Accoustium Studios emblem Accoustium Studios
Download Free

StreamSync — Privacy Policy

Last updated: July 21, 2026 · Applies to StreamSync Demo and StreamSync Pro (Windows, macOS, Linux)

StreamSync is a local-first desktop application. It does not have its own backend server, does not run analytics or telemetry, and does not sell, share, or transmit your data to Accoustium or any third party for marketing purposes. Almost everything StreamSync stores lives only on your computer. The only outbound network traffic StreamSync generates is:

Information We Collect and Store

Account credentials (OAuth tokens). When you connect a Streamer or Bot account for Twitch, YouTube, Kick, or Facebook, StreamSync obtains an OAuth access token (and, where issued, a refresh token) directly from that platform via the standard authorization-code + PKCE flow, using a temporary local web server (localhost) to receive the callback. These tokens are stored only in your operating system's native secure credential store (Windows Credential Manager, macOS Keychain, or the Linux Secret Service via libsecret), using the keytar library. Tokens are never written to a plain-text file, never transmitted to Accoustium, and never leave your device except when StreamSync uses them to call the relevant platform's own API on your behalf. If a refresh attempt fails, StreamSync deletes the stored token automatically.

TikTok is the one exception to the above. TikTok's OAuth implementation does not support redirecting back to a localhost address, so StreamSync cannot complete a TikTok connection entirely on your machine. Instead, when you connect a TikTok account, StreamSync opens TikTok's authorization page tagged with a randomly generated, single-use identifier (a nonce). TikTok redirects to a small callback endpoint we operate at accoustiumstudios.com, which exchanges the authorization code for an access token and holds it briefly — keyed only by that nonce, with no link to any Accoustium account, because none exists — in Cloudflare's key-value storage. StreamSync then retrieves the token using the same nonce, and our copy is deleted the instant it's picked up. If StreamSync never asks for it (for example, if you close the app mid-connection), the stored token is automatically deleted after 24 hours regardless. Once retrieved, the TikTok token is stored exactly like any other platform's: only in your OS's native secure credential store, never in a plain-text file. Outside that brief handoff — typically a few seconds, at most 24 hours — Accoustium does not retain, log, or otherwise use TikTok tokens.

Non-sensitive account metadata. Basic profile information — user ID, login/username, and display name for each connected account — is stored in a local JSON file in your OS's per-user application data directory. This never leaves your device except as part of the normal API calls to that platform.

Content you create inside the app. The following is stored only in local JSON files on your device, and never transmitted anywhere except where described elsewhere in this policy: bot commands, timers, counters, and event-response templates; the quote database; points/loyalty balances and gambling-game history; giveaway state (entrant usernames, winner history); overlay designs; trigger/action automation rules; global variables; app settings; and chat nicknames and recent chat history (stored in the app's local browser storage, capped at a fixed number of entries, clearable with /clear).

Live chat and stream-event data. To operate the chat bot and overlays, StreamSync processes, in memory and short-lived local storage, chat messages and stream events (follows, subscriptions, cheers, raids, redemptions) from the platforms you connect — including viewer user ID, login name, display name, message text, badges, and event amounts (bits, channel points, gift subs, Super Chats). This is used solely to run bot commands, display alerts, and drive automations you configure, and is not sent to Accoustium.

What we do not collect. StreamSync includes no analytics SDKs, crash reporters, or telemetry beacons. It does not track feature usage or fingerprint your device, and there is no "StreamSync account" to sign up for.

Where Your Data Goes: Third-Party Services

StreamSync only communicates with the following external services, and only when the relevant feature is in use:

StreamSync does not use any advertising, analytics, or data-broker services.

Local Network Communications

StreamSync runs services intended only for your own machine (or, for OBS, a private network device you explicitly configure):

Data Retention and Deletion

Because StreamSync stores data locally rather than in the cloud, you control retention directly: uninstalling the app or deleting its application-data folder removes all locally stored JSON data. Disconnecting a platform account deletes that account's OAuth tokens from your OS credential store. Chat history and nicknames can be cleared from within the app. Quotes, giveaway records, points balances, and trigger rules can be deleted individually from their management screens.

Children's Privacy

StreamSync is a professional/creator tool not directed at children. It is not intended for use by, and does not knowingly collect information from, individuals under the age of 13 (or the relevant minimum age in your jurisdiction).

Security

OAuth tokens are stored exclusively in OS-native secure credential storage. The local overlay server is bound to loopback only and never exposed to the public internet. The optional OBS/StreamHub integrations require a password and are off unless explicitly configured. We recommend keeping your operating system and StreamSync up to date.

Changes to This Policy

We may update this policy as StreamSync's features evolve. Material changes will be reflected in the "Last updated" date above.

Contact

Questions about this policy or StreamSync's data handling can be directed to accoustiumstudios@gmail.com.