy

We collect information you provide directly (such as your name and email when you are invited to the app) and information obtained through authorized OAuth integrations with third-party services. The specific data we collect includes:

• Account information: your user ID, full name, email address, and role (admin or user) within the app.
• Google account data: your Google account identifier and email address, obtained via Google OAuth when you connect your account.
• YouTube channel data: your channel ID, channel title, channel thumbnail, and the refresh token used to maintain access to the YouTube Live Streaming API on your behalf.
• YouTube broadcast data: broadcast and stream IDs, stream keys, video titles, descriptions, visibility settings, scheduled start times, view counts, and stream status (scheduled, live, ended) for broadcasts you create or manage through the app.
• Device configuration: scoreboard IDs, device names, OS type, camera IP addresses, proxy URLs, stream URLs, and OBS WebSocket passwords that you configure for each remote site.
• Usage data: aggregated, de-identified analytics about feature usage to help us improve the Services.

This section addresses, in one place, the Google user data our application accesses, how it is used, with whom it is shared or disclosed, the protection mechanisms applied to it, and how long it is retained.

2.1 What Google user data we access. When you connect your Google account via OAuth 2.0, StreamStudio accesses the following Google user data, limited to the scopes each feature requires:

• Your Google account identifier (user ID) and email address, used to identify you and link your YouTube channel.
• Your YouTube channel ID, channel title, and channel thumbnail image.
• A YouTube OAuth refresh token that lets the app maintain access to the YouTube Live Streaming API on your behalf between sessions.
• YouTube broadcast and stream metadata you create or manage through the app: broadcast and stream IDs, stream keys, video titles, descriptions, visibility settings, scheduled start times, view counts, and stream status (scheduled, live, ended).

2.2 How we use Google user data. We use your Google user data only to provide the features you initiate within the app:

• To authenticate your Google session and link your YouTube channel to your StreamStudio account.
• To create, schedule, transition (go live), and end live broadcasts on your YouTube channel when you request it.
• To retrieve updated view statistics and broadcast status so the dashboard reflects current stream performance.
• To display your channel name and thumbnail within the app interface.

We do not use your Google user data for advertising, and we do not sell it.

2.3 With whom we share, transfer, or disclose Google user data. We do not share, transfer, or disclose your Google user data except:

• To Google's YouTube Live Streaming API, but only to perform the actions you initiate (creating a broadcast, going live, fetching statistics). The data sent is the minimum required by that API.
• To our cloud hosting provider (Base44) which stores the data securely on our behalf under appropriate confidentiality and data-processing obligations.
• If required by law, court order, or valid legal process, we may disclose data to the relevant authority.

We do not share your Google user data with advertising networks, data brokers, or any other third party for their own purposes.

2.4 Data protection mechanisms for sensitive data. Google user data includes sensitive items (your OAuth refresh token and stream keys). We protect these and all Google user data with the following mechanisms:

• Encrypted transmission over HTTPS/TLS for all data in transit between your browser, our servers, and Google's APIs.
• Encrypted at rest in our cloud database; OAuth refresh tokens and API keys are stored as server-side secrets, never exposed to the browser or to other users.
• Strict access controls: only authenticated, authorized users can access data, and only the records and devices assigned to them (row-level security).
• Remote site connections are secured through Tailscale tunnels, and ONVIF proxy endpoints are protected by API-key authentication.
• Principle of least privilege: we request only the OAuth scopes each feature requires and no more.

2.5 Retention and deletion of Google user data. We retain your Google user data only as long as necessary to provide the Services:

• Your YouTube OAuth refresh token is retained until you revoke access or your account is removed. Revoking access (from your Google Account security settings) invalidates the token and stops the app from performing further actions on your behalf.
• YouTube broadcast metadata is retained for the lifetime of the broadcast record in the app, and is deleted when you delete the broadcast or your account.
• Channel information (channel ID, title, thumbnail) is retained while your account is active and is deleted when your account is removed.
• You may request deletion of your Google user data at any time by contacting us at support@websports.co.za; we will delete it within 30 days of a verified request.

We use the information we collect to:

• Operate and maintain the Services, including authenticating your sessions and displaying your data within the consoles.
• Create and manage YouTube live broadcasts on your behalf when you initiate those actions.
• Send commands to OBS Studio and PTZ cameras at the remote sites you are authorized to control.
• Enforce per-user device access so each operator only sees and controls the hardware assigned to them.
• Provide support and respond to your enquiries.
• Improve our tools and develop new features. Aggregated, de-identified data may be used for analytics.

We retain your data only for as long as necessary to provide the Services and to comply with legal obligations. YouTube refresh tokens are retained until you revoke access or your account is removed. Device configuration is retained until you delete the device or your account. Broadcast metadata is retained for the lifetime of the broadcast record in the app. You may request deletion of your data at any time by contacting us at support@websports.co.za.

We do not share your personal data with third parties except where required by law, or with service providers who process data on our behalf under appropriate confidentiality obligations. Specifically, your Google and YouTube data is sent to the YouTube Live Streaming API only to perform the actions you initiate. We do not share your data with any advertising networks.

We implement reasonable technical and organizational measures to protect your data, including encrypted transmission (HTTPS/TLS), access controls, and secure storage of OAuth tokens and API keys. Remote site connections are secured through Tailscale tunnels, and ONVIF proxy endpoints are protected by API-key authentication. However, no method of transmission over the internet is fully secure, and we cannot guarantee absolute security.

You may request access to, correction of, or deletion of your personal data. You may also revoke the app's access to your Google account at any time from your Google Account security settings. To exercise your data rights within the app, contact us at support@websports.co.za.

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated revision date.

For any privacy-related enquiries, contact us at support@websports.co.za.