Privacy Policy

1. Who we are

This policy covers the website at openstreamtools.com and the OST web app. For anything about your data, write to privacy@openstreamtools.com.

2. What we collect

Your account

You sign in with Twitch or Google. From the provider we receive your email address, display name and, for Twitch, your Twitch user id and avatar. We store these to identify you and to show your name to teammates. We do not receive or store your password.

Your projects

When you save a project we store the project document: the timeline, the crops, the caption style and text, the caption words, and a reference to each media file (a Twitch clip id, or the name of a file on your computer). The media itself (your video, audio and image files) is never copied to our servers. It stays on your device; the editor reads it directly from there.

Captions

When you ask for captions, your browser extracts the audio from the clip and sends only that audio to our transcription service. The resulting transcript is stored as part of your project. The audio is not kept after transcription.

Clip searches (the AI clip finder)

When you paste a Twitch stream recording (VOD) link, our servers fetch the audio of that recording from Twitch, transcribe it, and rank moments in it. We store the transcript, the ranked clips (times, titles, descriptions, hashtags) and the job's status so you can come back to it. Clip searches and their transcripts are kept for 30 days, then deleted automatically.

To frame each clip it finds, our servers also take a dozen small still frames of that clip from Twitch, work out where the picture holds still (where your camera is), and send three of the frames, at low resolution, to an AI model provider to say what's in them. The frames are not kept. When you search a video from your computer, your browser makes those frames itself and sends only the three small pictures. The video itself is never uploaded.

Teams

If you create a team or accept an invitation, we store the team, its members and who invited whom. Teammates can see each other's projects in that team and the name of who created each.

Connected social accounts

If you connect a TikTok, YouTube or Instagram account to post clips, we store the access token that platform gives us (encrypted), your username on that platform, and a record of what was posted and when. An account you connect belongs to the team you connected it for: everyone on that team can post to it and see what's scheduled. We use the token only to upload the video you chose to post, to the account you authorised. To post a clip, right away or at a time you pick, we keep a copy of that finished video until it has been posted, and delete it straight after (or when you cancel the post, and after 30 days at the latest); Instagram fetches it from us through a private, expiring link. Your source recordings are never uploaded. If you turn on analytics, we also read the view, like and follower counts for the clips you posted, to show you how they're doing; we never read your messages or anyone else's content. You can disconnect a platform at any time, which deletes the token and stops all of this.

Cached AI results

Transcripts and AI responses are cached for up to 90 days, keyed by a hash of their input, so the same request is not billed and computed twice. The cache holds the transcript or response, not who asked for it.

Website analytics

The marketing website (not the app) uses Google Analytics to count visits and see which pages are read. This sets cookies and sends your IP address and browser details to Google. The app itself has no analytics and no tracking cookies.

Technical logs

Our hosting provider records requests (IP address, URL, time, browser) in server logs for security and debugging. These are kept briefly and are not used to profile you.

3. Why we use it

• To run the product: sign you in, save and open your projects, run your clip searches, post the clips you tell us to post.
• To bill you for a paid plan. Payments are handled by Stripe; we never see your full card number.
• To keep it working: debug errors and prevent abuse.
• To answer you when you contact us.

Under the GDPR the legal bases are performance of our contract with you (running the product), our legitimate interest in keeping it secure and working, and your consent where we ask for it (connecting a social account, website analytics cookies). We do not use your data for advertising, and we do not sell it.

4. Who processes it for us

We use these providers to run OST. Each only receives what it needs for its job.

Provider	What for	What they receive
Cloudflare	Hosting, the API, transcription (Workers AI), job storage, framing found clips	Requests, clip-search jobs, audio for transcription, transcripts, still frames of found Twitch clips
Our database provider	Sign-in and the database	Your account, projects, teams
A speech-to-text provider	Transcribing clips for captions	The audio of the clip you caption, not your account details
Stripe	Payments and subscriptions for Editor+ and Pro	Your email, your team's plan, your payment details and billing address (entered with Stripe directly)
An AI model provider	Transcribing streams for clip searches, ranking moments, generating titles, detecting profanity, finding the camera in found clips	The audio of the stream you search, transcript text, and three small still frames per found clip; never your account details
Twitch	Sign-in and fetching your clips and recordings	Your Twitch identity; which clips/VODs you open
Google	Sign-in (optional); website analytics	Your Google identity if you sign in with it; website visits
TikTok, YouTube, Instagram	Posting and post analytics, only if you connect them	The video you post and its title/description/hashtags; we read back view and follower counts

Ask privacy@openstreamtools.com for the full list of providers by name. Some of these providers are in the United States. Where data leaves the EU it is covered by the provider's standard contractual clauses or the EU–US Data Privacy Framework.

5. How long we keep it

• Account, projects, teams: until you delete them or your account.
• Clip searches and their transcripts: 30 days.
• Cached AI results: 90 days from last use.
• Social account tokens: until you disconnect the platform or delete your account.
• A video you post or schedule: until it's posted or the post is cancelled, 30 days at most.
• The record of a post (text, time, where it went): until you delete your account.
• Billing records (invoices, payments): 7 years, as tax law requires, also after you delete your account.
• Server logs: a few days.

6. How we protect your data

We treat the access tokens of your connected accounts, your sign-in and everything you store with us as sensitive data, and protect it like this:

• Encrypted in transit. Every connection between your browser, our servers and our providers is encrypted with HTTPS. Nothing is sent unencrypted.
• Platform tokens encrypted at rest. The access and refresh tokens that TikTok, YouTube and Instagram give us are encrypted with AES-256-GCM, with a fresh random value per token, before they are stored. The encryption key is kept as a secret in our hosting provider's secret store, separate from the database, so a copy of the database alone cannot be used to read them.
• Tokens never reach the browser. Only our server can read the tokens, and only to post or read statistics for the account they belong to. The app in your browser, including your own session, has no access to them.
• Database access is restricted per user. The database is encrypted at rest by our provider. Row-level security rules make sure a signed-in user can only read their own data and that of teams they belong to. Billing and plan details can only be changed by our server.
• Every request is authenticated. Each call to our API carries a signed sign-in token that is checked on every request. Links that let Instagram fetch a video you are posting are signed and expire shortly after.
• Minimal data, short retention. We only ask platforms for the permissions needed to post and to show your statistics, and we keep data no longer than listed in section 5. Finished videos waiting to be posted are deleted once posted.
• Limited access on our side. Only the people who run OST can reach the production systems, through accounts protected with two-factor authentication. Secrets and keys are never stored in source code.
• Revoked when you disconnect. Disconnecting an account deletes its tokens from our database and, for YouTube and TikTok, also revokes them with the platform.
• Limits against abuse. Rate limits on every endpoint that costs money or posts somewhere stop automated misuse.

If we ever learn of a breach that affects your personal data, we will tell you and the relevant authority without undue delay, and within 72 hours where the GDPR requires it.

7. Google and YouTube data

If you connect a YouTube channel, OST asks Google for two permissions: to upload videos you choose to post (youtube.upload) and to read your channel's name, picture and video statistics (youtube.readonly). We use this data only to post your clips and to show you how they perform. We do not use it for advertising, do not sell it, do not share it with anyone except as needed to provide these features, and do not use it to train AI models.

OST's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. OST uses YouTube API Services; by connecting a channel you also agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. You can remove OST's access at any time by disconnecting the channel in OST, or from your Google account's third-party connections page.

8. Your rights

You can access, correct, export or delete your data. You can delete your account from the app; that removes your profile, your projects, your clip searches and any connected-platform tokens. Projects in a team you've left stay with the team. For anything you can't do in the app, email privacy@openstreamtools.com and we'll handle it within 30 days. If you're in the EU you can also complain to the data protection authority in your country.

9. Cookies and local storage

The app uses browser storage for your sign-in session and small conveniences (recently used settings, a list of the local files you've opened so they can be reopened after a reload). None of it is used for tracking. The marketing website sets Google Analytics cookies as described above.

10. Children

OST is not intended for anyone under 16, and we don't knowingly collect data from them.

11. Changes

If this policy changes in a way that matters, we'll say so on this page and, for significant changes, in the app. The date at the top is the date of the last change.