StreamHub — Privacy Policy

StreamHub is a local-first desktop application for posting content to your own social media accounts. It has no backend server of its own, includes no analytics or telemetry, and does not sell, share, or otherwise transmit your data to Accoustium. The only outbound network traffic StreamHub generates is:

• Direct API calls from your computer to the social platforms you connect (Discord, and in the Pro edition, Facebook, Instagram, YouTube, X/Twitter, Threads, Bluesky, and TikTok), authenticated with your own accounts;
• A brief, one-time relay through a callback endpoint we operate at accoustiumstudios.com, used only to complete a TikTok connection, since TikTok's OAuth implementation does not support localhost redirects — see "Account credentials" below;
• Content you choose to publish (text, images, videos, links) being sent to those platforms at your explicit request; and
• An optional, off-by-default local connection to StreamSync, used only to relay posts that your own automations request.

Information We Collect and Store

Account credentials. StreamHub authenticates to each platform using that platform's own login flow. Facebook, Instagram, YouTube, X/Twitter, and Threads use standard OAuth 2.0 (authorization code + PKCE) via a temporary local web server that receives the callback. Bluesky uses an app password you generate in your Bluesky account settings (not your main account password), exchanged for session tokens via the AT Protocol. Discord requires no login at all — you paste a channel Incoming Webhook URL that you create yourself in Discord's server settings, which itself functions as the posting credential.

All OAuth/session tokens are stored only in your operating system's native secure credential store (Windows Credential Manager, macOS Keychain, or the Linux Secret Service via libsecret) using the keytar library — never in plain text, never sent to Accoustium. Discord webhook URLs are stored locally in a JSON file, since a webhook URL functions as a bearer credential rather than an OS-keychain-style token; you can delete or regenerate webhooks at any time from Discord.

TikTok is the one exception to the above. TikTok's OAuth implementation does not support redirecting back to a localhost address, so StreamHub cannot complete a TikTok connection entirely on your machine the way it does for the platforms above. Instead, when you connect a TikTok account, StreamHub opens TikTok's authorization page tagged with a randomly generated, single-use identifier (a nonce). TikTok redirects to a small callback endpoint we operate at accoustiumstudios.com, which exchanges the authorization code for an access token and holds it briefly — keyed only by that nonce, with no link to any Accoustium account, because none exists — in Cloudflare's key-value storage. StreamHub then retrieves the token using the same nonce, and our copy is deleted the instant it's picked up. If StreamHub never asks for it (for example, if you close the app mid-connection), the stored token is automatically deleted after 24 hours regardless. Once retrieved, the TikTok token is stored exactly like any other platform's: only in your OS's native secure credential store, never in a plain-text file. Outside that brief handoff — typically a few seconds, at most 24 hours — Accoustium does not retain, log, or otherwise use TikTok tokens.

Non-sensitive account metadata. Basic profile/page metadata needed to show what you're connected to — Page name/ID, channel display name, Instagram/X/Threads username, Bluesky handle — is stored in local JSON files in your OS's per-user application data directory.

Content you create and post. Stored only in a local JSON post-history file on your device: the text/message content of posts you send, the destination platform and target, and image URLs, attachment file names, and send status. Actual media files are read from your local disk at send time and transmitted directly to the destination platform's API — StreamHub does not maintain its own copy or cloud storage of your media.

Local integration settings. If you enable the StreamSync bridge, StreamHub stores locally the port it listens on, a connection password, and whether the integration should auto-start.

What we do not collect. StreamHub includes no analytics SDKs, crash reporters, or telemetry beacons. It does not track feature usage or fingerprint your device. There is no "StreamHub account" — no data is collected by or stored on any server operated by Accoustium.

Where Your Data Goes: Third-Party Services

StreamHub only communicates with the following external services, and only when the relevant feature is used:

• Discord — posting messages/images/files to a channel via a webhook you provide. Always available (core feature, both editions).
• Facebook (Meta) — OAuth login, Page posting (text, hosted image, direct photo/video upload). Pro edition, if connected.
• Instagram (Meta) — OAuth login, photo/Reels publishing via a public media URL. Pro edition, if connected.
• YouTube (Google) — OAuth login, resumable video upload. Pro edition, if connected.
• X / Twitter — OAuth login, tweet posting with optional media. Pro edition, only if the app operator has configured X credentials and you connect an account.
• Threads (Meta) — OAuth login, text/media container-based publishing. Pro edition, if connected.
• Bluesky — session login, posting text/images. Pro edition, if connected.
• TikTok — OAuth login (via the relay callback described above), video publishing. Pro edition, if connected.

StreamHub does not use any advertising, analytics, or data-broker services.

Local Network Communications

StreamHub can run one local network service, off by default: the StreamSync bridge — a password-authenticated WebSocket server bound to 127.0.0.1 (localhost) only, on a port you choose (default 5680). It is never reachable from outside your machine and does nothing until you start it. When active, it lets a locally-running copy of StreamSync retrieve a list of your connected posting destinations by name/label only (never credentials) and request that StreamHub send a specific post on its behalf. StreamHub never transmits your platform credentials to StreamSync.

Data Retention and Deletion

Because StreamHub stores data locally rather than in the cloud, you control retention directly: uninstalling the app or deleting its application-data folder removes all locally stored JSON data. Disconnecting a platform account deletes its stored tokens from your OS credential store. Post history entries can be deleted individually. Discord webhooks can be deleted from within the app (revoke/regenerate them from Discord's own settings to fully disable). Regenerating the StreamSync bridge password immediately invalidates any previously connected client's access.

Children's Privacy

StreamHub is a professional/creator tool not directed at children. It is not intended for use by, and does not knowingly collect information from, individuals under the age of 13 (or the relevant minimum age in your jurisdiction).

Security

All OAuth/session tokens are stored exclusively in OS-native secure credential storage. Discord webhook URLs and the StreamSync bridge password are stored locally; treat your device's user account access as the security boundary for these. The StreamSync bridge server is bound to loopback only and requires password authentication for every connection. We recommend keeping your operating system and StreamHub up to date, and revoking or regenerating a Discord webhook or bridge password immediately if you believe it has been exposed.

Changes to This Policy

We may update this policy as StreamHub's features evolve. Material changes will be reflected in the "Last updated" date above.

Contact

Questions about this policy or StreamHub's data handling can be directed to accoustiumstudios@gmail.com.