This policy explains what information StreamMesh (“we”, “us”) collects when you use streammesh.live and dashboard.streammesh.live (the “Service”), what we do with it, and the choices you have. StreamMesh plays videos you upload as a live stream to your account on the streaming platforms we support (the “Platforms”). Today these are YouTube and Instagram, and we expect to add more; when we do, this policy will be updated to cover them.
1. Information we collect
Account information
- Email and name that you give us when you sign up.
- Password, if you sign up with email. We never store it in readable form; only a salted one-way hash.
- Google account details, if you sign in with Google: your Google account ID, name, email address and profile picture. We do not receive your Google password. Signing in does not give us access to your Gmail, Drive, YouTube account or any other Google data.
- YouTube channel access, only if you choose “Connect with YouTube”. See “YouTube data” below.
Content you provide
- Videos you upload. We store each one as you uploaded it. The first time a video is used in a stream on a Platform, if that Platform needs a different format, we convert it once and keep the converted copy alongside the original.
- Stream keys you enter yourself: a YouTube stream key, or the stream URL and stream key that Instagram shows you for a live. See “Stream keys” below.
- Broadcast details you enter for a connected YouTube channel: the title, description, privacy setting and “made for kids” choice of your live stream.
Service and technical data
- The status of your streams: when they started, whether they are running, restart counts and error messages.
- Server logs with the IP address, browser type and pages or endpoints requested, which we use to keep the Service secure and working.
- Cookies and local storage: a session cookie that keeps you signed in, and a local setting that remembers your light/dark theme. We do not use advertising or third-party analytics cookies.
2. How we use your information
- To provide the Service: store your videos and send them as a live stream to the Platforms you choose.
- To create and secure your account, and to sign you in.
- To send you service emails, such as the link to verify your email address.
- To detect and prevent abuse, fraud and security problems, and to fix errors.
- To meet legal obligations.
We do not sell your personal information, and we do not use it for advertising.
3. Stream keys
A stream key you save is encrypted (AES-256-GCM) before it is stored in your account, and it is only decrypted when needed to connect your stream to its Platform.
To keep a stream running and to restart it automatically after a failure, the Platform’s destination address, which contains your key, is also passed to our streaming components. It is stored encrypted with that stream’s settings for as long as the stream exists, is only decrypted to connect the stream to the Platform, is never shown back to you in the dashboard, and is masked in our application logs. Treat your stream key like a password: if you think it has been exposed, reset it in YouTube Studio.
We do not connect to your Instagram account and never ask for your Instagram password. To go live on Instagram you paste the stream URL and stream key that Instagram shows you for one live. We store them encrypted, as described above, and delete them from your account when you stop that live, because Instagram does not accept them again. We do not read your Instagram profile, posts, followers, messages or insights.
4. Information from Google
Google sign-in
If you choose “Continue with Google”, we receive your name, email address, profile picture and a unique Google account ID. We use them only to create your account and sign you in. We do not use this data for advertising, we do not sell it, and we do not share it except with the service providers described below when needed to run the Service.
YouTube data
“Connect with YouTube” is optional. If you use it, Google asks you to allow StreamMesh to manage your YouTube account, and StreamMesh then uses YouTube API Services on your behalf. You can stream without it by entering a stream key instead.
With that permission, this is everything we do:
- Read your channel’s name and ID, to show you which channel is connected.
- Create a live broadcast on your channel each time you start a stream, with the title, description, privacy setting and “made for kids” choice you entered, and get the address and key that broadcast is sent to.
- Check and end that broadcast when you stop the stream, or remove it if it never went live.
We do not read, change or delete your other videos, playlists, comments, subscribers, messages, analytics or earnings, and we never act on your channel except to run a stream you started.
What we store from YouTube:
- Your channel name and channel ID.
- An access credential (an OAuth refresh token) that lets us do the things above without asking you each time. It is encrypted (AES-256-GCM) before it is stored and is only decrypted when a stream is started or stopped. We never see your Google password.
- While a stream is live, the IDs of its broadcast and the broadcast’s stream key, handled as described under “Stream keys” above. They are removed when the stream stops.
This data is stored on our DigitalOcean servers (see “Who we share information with” below). We do not transfer or disclose it to any other party.
We use YouTube data only to provide the streaming features you see in the Service. We do not sell it, use it for advertising, use it to train AI models, or let people read it, except with your permission, for security purposes, or where the law requires. StreamMesh’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting your channel. You can take away StreamMesh’s access to your YouTube channel at any time. On the Destinations page, choose Disconnect on the connected channel. We then withdraw all of our access to it at Google and delete the stored credential straight away. If a stream is live on that channel, stop it first. The channel’s name and ID stay in your account so that the streams you set up for it are kept; they cannot go live until you connect the channel again.
To delete the channel’s name and ID as well, choose Remove instead (after deleting any streams that use it). This also withdraws our access if the channel is still connected. You can also withdraw access yourself on Google’s security settings page; streams to that channel then can no longer be started until you connect it again.
Because the Service uses YouTube API Services, the YouTube Terms of Service and the Google Privacy Policy also apply to your use of YouTube through StreamMesh.
5. Who we share information with
We share information only with providers that help us run the Service:
- DigitalOcean, which hosts our servers. Your account data is stored on a server in its Bangalore, India data centre. A video that needs converting is processed on a temporary DigitalOcean server, which may be in another country and is deleted when the conversion ends.
- Amazon Web Services, which stores your uploaded videos. Our streaming server downloads a copy when your stream starts and deletes it when the stream stops.
- Resend, which delivers our emails (it receives your email address and the message content).
- Google, if you use Google sign-in or Connect with YouTube.
- YouTube: when you start a stream, your video is sent to YouTube using your stream key or the broadcast created on your connected channel, together with the broadcast details you entered. YouTube’s own terms and privacy policy apply to what it receives.
- Instagram (Meta): when you start a stream to Instagram, your video is sent to Instagram using the stream URL and key you pasted. The Instagram Terms of Use and Meta’s Privacy Policy apply to what it receives.
We may also disclose information if required by law, or to protect the rights, safety and security of our users and the Service.
6. How long we keep it
We keep your account information, videos, stream keys and connected channels while your account is open. An Instagram stream URL and key are kept only until the live they were issued for is stopped. The credential for a connected YouTube channel is deleted as soon as you disconnect or remove that channel. You can delete your uploaded videos (with their converted copies), saved stream keys and connected channels from the dashboard at any time. If you ask us to delete your account, we will delete your account data, uploaded videos, stored stream keys and YouTube credentials, except where we must keep something to meet a legal obligation. Server logs are kept for a limited time for security and troubleshooting.
7. Security
We use HTTPS for all traffic, store passwords only as salted hashes, encrypt saved stream keys and YouTube credentials, and restrict access to our servers. No system is perfectly secure, so we cannot guarantee absolute security.
8. Your choices and rights
You can ask us to access, correct or delete your personal information, or to delete your account, by emailing support@streammesh.live. Depending on where you live, you may have additional rights under local law, and we will honour them. You can disconnect a YouTube channel at any time, as described under “YouTube data” above. You can also clear cookies in your browser, though you will then be signed out.
9. Children
The Service is not directed to children under 18, and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.
10. Changes to this policy
We may update this policy from time to time. We will change the “Last updated” date above, and for significant changes we will take reasonable steps to let you know.
11. Contact us
Questions about this policy or your data? Email support@streammesh.live.