Privacy Policy

This policy explains what data the BenchStream mobile app and website handle, why we process it, and what rights you have.

BenchStream does not operate an application server that receives your video or stores copies of your streams. The sections below explain how the app and website process other data.

The Android app has Pro purchasing enabled, so the RevenueCat processing described in section 7 applies to it. iOS billing and RevenueCat integration exist in draft source, and the App Store download is coming soon. The iOS source uses StoreKit 2 and RevenueCat for Apple purchase and entitlement state, with a pseudonymous billing support ID independent of Google/YouTube identity and local billing caches. Production billing configuration is still blank; real purchases, SDK network behavior, retention, and final App Privacy and legal disclosures remain release gates. The detailed contact triggers and reporting below describe Android, not a verified shipping iOS billing flow.

1. Who we are

BenchStream is operated by Kristian Jones, trading as BenchStream, a sole trader established in England. For UK GDPR purposes, Kristian Jones, trading as BenchStream is the controller for personal data processed by BenchStream.

This data includes your Google sign-in identity, YouTube channel and broadcast data, local app data, support correspondence, and, for installations that contact RevenueCat, the RevenueCat app-user ID, entitlement result, and Pro subscription data. The sections below explain each category.

Most of this data never leaves your device. We explain exactly what does, and where it goes, in the sections below.

Contact: support@bench-stream.com.
Postal correspondence address: BenchStream, Unit 168641, PO Box 7169, Poole, BH15 9EL, United Kingdom.

2. The short version

• BenchStream sends your video directly from your phone to YouTube (or to a streaming destination you configure yourself). It does not pass through any server we operate.
• To use BenchStream with YouTube you sign in with your Google account so the app can manage YouTube broadcasts on your behalf. We request a single YouTube read/write permission, plus basic Google identity permissions, needed for the app features.
• Your Google sign-in tokens are stored encrypted on your device. Access tokens are sent to Google's servers with authenticated YouTube API requests, and refresh tokens are sent to Google when renewing your session. BenchStream does not receive or store these tokens on an application server it operates.
• The Android app does not include an advertising, behavioural-analytics, or crash-reporting SDK. The Android package includes RevenueCat, which the app configures when you reach a screen showing subscription prices. Section 7 describes that processing and when it begins.
• BenchStream creates no BenchStream account. Your store subscription is independent of the Google/YouTube account, channel, or Brand Account connected for streaming.
• On Android, Google Play processes a Pro payment; we never see your card details. RevenueCat checks Android entitlement status and verifies purchases without receiving your video, audio, or Google/YouTube identity. See section 7.
• The website uses Cloudflare Web Analytics for aggregated traffic metrics. It does not use cookies, does not fingerprint your device, and does not track you across other websites. Our website host may also process basic request logs for hosting and security.
• You can remove BenchStream's local app data and revoke its access to your Google account at myaccount.google.com/permissions. Broadcasts you created stay on your YouTube channel until you remove them there. See section 10 and our Delete your data page.

3. Data we access via Google APIs

BenchStream uses YouTube API Services to create and manage broadcasts on your channel.

When you sign in with Google, BenchStream requests these OAuth scopes on both Android and iOS. Both apps use the same Google Cloud project and OAuth client, and sign in through Google's browser-based OAuth flow (AppAuth with PKCE) so that YouTube Brand Accounts can be selected:

• openid, email, profile: your email address, display name, and basic profile so we can show you who is signed in.
• youtube.force-ssl: read your YouTube channel and live broadcast information, create and configure live broadcasts and live streams, bind a stream to a broadcast, transition broadcasts between testing/live/ended states, and update broadcast metadata you set in the app.

The app handles two groups of Google data:

• Identity data: your email address, display name, and basic profile information from Google.
• YouTube data: your channel ID, channel handle, channel avatar URL, the list of your scheduled and live broadcasts, live stream/broadcast IDs needed to start the stream, and the lifecycle state of those broadcasts (testing, live, ended).

We use this data only to let you choose a broadcast, bind your stream to it, and manage its lifecycle (start, stop, transition). The app handles this data on your device and does not send it to a BenchStream application server.

If you subscribe to Pro on Android, the app also handles purchase data issued by Google Play Billing, including a purchase token and the resulting entitlement. This is separate from the OAuth scopes above and is not YouTube data. Section 7 provides more detail. Google/YouTube identity, channel IDs, and Brand Accounts are never used as subscription identity.

4. Limited Use of Google user data

BenchStream's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use access to YouTube user data to provide and improve the user-facing features of BenchStream (listing, creating, binding, configuring, and transitioning live broadcasts on the authenticated user's own YouTube channel).
• We do not transfer the data to others unless doing so is necessary to provide or improve user-facing features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users.
• We do not use the data for advertising, including retargeting, personalised, or interest-based advertising.
• We do not allow humans to read Google user data unless you have given affirmative agreement for specific data, access is necessary for security purposes such as investigating abuse, access is necessary to comply with applicable law, or the data is aggregated and used for internal operations in accordance with privacy law.

BenchStream does not transmit Google user data to an application server we operate, so our staff do not have routine access to it. We can access information that you choose to send us, such as logs or screenshots attached to a support email. We use that information only for support, security, legal compliance, or service maintenance.

The purchase-verification service described in section 7 does not receive Google user data covered by these scopes. It receives entitlement, store, and limited technical context, but not your YouTube channel, broadcasts, or Google profile.

5. Your video and audio

While you are streaming, video frames from your camera and audio from your microphone are encoded on your device and sent directly to YouTube's ingest servers or to a manual RTMP, HLS, or SRT destination available in your app version. BenchStream does not operate a server that receives, transcodes, records, or rebroadcasts your stream content.

We do not see your video or audio. We do not store copies. We have no ability to play back a stream after it has been sent.

6. Data stored on your device

The following items are stored locally on your phone and do not leave it except as described elsewhere in this policy:

• OAuth tokens (your Google access and refresh tokens). On Android these are stored using platform-provided encrypted storage backed by keys from the Android Keystore. On iOS they are stored in the iOS Keychain, restricted to this device.
• Manual destination credentials (any RTMP, HLS, or SRT URLs, stream keys, passphrases, and authentication headers you enter for protocols available in your app version). On Android, these credentials use encrypted storage backed by the Android Keystore. On iOS, saved manual destination records use device-only Keychain storage in draft source, including URL-embedded secrets. Separate Settings prefills now use a single Keychain record in draft source for URLs, stream IDs, keys, headers and passphrases. Legacy preferences are removed only after a successful secure write; failed migration retains them, and unavailable secure reads block saving until reloaded. This addresses the documented prefill gap in unreleased source, not a guarantee that every installation has migrated or all storage is secure. Physical-device migration and locked-device behavior remain release gates; section 10 distinguishes the verified isolated restart from remaining deletion checks. Do not share device backups, stream keys, or destination credentials.
• App preferences: microphone settings, default bitrate and resolution, scoreboard preset and team logos you have imported, custom thumbnails you have selected.
• Cached entitlement status (Android): whether Pro is currently active. Once the app has contacted RevenueCat, it also caches the pseudonymous identifier used to check it. Before that first contact, the app holds only a local entitlement state and no RevenueCat identifier exists. See section 7.

None of this is sent to any BenchStream server, because we do not operate one. The subscription check described in section 7 goes to RevenueCat, not to us.

7. Android subscriptions and purchase data

When the Android app contacts RevenueCat. The app contacts RevenueCat the first time you choose to open a billing surface that shows subscription prices or plan terms, such as the Pro paywall or plan comparison. It creates an identifier for that installation at the same moment. If the installation has previously transacted with the store, the app also re-checks the entitlement when it starts and, subject to a short throttle, when it returns to the setup screen. This includes checks after a subscription has lapsed, been refunded, or been cancelled. Merely starting a broadcast does not contact RevenueCat. Ending a broadcast can return you to setup, where a check may run; no check runs during the active stream. It does not contact RevenueCat when you install the app, on first launch, or during onboarding, and locking or unlocking Pro features on screen never contacts it.

This can include operators who never subscribe. Opening the paywall or plan comparison requests Google Play's current offers through RevenueCat, even if you decide not to buy. Merely starting a broadcast does not contact RevenueCat. There is no separate consent step before the billing surface loads; you choose whether to open that surface.

That identifier is a pseudonymous RevenueCat app-user ID generated by the SDK for the installation. We call it pseudonymous rather than anonymous because RevenueCat can link it to an entitlement, a store transaction, and the technical context of the request, so it remains personal data and your rights in section 14 apply to it. We do not set it to a hardware identifier, advertising ID, Google account, email address, YouTube channel, or Brand Account. The app does not give RevenueCat your Google/YouTube identity. After a reinstall or restore, RevenueCat may associate the store entitlement with a current app-user ID. The purchase remains tied to the store account that made it.

The originating store processes the payment. Google processes Google Play Pro transactions. Apple billing exists in unreleased iOS draft source; App Store purchases are not publicly available yet. The store charges you, handles applicable taxes under its arrangements, provides its refund process, and keeps your payment details. We never see your card number, billing address, or other payment details.

RevenueCat verifies the purchase. The app checks store purchase evidence with RevenueCat, which validates it against the originating store and returns an entitlement: whether Pro is active for that platform. Store lifecycle updates keep this status current when a subscription renews, is cancelled, enters grace or billing retry, lapses, or is refunded.

The data involved is:

• Store purchase evidence: the purchase token or receipt issued for your subscription.
• Entitlement status: whether Pro is active, in a grace period, cancelled, or expired, and the dates attached to that.
• A pseudonymous RevenueCat app-user ID: an identifier generated when the app first contacts RevenueCat, which RevenueCat uses to attach an entitlement to that installation. It identifies the installation rather than naming you, and a fresh one is generated if you reinstall the app.
• Basic subscription details from the store: which plan you chose (monthly or annual), product identifier, originating store, store country, and whether the transaction is in a test or production environment.
• App, device and request context needed to operate the SDK: this may include the BenchStream app version, operating system, device model or type, locale, IP address, request time, and when the app was last seen by the service. We list this as what RevenueCat may process rather than as a closed set, because the request contents are determined by the SDK and the network rather than by data we choose to send. We do not supply a hardware identifier or advertising ID, and we do not use any of it for behavioural tracking.

RevenueCat does not receive your video or audio. It is not used to record which features you open, how long you stream, or what you stream. Its limited last-seen time records when the SDK contacted the service, not your in-app activity.

RevenueCat processes this data on our behalf and under our instructions as our processor. Its servers are in the United States, as explained in section 15. See the RevenueCat Privacy Policy.

RevenueCat uses suppliers for services such as cloud hosting, databases, and monitoring. These sub-processors are bound by RevenueCat’s obligations to us. The current list is published in Annex 3 of the RevenueCat Data Processing Addendum. They process entitlement, purchase, and limited technical context, but not your video, audio, or Google/YouTube identity.

We minimise subscription data by keeping Google/YouTube identity out of the billing flow and by relying on stores for payment details. Access is limited to operating subscriptions, support, accounting, security, and legal obligations, and processors are contractually required to protect the data they handle for us.

8. Analytics, crash reporting, advertising

The Android app contains no advertising SDK, crash-reporting SDK, or behavioural or usage-analytics SDK. It does not collect a hardware identifier or advertising ID, build a behavioural profile, or track you across other apps or websites. We cannot see which features you use, how often you stream, or what you stream.

The Android package contains the RevenueCat SDK described in section 7. An installation that has contacted RevenueCat has a pseudonymous app-user ID, entitlement result, request and device context, and SDK last-seen time. Purchase evidence is sent only when needed to verify or restore a purchase. RevenueCat does not receive which features you open, how often or how long you stream, what you stream, or your Google/YouTube identity.

RevenueCat provides Android subscription reporting, including active subscriptions, renewals, and cancellations. This reporting concerns purchases and subscription status, not feature usage or streaming activity. The final iOS dependency and data-flow audit, including Apple App Privacy disclosures, remains a pre-release requirement; these Android statements are not verification of the iOS release binary.

The website uses Cloudflare Web Analytics to measure aggregated traffic, such as pages visited, approximate country, browser, and device type. Cloudflare Web Analytics does not use cookies, fingerprint your device, or track you across other websites. Cloudflare may process IP addresses and request metadata separately to host and secure the website, as explained below. Cloudflare's processing is governed by its Privacy Policy.

The website is hosted on Cloudflare Pages. Cloudflare may also process basic request metadata such as your IP address, browser user agent, requested URL, timestamp, and security signals to deliver the site and protect it from abuse. We do not use Cloudflare Zaraz, Turnstile, or other Cloudflare tracking features on this site.

When you open the Android app it fetches one small file from this website, /legal/versions.json, to learn whether these documents have changed since you agreed to them, so it can show you a notice and ask again where a change needs your agreement. That request carries no account, device or advertising identifier and the app sends nothing else; Cloudflare handles it as an ordinary website request, with the request metadata described above.

If you have not saved a currency preference, your browser requests Cloudflare's country signal so the website can select an indicative regional currency. Cloudflare derives a two-letter country code from the request's IP address. BenchStream uses the code in your browser, does not receive or store it, and does not save the automatic selection.

If you choose a price currency on the website, we save that currency code in your browser's local storage so the same choice appears on the next page you visit. It stays on your device and is not used for tracking.

If we add opt-in crash reporting in a future release (for example to help us fix bugs that affect many users), we will update this policy, add a setting in the app to enable or disable it, and default it to off until you opt in.

9. Permissions the app requests

• Camera: to capture the live video you are broadcasting.
• Microphone: to capture the live audio you are broadcasting.
• Photos (when you select a custom thumbnail or team logo): a one-shot picker; we do not browse your photo library.
• Bluetooth (Android only, when you choose to use a Bluetooth audio device): to enumerate and connect to your paired microphone or headset.
• Foreground service (Android): supports continuing a broadcast while you switch apps or turn off the screen. The iOS app declares background audio mode, but this does not establish uninterrupted background camera capture or streaming on iOS. Keep BenchStream in the foreground with the screen on during iOS testing.
• Network state: to detect whether you are on Wi-Fi or cellular so the encoder can adapt.

10. Retention and deletion

A step-by-step version of everything in this section, written for people who just want to remove their data, is on our Delete your data page.

Local app data, Google/YouTube records, support correspondence, and subscription records have different deletion routes. The numbered removal instructions below describe Android. The unreleased iOS draft now provides separate confirmed Google disconnect and local-erasure controls in Profile. Disconnect clears credentials only after Google confirms revocation; failed requests retain credentials for retry, and local cleanup failures are reported separately. The confirmation explains that revocation can affect other clients in the same Google OAuth project and can take time to propagate. Local sign-out alone is not server revocation. Do not assume signing out or uninstalling erases all iOS data.

The iOS draft's local reset is scheduled by explicit confirmation, can be cancelled before restarting, and runs on a fresh launch before repositories and SDKs start. Its declared scope covers app documents, imported images, support files, caches, cookies, preferences, temporary files and scoped current/legacy Keychain services, including local RevenueCat security data. Partial failures retain a retry marker and block normal entry rather than claim success. System permissions, Safari sessions, remote data and backups are outside this scope. Local erasure does not revoke Google, delete remote videos or store purchase ownership, or cancel subscriptions. An isolated simulator restart check has passed; physical locked-device/interruption behavior, real purchase restoration and owner/legal scope approval still need verification. Tests did not erase real user data or revoke real Google access. SDK privacy review remains a release requirement, not an approved disclosure. These are draft controls, not publicly released iOS instructions.

1. From the app's account settings, sign out. This clears your OAuth tokens from the app.
2. Revoke BenchStream's access to your YouTube account at myaccount.google.com/permissions, or through your Google security settings.
3. Uninstall the app, or clear its data in your phone's app settings, to remove saved preferences, cached profile information, and anything else that remains locally.

Broadcasts you have created on your YouTube channel are yours and remain on your YouTube account; deleting them is done through YouTube Studio.

RevenueCat retains an app-user and entitlement record for installations that contact it for as long as needed to provide the entitlement check, subject to applicable deletion rights. If you subscribe to Pro, the originating store and RevenueCat also hold transaction and subscription lifecycle records.

Signing out, disconnecting or revoking YouTube, changing channels or Brand Accounts, clearing app data, or uninstalling affects local or OAuth data only. None of these actions cancels store billing or erases the transaction record. Cancel through the originating store.

Google retains its purchase record under its legal and operational obligations. For future purchases billed by Apple, Apple's own privacy policy will govern its purchase records; the iOS draft integration is not a verified public purchase flow. RevenueCat retains records for as long as needed to provide entitlements and meet applicable accounting, security, dispute, and legal obligations. If you ask us to delete a RevenueCat record, we will act on the request where the law allows. We cannot delete the store's transaction record on your behalf.

If you email us for support, we retain that correspondence and any attachments for up to 12 months after the request is resolved, unless we need to keep it longer for security, legal, accounting, or dispute-resolution reasons.

11. Your rights under UK and EU data protection law

If you are in the UK, the EEA, or somewhere with similar rights, you can ask us to:

• Confirm what personal data we hold about you and provide a copy (right of access).
• Correct inaccurate information (right to rectification).
• Delete personal data we hold (right to erasure).
• Restrict or object to certain processing.
• Receive your data in a portable format (right to data portability).
• Not be subject to a decision based solely on automated processing, including profiling, where that right applies. BenchStream does not currently make these decisions.

The deletion steps in section 10 address most requests about local app or Google/YouTube data. RevenueCat holds a pseudonymous entitlement record for installations that contact it, and store and subscription records also exist if you bought Pro. Send a rights request about data held through RevenueCat to support@bench-stream.com. We aim to respond within one month, as required by UK GDPR. Requests to Apple or Google about records they control must be made through their privacy processes.

You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk/concerns, or to your local supervisory authority in the EEA.

12. Legal basis for processing

• Performance of a contract: to process Google identity data, YouTube channel/broadcast data, local app preferences, and stream-destination settings needed to provide the app features you request. This also covers the Free/Pro entitlement check, purchase verification, and subscription data needed to provide the available app tier.
• Legitimate interests: for security, abuse prevention, responding to your support requests, maintaining correspondence records, operating reliable website hosting, and selecting an indicative regional price, where this does not override your rights.
• Legal obligation: to keep records of subscription transactions for as long as UK tax and accounting law requires.
• Consent: for any optional feature that requires it, such as opt-in crash reporting we may add in a future release.

13. Children

BenchStream is intended for users aged 18 or over and is not directed at children. If you believe a child has provided personal data through BenchStream, contact us and we will delete it where required.

14. Third parties

We rely on the following third parties to provide BenchStream. Their handling of your data is governed by their own privacy policies:

• Google: for sign-in (OAuth) and for the YouTube Data API. See Google's Privacy Policy.
• YouTube: as the destination for your broadcasts, governed by the YouTube Terms of Service.
• Cloudflare: for website hosting, content delivery, security logging, Cloudflare Web Analytics, and the country signal used to select an indicative regional currency. See Cloudflare's Privacy Policy.
• Google Play: for Android distribution and Pro payments and transaction records. Apple: the planned iOS distribution and payment platform; App Store download and purchasing are not publicly available yet. The planned subscriptions are separate, and we do not receive payment-card details.
• RevenueCat (Android): for entitlement checks and Pro purchase verification. It processes the data listed in section 7 and acts as our processor. Its servers are in the United States. RevenueCat does not receive your video, audio, or Google/YouTube identity. See the RevenueCat Privacy Policy and Annex 3 of the RevenueCat Data Processing Addendum.
• Our email provider: for support, legal, and privacy correspondence you send us.
• Any third-party streaming destination you configure manually (RTMP, HLS, or SRT, where available in your app version) is operated by whoever provides it and is outside our control.

We do not sell, share, or transfer your personal data to third parties for advertising purposes.

15. International transfers

When you sign in with Google or stream to YouTube, your data is transferred to Google's infrastructure, which may process it outside the UK or EEA. When you load our website, Cloudflare may process request metadata through its global network. Support email, app-store services, and manual streaming destinations may also involve processing outside the UK or EEA.

The app-user and entitlement data described in section 7 is processed on servers in the United States for installations that contact the service. If you subscribe, this also includes purchase and subscription lifecycle data. The transfer does not include video, audio, or Google/YouTube identity.

Where international transfers require safeguards, we rely on the relevant provider's transfer mechanisms, such as adequacy regulations, the UK International Data Transfer Agreement, or the UK addendum to the EU Standard Contractual Clauses. For the transfer to RevenueCat specifically, the safeguard is the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which forms part of our data processing agreement with them.

16. Changes to this policy

If we make material changes to this policy, we will update the "Last updated" date. The Android app checks for legal updates when opened and can show a notice when that check succeeds. The iOS legal-update notice and consent flow exists in draft source with local versioned receipts and cached documents; approved content and material-change behavior must be verified before release. Publishing this website alone does not deliver an iOS in-app notice. Where practical, we will give at least 30 days' notice before material changes take effect. If a change needs your consent, such as a new optional telemetry feature or a new use of Google user data, we will ask for that consent separately.

17. Contact

For privacy questions, rights requests, or anything else, email support@bench-stream.com.