# NovaCaster Privacy Policy

**Last updated:** June 29, 2026

NovaCaster (the "App") is a native iOS live-streaming application developed by
Roger Herklots. This privacy policy explains what data the App collects, how
that data is used, and which third-party services are involved.

## 1. Data collection

NovaCaster does **not** collect analytics, telemetry, or any personally
identifiable usage data. The App does not include crash reporting, ad SDKs, or
tracking pixels. No data leaves your device except the streams and donation
webhooks you explicitly configure.

The App stores the following data **locally on your device** so that the
streaming functionality works:

| Data | Where it lives | Purpose |
|------|----------------|---------|
| Twitch stream key | iOS Keychain | Authenticate RTMP push to Twitch |
| YouTube Live stream key | iOS Keychain | Authenticate RTMP push to YouTube |
| Custom RTMP URL + key (optional) | iOS Keychain | Authenticate RTMP push to a user-defined endpoint |
| Donation records (provider, username, amount, currency, message, timestamp) | Local SwiftData store | Show donation history inside the App |
| Overlay configuration (text, color, position, duration) | Local UserDefaults | Render lower-thirds / alerts / chat-box overlays |

All secrets are stored exclusively in the iOS Keychain. Donation records are
stored in an on-device SwiftData database and are never transmitted off-device.

## 2. Third-party services

When you enable a streaming destination or a donation provider, the App
exchanges data with the following third-party services. Their privacy
practices apply to any data you send them directly:

| Service | Used for | Privacy policy |
|---------|----------|----------------|
| Twitch (Amazon) | RTMP stream destination | https://www.twitch.tv/p/legal/privacy-notice/ |
| YouTube / Google | RTMP stream destination (YouTube Live) | https://policies.google.com/privacy |
| StreamLabs | Donation webhook source | https://streamlabs.com/privacy |
| StreamElements | Donation webhook source | https://streamelements.com/privacy |

**Important:** Stream keys and RTMP credentials are sent **only** to the
destination servers you select (Twitch, YouTube, or your custom endpoint).
Donation webhooks are received by a **local HTTP listener** that runs on
`http://localhost:8080` on your device while a stream is active; no donation
data is sent to NovaCaster or any other party.

To make the donation webhook reachable by StreamLabs / StreamElements, the App
includes an optional helper script (`scripts/start-tunnel.sh`) that exposes
the local listener via a Cloudflare quick-tunnel. The tunnel is operated by
Cloudflare and is subject to Cloudflare's privacy policy
(https://www.cloudflare.com/privacypolicy/).

## 3. In-app permissions

NovaCaster requests the following iOS permissions. The App does not request
any permission it does not need.

| Permission | Why it's needed |
|------------|-----------------|
| Camera | Capture the live video feed for your stream |
| Microphone | Capture the live audio feed for your stream |
| Photo Library (read & add) | Use photos as overlay artwork; optionally save stream recordings |
| Local Network | Receive donation webhooks from a local test tunnel; connect to local RTMP servers for development |

You can revoke any of these permissions at any time via iOS Settings →
NovaCaster. Revoking a permission disables the corresponding feature but does
not delete any data already stored locally.

## 4. Data retention & deletion

Because all App data lives on your device, removing NovaCaster from your
device (uninstall) deletes all locally stored data, including donation
history, overlay configuration, and Keychain entries. There is no remote
backup of any user data.

## 5. Children's privacy

NovaCaster is not directed at children under the age of 13 and we do not
knowingly collect any data from children. Stream keys and donation webhooks
are configured by the device owner.

## 6. Changes to this policy

We may update this privacy policy from time to time. Material changes will be
reflected in the "Last updated" date at the top of this document. Continued
use of the App after a change constitutes acceptance of the updated policy.

## 7. Contact

If you have questions, concerns, or requests regarding this privacy policy
or your data, please contact:

**Roger Herklots**
Email: **privacy@herklots.nl**

We aim to respond to all privacy-related enquiries within 30 days.

---

*This privacy policy is provided in English. Translations may be made
available in the future; in case of conflict, the English version prevails.*