Privacy Policy

Last updated: 28 July 2026

This policy explains how stream.rossmackenzie.co.uk ("the Site") handles information. The Site is used to broadcast live services and events, and lets administrators manage and record those broadcasts.

Who this applies to

There are two kinds of people who use the Site:

• Viewers - anyone watching a live stream or recording through the embedded player or a public watch link. No account or sign-up is needed to watch.
• Administrators - a small number of people we authorise to manage channels, streams, and recordings via a password-protected dashboard.

Information we collect from viewers

When you watch a stream, our server automatically logs, for internal analytics only:

• Your IP address, used to estimate a general location (e.g. country/city) via an offline lookup database - your IP address is never sent to a third party for this purpose.
• Basic technical details such as when playback started and stopped, and roughly how many people are watching at once.

We do not require or collect names, email addresses, or any other personal account information from viewers. We do not use this data for advertising, and we do not sell or share it with third parties, other than as described under "Who we share information with" below.

Information we collect from administrators

• A username and password to access the management dashboard.
• If an administrator chooses to relay a stream to YouTube, we store the access credentials (OAuth tokens) that Google issues to us, along with basic channel details, so we can publish the stream on the administrator's behalf. These credentials are stored securely on our server and are never exposed to visitors' browsers.

Recordings

Administrators can optionally turn on recording for a channel. When enabled, the stream is recorded and stored in private cloud storage, accessible only to administrators for playback or download. Recordings are automatically deleted after the retention period the administrator has configured, or can be deleted manually at any time.

Who we share information with

• Google (YouTube Data API) - only when an administrator chooses to relay a stream to YouTube, so the stream can be published there.
• Cloudflare - our hosting/CDN provider, and (if recording is enabled) our storage provider for recorded video files.

We do not sell personal information to anyone.

How we use Google user data

When an administrator connects their YouTube channel, we request the https://www.googleapis.com/auth/youtube scope from their Google Account. Specifically, we use this access to:

• Create a live broadcast on the administrator's YouTube channel, and a live stream resource bound to it.
• Set that broadcast's title, description, and privacy status to match the channel's settings in our dashboard.
• Transition the broadcast between "ready", "live", and "complete" states in step with the administrator's own stream starting and stopping.

This is the only use we make of this access. We do not read, view, or otherwise access the administrator's existing videos, comments, subscribers, analytics, or any other data on their YouTube channel. We never transfer this data to any third party, and no human at our organisation reads or reviews it - it is used exclusively, automatically, by our server to perform the actions listed above.

The OAuth access and refresh tokens Google issues to us are stored encrypted on our own server, are never exposed to any browser (including the administrator's own), and are retained only until the administrator disconnects YouTube from a channel, at which point they are deleted. An administrator can also revoke this access at any time directly from their Google Account's third-party access settings, independently of our dashboard.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data retention

• Viewer analytics (approximate location, watch timestamps) are retained indefinitely for internal reporting unless an administrator deletes them.
• Recordings are retained for the period an administrator configures, then automatically deleted, or deleted sooner on request.
• OAuth credentials are retained until an administrator disconnects the YouTube integration.

Security

Access credentials and other secrets are stored only on our server and are never sent to or stored in visitors' browsers. The management dashboard is password-protected and restricted to authorised administrators.

Children's privacy

The Site is not directed at children, and we do not knowingly collect personal information from children beyond the anonymous viewing analytics described above.

Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with an updated "Last updated" date.

Contact us

If you have questions about this policy or how your information is handled, please contact us at info@rossmackenzie.co.uk.