§ 01

Information We Collect

Account Information

When you sign in via Google, Twitch, Kick, or YouTube, we receive basic profile information from the OAuth provider. We do not receive or store your password from any provider.

If you sign in with Kick, we hold your Kick user ID, username and e-mail address. We use them only to create your TurboKast account and to recognise you when you sign in again. We do not keep a Kick access or refresh token from signing in. If you disconnect Kick as a sign-in method in Settings, or delete your TurboKast account, we delete this record. You can also end TurboKast's access at any time in Kick's own settings.

Display name & profile picture

Email address

Provider-specific user ID

Streaming Data

If you grant streaming permissions, we access your stream keys and broadcast settings on connected platforms (Twitch, YouTube, Kick) solely to forward your stream to those destinations. Stream keys are encrypted at rest and never logged in plaintext.

If you connect a Kick account, we hold your Kick broadcaster ID, your channel name (slug) and the access and refresh tokens Kick issues to us, which are encrypted at rest. We use them only to connect your channel, so we can send your stream to Kick and, for the features you use, read and update your channel and chat. If you disconnect Kick, or delete your TurboKast account, we revoke the grant at Kick and delete the Kick data we hold. If Kick tells us that you have revoked the grant on Kick's side, we delete it within 30 days. You can also revoke TurboKast's access at any time from your Kick account settings.

Usage Data

We collect service usage information and, with your analytics permission, use PostHog and any configured analytics providers to understand page and feature use. Analytics can be associated with a signed-in account; it is not necessarily anonymous. Declining optional analytics stops browser tracking. Research survey answers and follow-up contacts are stored separately and are never sent to analytics.

When you create a TurboKast account by signing in with Google or Twitch, we record how you first reached us: the campaign tags (utm_ parameters), referral code (ref) and TurboKast post identifier (post_id) in the link you followed, the page you landed on, and the domain of the website that sent you. If there were none, we record the visit as direct. Our pages carry these details in the links you click, not in cookies or browser storage, and our server holds them for up to one hour while you sign in. We save them to your account only when it is created, never when you sign in again. We also send them with your account's sign-up, first-destination and first-payment events to PostHog (EU). Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)): our interest in knowing which of our posts and campaigns bring people to TurboKast. This does not depend on your analytics choice. We keep these details for as long as your account exists, and delete them when you delete your account. You can object at any time by writing to [email protected], and we will clear these details from your account and stop sending them with your events.

Technical Data

Our servers automatically log IP addresses, browser type, and request timestamps for security and debugging purposes. These logs are kept for up to 7 days and then deleted.

§ 02

Google User Data

TurboKast uses YouTube API Services. By using TurboKast's YouTube features you agree to be bound by the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. You can revoke TurboKast's access to your Google data at any time at security.google.com/settings/security/permissions.

TurboKast's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use Google account data exclusively to:

Authenticate your identity and create your TurboKast account

Display your name and profile picture within the app

Create and manage YouTube live broadcasts on your behalf (when you grant streaming permissions)

Read and send messages in your YouTube live chat while you are streaming

Update the title, description, and category of your broadcasts when you change them in TurboKast

Upload clips to your YouTube channel when you explicitly choose to publish them

Google access and refresh tokens are encrypted at rest and are used only to perform the operations listed above. We never delete your YouTube videos. You can revoke TurboKast's access at any time from your Google Account permissions page, and deleting your TurboKast account deletes the tokens we hold.

We do not sell, rent, or share Google user data with third parties for advertising or any purpose unrelated to providing the TurboKast service.

Google API Services User Data Policy Google Privacy Policy

How Long We Keep YouTube Data

We refresh or delete the YouTube API data we hold within 30 days. That includes your channel name, handle and picture, broadcast and live chat identifiers, the stream address and key YouTube gives us for your broadcasts, titles we observed on YouTube, and live chat events and polls in your session history.

Viewer counts and chat message counts for your streams are YouTube statistics. We keep them only while your YouTube authorization is re-verified, which we do with Google at least every 30 days. If we learn that your authorization has ended, we delete these statistics within 24 hours.

If you disconnect YouTube from TurboKast, or delete your TurboKast account in Settings, we ask Google to revoke our access and we delete your YouTube data within 7 days, backups included. We remove it from our live systems within 24 hours, and our backups expire after 5 days. The one exception is data tied to a stream that is still live when you disconnect: we remove that within 24 hours after the stream ends.

You can also revoke TurboKast's access at any time in your Google Account permissions. We find out the next time we use your access, or at our next re-verification, and then delete your YouTube statistics within 24 hours and the rest of your YouTube data within 30 days of you revoking access.

Google Account Permissions

§ 03

Data Storage & Security

Encryption at Rest & In Transit

OAuth tokens and stream keys are encrypted at rest using AES-256-GCM. Stream keys are stored as SHA-256 digests — plaintext keys are never persisted. All connections use TLS (HTTPS) in transit.

Authorised TurboKast staff can view an account's usage, billing and payment summary to provide support and administer billing, and each time they open an account's summary page that access is logged.

Where your stream goes, and what we keep

Your stream passes through our servers so we can forward it to the destinations you have connected. Along the way we keep two things, both briefly: a short-lived copy of your live session, held so we can show you the preview in your browser, which expires after 24 hours and is then deleted automatically; and any clips — auto-clip is on by default and saves clips for you to review, and you can turn it off per stream from the Autoclip panel on your broadcast page. A clip you do not act on expires after 7 days, and the clip itself is then removed from your account on a rolling basis, and we ask our storage provider to delete the stored file at the same time; a clip you publish stays until you ask us to delete it. For each clip we also keep a separate decision record, with no video, audio, thumbnails or chat messages in it, as described in section 05. We do not keep a permanent archive of your broadcasts, we do not sell or licence your content, we do not publish it anywhere except to the channels you connect and ask us to publish to, and we do not use the clips, recordings, transcripts or chat of your stream to train our own models. The only thing we may train our own models on is the decision record described in section 05. If you use Enhance, we also keep the landscape recording Enhance renders from (the "source master"), your transcript, and each render for as long as the clip itself is kept. Our servers run in London, United Kingdom, and in Ashburn, United States. Clips and preview segments are stored in Cloudflare's Western Europe region and served through Cloudflare's network, which keeps short-lived cached copies near whoever is watching. Some of the companies that help us run the service are based outside the UK.

Zero Plaintext Keys

Stream keys never leave our system in readable form.

Recording for the content engine is not active yet. Nothing from your stream is recorded for it today.

§ 04

Data Sharing

We share information only in these limited circumstances:

Streaming platforms

Your stream data is forwarded to destinations you have connected (Twitch, YouTube, Kick, custom RTMP endpoints).

Payment processor

Stripe processes billing on our behalf and receives only the information required to complete transactions.

Infrastructure providers

Fly.io and Cloudflare host our services and may process requests in the course of providing infrastructure.

Enhance AI and compute services

If you use Enhance, the parts needed for your clip may be sent to outside processors. Anthropic (Claude) may receive sampled frames, transcript text and a Twitch chat excerpt to draft a hook, title or description and read an on-screen scoreboard. Its commercial API may process data in the United States, Europe, Asia or Australia and stores it in the United States unless otherwise agreed. Meta's Muse system may receive source footage to suggest candidate moments; its processing and storage locations have not yet been confirmed. TypeSafe's Jev may receive transcript and Twitch chat message text, detector type and confidence, no-gameplay likelihood, draft hooks and scoreboard text to check a draft against the available evidence; its processing and storage locations have not yet been confirmed. For Enhance captioning, a GPU or hosted speech-to-text provider is not yet selected, so Enhance captioning runs on our own servers. Outside AI processing remains disabled until the location and transfer safeguards for Anthropic, Meta and TypeSafe have been verified and this notice and the relevant terms are live. We will update this notice before enabling any later caption provider.

AI clip ranking

AI clip ranking is not active yet, and nothing from your stream is sent to these providers today. When we turn it on, TurboKast may send the parts of your stream needed to rank candidate clips to outside processors, unless the AI clip ranking switch for that stream is off. Anthropic (Claude) may receive transcript text, sampled frames, and Twitch chat statistics and emote categories, never message text, to judge and score candidate clips. Its commercial API may process data in the United States, Europe, Asia or Australia and stores it in the United States unless otherwise agreed. TypeSafe's Jev may receive transcript text and Twitch chat statistics to answer yes-or-no questions about a candidate clip; its processing and storage locations have not yet been confirmed. ElevenLabs may receive the audio of short windows around detected moments, including any other voices heard on your stream, to transcribe it; its processing and storage locations have not yet been confirmed. Twitch chat statistics are the message rate, the number of chatters and emote categories, and we send none for streams under 10 concurrent viewers. The AI clip ranking switch is in the Autoclip panel of your broadcast page and is on by default for each stream; with it off, nothing from that stream is sent to these providers and clips are chosen only on TurboKast's own servers. Outside AI processing remains disabled until the location and transfer safeguards for Anthropic, TypeSafe and ElevenLabs have been verified and this notice and the relevant terms are live. We will update this notice before any chat message text is sent.

Stream recording Not active yet

Recording for the content engine is not active yet. Nothing from your stream is recorded for it today.

Stream understanding Not active yet

Stream understanding is not active yet. Nothing from your stream is sent to an outside service for it today.

Audio generation Not active yet

Audio generation is not active yet. Nothing from your stream is sent to an outside service for it today.

Sign-up question classification

During setup we ask an optional question, "How did you hear about TurboKast?". Skipping it changes nothing. We store your answer with your account. To sort answers into a fixed list of sources (X, Bluesky, Threads, LinkedIn, YouTube, TikTok, search, an AI assistant, a friend, or other), we send the text of your answer, without your name, email or account details, to Anthropic (Claude), which processes it on our behalf. We keep the category it returns with your answer and nothing else from its reply. Anthropic's commercial API may process data in the United States, Europe, Asia or Australia and stores it in the United States unless otherwise agreed. We do not send any answer to Anthropic until the location and transfer safeguards for Anthropic have been verified. Until then your answer is stored but not classified.

Legal requirements

We may disclose information if required by law, regulation, or valid legal process.

We do not sell your personal information to any third party.

§ 05

Data Retention

We retain your account data for as long as your account is active. Streaming session metadata is retained for analytics and history purposes. If you delete your account, we remove your account and the data stored with it in our database within 7 days, backups included, except where retention is required by law.

If you use Enhance, the source recording, transcript and each render are kept for as long as the clip is kept. A render that has been replaced by a newer one, or that failed, is deleted 7 days later. A Twitch chat excerpt captured for a render is deleted at the same time as that render's other content.

For every clip that auto-clip saves, we also keep a record of the decision, separate from the clip. It holds what you decided about the clip, and the reason if you give one; the detection scores and chat statistics that produced it (counts and rates, never message text or who sent a message); when in the stream the clip falls and how long it is; the stream's title, category and your autoclip settings; any title or description you set; and any AI suggestion you accept. We keep this record for 180 days after your decision or, if you made no decision, for 180 days after the clip is removed, whether or not the clip itself has been removed by then. It contains no video, audio, thumbnails or chat messages, and it is deleted when you delete your account.

We may use the numeric detection scores, the clip's timing, your decision and reason, the stream's category and your autoclip settings in these records to train TurboKast's own clip-ranking models. The stream and clip titles and descriptions in a record are used only to evaluate those models, and never to train them.

Recording for the content engine is not active yet, so we keep nothing for it today.

Stream understanding is not active yet, so we derive and keep nothing for it today.

§ 06

Cookies

TurboKast uses a necessary session cookie for login and form security. If you allow analytics, configured providers may use cookies or browser storage. Research pages disable replay and automatic form capture; their optional analytics requires your permission.

Pages with a video load YouTube only when the visitor presses play.

§ 07

Your Rights

Revoke Access

You can revoke TurboKast's OAuth access at any time from your provider account:

Google Account Permissions Twitch Connections

Access Your Data

Contact us to request a copy of the personal data we hold about you.

Delete Your Data

Contact us to request deletion of your account and associated data.

Deleting content engine recordings is not active yet, because nothing is recorded for it today.

Opt Out of Analytics

Use the analytics choice on the site to decline optional browser analytics, or contact [email protected] for help. See the research privacy notice at /research/streamer-workflow/privacy for survey-specific processing.

§ 08

Children's Privacy

TurboKast is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us so we can delete it.

§ 09

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by posting the updated policy on this page with a revised "Last updated" date. Your continued use of TurboKast after changes are posted constitutes acceptance of the updated policy.

§ 10

People We Contact About Our Services

If we have contacted you at work to offer our services, or at the business address you publish as a creator, this section explains what we hold about you and why. The controller is TurboKast Ltd, a company registered in Scotland, company number SC881077, registered office 29 Commercial Street, Dundee, DD1 3DG, United Kingdom. Contact: [email protected].

What We Hold: Your name, job title, work email address and employer, the public source where we found each of them, and a record of our contact with you.
Where We Get It: Company websites, Companies House, public LinkedIn profiles, published articles that name you in your role, and Hunter.io, an email-lookup service.
Churches and Faith Organisations: We contact a church or other faith organisation only if it is a legal person, such as a SCIO, a CIO, a charitable company, a parochial church council or a corporation sole, and only at the contact address it publishes, preferring a role address such as office@. We find it on the OSCR and Charity Commission registers, its own website, and its public YouTube and Facebook pages. We hold its name, charity number and legal form, its published contact address, the public pages showing that it streams, and where and when we saw each of them. If you reply to us by name, or are introduced to us, we record only your role and contact details. We never infer or record anyone's religious beliefs. We send at most a first email and one follow-up. We do not use Hunter.io for churches or faith organisations.
Creators and Agencies: We contact creators and their representatives, including talent agencies, only at the business address they publish. We find it on YouTube About pages, Twitch panels, creators' own websites and link-in-bio pages, agency roster pages and Companies House. We hold the channel or brand name, the platform, the published business address, the page where we found it and the date we saw it, one public observation we mention in our message, the Companies House number where relevant, and the country. We do not contact anyone we know or suspect to be under 18. If you are an individual creator, we send at most a first email and one follow-up. We do not use Hunter.io for creators or agencies.
Why We Use It: Only to offer our services to the organisation you work for, or to your creator business.
Our Lawful Basis: Legitimate interests (UK GDPR Article 6(1)(f)): our interest in telling businesses and organisations about a service that is relevant to their work. We have weighed it against your interests and rights and concluded that they do not override it, because we contact you only in your work role at an organisation that is a legal person, or at a creator's published business address, use only your work or published business contact details, send at most a first email and two follow-ups, do not track opens or clicks, and stop as soon as you ask.
Who Else Sees It: It stays with us and the services that help us run this outreach: our email provider, Zoho Mail (EU data centre); the AI service we use to help draft messages, Anthropic; and Hunter.io, which verifies email addresses. We do not sell it.
How Long We Keep It: We delete it 12 months after our last contact with you, unless we start working together. If you object, we keep your email address and your organisation's email domain on a suppression list for as long as we need to, so that we never contact you again.

Your Right to Object

You can object at any time. For direct marketing this right is absolute (UK GDPR Article 21(3)): once you object, we stop contacting you. Reply "no" to any of our emails, or write to [email protected].

Your Other Rights

You can ask to see, correct, restrict or delete the details we hold about you. You can also complain to us, or to the Information Commissioner's Office (ico.org.uk).