Privacy Policy

Streamako is a live-streaming service under development for separate user accounts. This policy explains how the Streamako project operator handles account information, camera content, recordings, and integration data. For privacy questions and requests, contact dubovyyandriy@gmail.com.

The dashboard is currently restricted to the operator's local network. The new account-based Google/YouTube integration is being developed and is not yet deployed or accepted end to end. The Google application's publishing status is In production, which removes the special seven-day refresh-token expiry of Testing mode but is not Google verification or a public launch of Streamako. Descriptions of that integration below apply when it is enabled; publishing this policy is not a statement that it is available or verified by Google.

Information processed

• Account and security: the name and email address you register, a password hash rather than your plaintext password, verification and password-reset records, session identifiers, and security-related request information such as IP addresses.
• Streaming: account settings, camera authentication credentials, stream destinations, session times, stream status, and technical measurements used for routing, interruption handling, support, and incident investigation.
• Camera content and recordings: the audio and video you send, temporary recording parts, prepared final files, file sizes and integrity checks, ownership, storage and archive-job status, and the displayed availability date.
• Communications: transactional email delivery information and messages you send to support.

This information is used to provide the features you request, authenticate access, keep accounts and recordings separate, enforce service limits, recover failed jobs, deliver essential messages, and diagnose failures. Do not send content you do not have permission to transmit or record.

Google and YouTube data

When enabled, the integration uses Google OAuth 2.0 and YouTube API Services. It requests https://www.googleapis.com/auth/youtube.force-ssl after your explicit authorization. This is a YouTube management permission, not a read-only permission. It does not authorize access to Gmail or Google Drive, and Streamako does not ask for your Google password.

The integration will process the channel identifier and title, access and refresh tokens, broadcast and live-stream identifiers, user-selected titles and settings, scheduled times, lifecycle status, ingestion configuration, and related recovery information. These are used only to connect the channel you authorize and create, bind, monitor, start, and complete the live broadcasts you request.

The integration is not intended to download videos from YouTube, inspect unrelated Google services, sell Google user data, target advertising, or train general-purpose AI models. Recordings in Streamako originate from the camera stream you submit, not from downloading a YouTube replay. Enabling a new use or requesting additional permissions requires a corresponding disclosure and consent where required.

Storage and safeguards

Account settings, session ownership, and the file catalog are stored in the service's MySQL database. Media servers process live content and temporary recording parts. Verified final files are transferred to private Cloudflare R2 storage; the local recording workspace is cleared only after the required integrity and ownership checks succeed. Failed recording parts may remain on the media server for investigation and recovery, and count toward the account's storage usage.

Downloads are authorized against the account and central file catalog before a temporary private-storage link is issued. Anyone to whom you disclose a still-valid download link may be able to use it; do not publish it. Account passwords are hashed. The new OAuth integration is designed to store refresh tokens encrypted in the database, with the application encryption key and Google client secret outside public files and source control. This design must pass testing before the integration is enabled.

The service uses restricted administrative access and encrypted system/database backups in a separate private R2 bucket. These measures reduce risk but do not guarantee that an incident or data loss is impossible. The development system is not a substitute for your own backup.

Service providers and disclosures

• Cloudflare: hosts these public information pages and provides private R2 object storage for recordings and encrypted backups. Visiting the pages involves ordinary hosting/network processing such as your IP address and requested URL.
• Google and YouTube: receive OAuth and API requests and, when selected as the destination, the audio/video and broadcast settings you instruct Streamako to transmit. Your channel's visibility settings determine who can view that content on YouTube.
• Email delivery: the current DEV service sends essential account and operational email through Gmail SMTP. Your email address and the message content are processed for delivery.

Authorized operators may access the minimum data needed to operate the service, resolve support requests, investigate incidents, or meet legal obligations. Streamako does not sell or rent personal information or Google user data. Providers may process information in countries different from your own; this DEV preview does not promise storage in a particular jurisdiction.

Cookies and public pages

The dashboard uses cookies needed for login sessions, authentication, and request protection. The public-page source contains no advertising scripts, embedded YouTube player, or tracking cookies added by Streamako. Cloudflare hosting may add a Web Analytics beacon to public-page responses to measure page views and browser performance; this hosting-layer processing is separate from the private dashboard. Hosting providers also process requests under their own policies. See Cloudflare Web Analytics and the Cloudflare Privacy Policy.

Retention and recording availability

Ready recordings have a 30-day download availability period measured from their first confirmed readiness in private storage. The dashboard displays the expiry date and blocks new download links after expiry. Re-uploading a file or retrying a transfer does not restart that period. Existing temporary links can remain usable until their short validity period ends.

Automatic physical expiry deletion and warning emails are not yet implemented. During this limited preview, expired files and failed recording parts require operator review and cleanup; they must not be treated as already erased merely because access has expired. Contact the operator for deletion rather than relying on the expiry date as proof of physical removal.

Account information is retained while needed to provide your account and handle security or support matters. Technical logs, incident evidence, and encrypted backups have separate operational purposes; recording expiry does not itself delete those copies. Precise production retention periods and automated cleanup are still being finalized before a public launch.

Google/YouTube API data must be deleted or refreshed within 30 calendar days where required by the YouTube API Services Developer Policies. This is distinct from the 30-day availability of your own camera recordings. The new integration will not be enabled until authorization checks, revocation, deletion, and backup handling have been verified against those requirements.

Your choices and deletion requests

You can stop sending camera content at any time. Request access to, correction of, or deletion of your account, recordings, or integration data by emailing dubovyyandriy@gmail.com from your registered address. State which data you want removed. We may verify account ownership; never send passwords, stream keys, or OAuth tokens in a support request.

For Google/YouTube data, the operator must honor a valid deletion request, account deletion, or revocation as soon as possible and within seven calendar days of the applicable request or revocation. This includes stored authorization tokens and associated authorized data, not just disconnecting a button. During DEV this requires operator handling; a completed self-service deletion feature is not being claimed.

Deleting data from Streamako does not delete a broadcast or replay stored by YouTube. Use YouTube's own controls to remove content there. Deleting one recording is also distinct from revoking the entire integration.

Revoking Google access

You can revoke Streamako's authorization through Google Account third-party connections. Revocation and erasure of stored data are separate operations. Also contact the operator so that the applicable deletion procedure, including affected backup handling, can be completed. The seven-day deadline is not extended by waiting for a routine backup rotation.

Google policies and changes

Google's handling of data is described in the Google Privacy Policy. Streamako's use and transfer of information received from Google APIs must adhere to the Google API Services User Data Policy, including its Limited Use requirements. Nothing in this preview policy creates an exception to Google's or YouTube's requirements.

We update this policy when data practices change. Material changes will be disclosed and fresh consent obtained where required before the new use begins. The date above identifies this version.

Contact

Streamako project operator: dubovyyandriy@gmail.com. See also the Terms of Service.