Privacy Policy

What we collect

Account information. When you create a Konduit account in the app, we collect your email address, a display name, and a password. If you use Continue with Google instead, Google shares your name, email address, and profile picture with us, and we use your name as your display name. Your account is stored with our authentication and database provider, Supabase.

Billing information. Subscriptions are processed by Stripe. Your card number never touches our servers — Stripe handles payment directly. When you start checkout, we give Stripe your email address and your Konduit account ID. We store your subscription status (for example trial, active, past due, or cancelled), when your current billing period ends, whether your subscription is set to cancel, and your Stripe customer and subscription IDs, so the app knows which features to unlock.

Feedback and bug reports. When you send feedback or a bug report from the app, we receive your message, your account email (so we can reply), any reply-to address you type, your app version, and basic details about your computer, such as its operating system and processor type. Bug reports also include error and warning counts, how long you'd been streaming, and, after a crash, technical details about what the app was doing. These reach us by email through Resend and, if crash reporting is on, through Sentry. Your full log files stay on your computer unless you choose to send them to us.

Crash and error reports. When the Konduit app runs into an error, it sends a diagnostic report to Sentry, our error-monitoring provider. This is on by default, and you can turn it off in Settings → Privacy. Reports include technical details such as your app version, operating system, and recent lines from the app's activity log, which can mention things like a viewer's name. Before a report is sent, the app removes email addresses, sign-in tokens, API keys, payment IDs, and your computer's user name from it. Your account is represented by a one-way hash of your email, never the email itself. If the app crashes, the next launch also sends the crash dump your computer saved. A crash dump is a snapshot of part of the app's memory at the moment of the crash, so it can contain bits of whatever the app was working with; we use it only to find and fix the crash. The app also sends Sentry a small sample of performance measurements.

Website analytics. konduit.gg uses Vercel Web Analytics to count page visits and a few button clicks (such as "start free trial" and "download"), and Vercel Speed Insights to measure how fast pages load. Web Analytics doesn't use cookies. If a page on konduit.gg hits an error, Sentry receives an error report. Sentry also records a sample of visits as session replays — about 1 in 10, plus visits where an error happens — to help us find bugs. Replays hide all text and form inputs and block images and video, so they show the page layout and where you clicked, not what you read or typed. No advertising trackers, no cross-site tracking.

What passes through our servers

Some features need our server, which runs on Railway, and our database, which runs on Supabase. This is what goes through them.

• Platform sign-ins. When you connect Twitch, YouTube, or Kick, the sign-in goes through our server. It swaps the platform's one-time code for your access tokens and hands them to your app through a single-use code that expires within 60 seconds. When your tokens need renewing, or when the app asks a platform to cancel them, that request passes through our server the same way. We don't store these tokens on our servers. If you set up YouTube with your own Google Cloud client in the app's advanced settings, that sign-in goes straight to Google instead.
• Kick chat and events. Kick sends your channel's events to our server rather than straight to your app. These include chat messages, follows, subscriptions and gifted subs, Kicks, channel reward redemptions, bans, and changes to your stream's status and title. Our server checks that each event really came from Kick and holds it until your app collects it; then that copy is deleted. If you're on the free plan and Kick isn't the platform you chose, we don't keep Kick events.
• Tips, memberships, and merch orders. When you connect Ko-fi, Buy Me a Coffee, Tipeee, Throne, PayPal, Stripe, Shopify, Fourthwall, or Printify, that service sends its events to our server. An event can include a supporter's name, message, and amount, and for store orders, the buyer and order details the store includes, such as an email or shipping address. Our server checks that each event is genuine and keeps it so your app can collect it, even if the app was closed when it arrived.
• Stored copies. We keep a copy of each tip and merch event, and of each Kick event while Kick is one of your active platforms, for your account on our servers until you delete your account.
• Connection details. To check these events, we store a private webhook address for each service you connect, the signing secret or verification token for it, the events you chose, and IDs such as your Kick channel ID or your Stripe account ID. When you set up Stripe or Fourthwall, the app sends us the key you entered so our server can register the webhook with that service; we use it for that request and don't store it. The same goes for your Kick token when we set up or remove Kick's event subscriptions.

What stays on your device

Konduit handles your chat, your viewers' names and messages, and your tips so it can show them to you. Apart from what passes through our servers as described above, this stays on your computer and isn't stored on our servers:

• Your sign-in tokens and keys for Twitch, YouTube, Kick, Rumble, and Streamlabs, and the API keys you enter for other services. These are encrypted at rest on your machine using your operating system's secure storage (Keychain on macOS, DPAPI on Windows). If that secure storage isn't available on your computer, the app stores them without that encryption. The webhook secrets you paste in for tip and merch services are the exception to this list: our server keeps a copy too, as described above.
• Chat from Twitch, YouTube, and Rumble. The app connects to these platforms directly, so their chat doesn't pass through our servers.
• Your history — alert history, event logs (kept 30 days by default; you can choose 7 days, 90 days, or forever), a 30-day record of incoming alerts, analytics (session history is kept for about a year), and your supporter, chatter, and loyalty lists, which have no time limit.
• Your settings — alert sounds, colors, commands, and configuration, plus backup copies of them.
• Log files. The app writes a log file for each session to a Konduit-Logs folder in your Documents folder, and copies it to a konduit-session-logs folder on your Desktop when you quit. Logs can include viewer names, short chat snippets, tip details, and text read aloud. The app doesn't delete old log files; you can delete them at any time.

The app keeps its data in ~/Library/Application Support/konduit on macOS and %APPDATA%\konduit on Windows. Signing out keeps your data on this computer, so it's there when you sign back in. Deleting your account removes most of it, as described below.

Services you connect yourself

Some features send data to services you choose and set up with your own account. Those services handle it under their own terms and privacy policies.

• Text-to-speech. By default, Konduit reads messages aloud with the voices built into your computer's operating system. If you add your own ElevenLabs or Fish Audio key, the app uses it to list that service's voices, play voice previews and read your alerts aloud: the text Konduit reads, including supporter names, amounts and messages, is sent to the service you picked to produce the voice. Your key stays on your computer and is sent only to that service.
• Tip, merch, and payment keys. When you add a key for Stripe, PayPal, Shopify, Fourthwall, or Printify, the app checks it directly with that service.
• Streamlabs and OBS. The app connects to Streamlabs directly with your Streamlabs token. OBS connections stay on your computer, and the overlay pages you add to OBS as Browser Sources are served only from your own computer.
• Discord. If you add a Discord webhook, the app sends a test message to it to check that it works.

AI connector

You can connect an AI app (Claude, ChatGPT, Grok, or Gemini) to your Konduit account, so it can answer your setup questions. When you do, we store:

• The connection — which AI app you connected, when you connected it, and when it was last used.
• A setup-status snapshot — status values only, such as connected or needs attention for each integration, when each integration last received an event, a short error code when one fails, plus your plan, the platform you chose on the free plan, your app version, and your operating system. It never includes keys, passwords, chat, or payment details.
• A log of which Konduit tools the AI used, with no question content. We keep it for 30 days.

The app uploads the snapshot only while at least one AI app is connected. The snapshot is deleted when you disconnect your last AI app, and everything above is deleted when you delete your account.

Your AI app's provider (OpenAI, Anthropic, xAI, or Google) receives the answers Konduit's tools return, and handles them under that provider's own privacy terms.

You can see your connected AI apps, and disconnect them, in Konduit under Settings → Connect your AI.

Updates and exchange rates

The app checks GitHub, where we publish Konduit releases, for updates and downloads them from there. To convert tips paid in other currencies, it also downloads public exchange rates from api.frankfurter.dev, or open.er-api.com as a backup. These requests don't include your account or stream data.

YouTube API Services

Konduit uses YouTube API Services. By using Konduit's YouTube features, you also agree to the YouTube Terms of Service.

Google's handling of your data is described in the Google Privacy Policy.

When you connect YouTube by signing in with Google, Konduit requests permission to manage your YouTube live chat (the youtube.force-ssl scope). Konduit uses this access solely to:

• Identify your channel and find your active live broadcast
• Read your live chat through the YouTube API when it can't be read from YouTube's public chat page
• Send chat messages you compose to your own live chat
• Perform moderation actions you initiate in your own live chat

Most of the time, Konduit reads your live chat from YouTube's public chat page, which doesn't use your Google account.

This access is used only to provide these user-facing features. Konduit does not use YouTube data for advertising, does not sell it, does not transfer it to third parties except as necessary to provide the feature or comply with law, and does not allow humans to read this data except with your consent, for security purposes, or to comply with law. Google user data obtained through this permission is processed and stored on your device and is not stored on Konduit's servers. Your Google tokens pass through our server only during sign-in, renewal, and revocation, as described above.

You can revoke Konduit's access to your Google account at any time via Google's security settings page. You can also choose Permanently revoke for YouTube in Konduit, which asks Google to cancel Konduit's access and deletes the stored tokens from your device.

Other platform connections

Connecting Twitch, Kick, Rumble, or Streamlabs works much the same way: you grant access through that platform's own sign-in or key, the credentials are stored encrypted on your device, and each platform's own privacy policy governs their side. Twitch and Kick sign-ins go through our server, and Kick events reach your app through our server, as described above.

Inside Konduit, Disconnect pauses a platform but keeps its saved sign-in, so you can reconnect quickly. Permanently revoke asks Twitch, YouTube, or Kick to cancel Konduit's access and then deletes the saved sign-in from your device; for Streamlabs and Rumble it deletes the saved token or channel details. If you signed in to Rumble inside the app, Rumble's own login cookies stay in the app until you delete your account.

How we use your data

• To provide the product: authentication, subscription management, feature unlocks, delivering tip, merch, and Kick events to your app, and answering the AI apps you connect
• To fix problems: crash reports, diagnostics, and bug reports
• To communicate with you: account and billing emails (such as sign-up and password-reset codes) and replies to your feedback

What we don't do

• We don't sell your data. Ever.
• We don't show ads or share data with advertisers.
• The desktop app doesn't send usage analytics.
• We don't mine your chat or stream content, and we store it only where this policy says we do.
• We don't look at the tip, merch, or Kick events stored for your account unless you ask us to help with a problem, to keep the service secure, or when the law requires it.
• We don't send marketing email without consent.

Third-party processors

The streaming platforms, the tip and merch services, and the AI apps you connect also receive and handle data under their own privacy policies.

Data retention and deletion

Account and subscription records are kept while your account exists. The copies of tip, merch, and Kick events we keep for your account are kept until you delete your account. Kick events waiting for your app are deleted once the app collects them. Crash reports, bug reports, and feedback emails are kept as long as we need them to fix problems, and deleting your account doesn't remove them; if you want them deleted sooner, email us. For the AI connector, the log of which tools an AI used is kept for 30 days, and the setup-status snapshot until you disconnect your last AI app. Our server also keeps operational logs, which can include your account ID and Stripe customer ID, for troubleshooting.

Deleting your account. You can delete your account in the app under Settings → Account → Delete account. When you confirm, we cancel any subscription right away, delete your customer record at Stripe, ask Twitch, YouTube, and Kick to revoke Konduit's access, and delete your account. That also deletes, from our servers, your subscription record, the tip, merch, and Kick events stored for you, your connection details, and your AI connector data. We keep a record that the deletion happened, without your email or name, and one-way hashes of your former account and Stripe IDs, so a late payment notice from Stripe can be matched without bringing your account back. A few internal records may keep your old account's random ID number, but never your email or name. Stripe may keep records of past payments under its own legal obligations.

On your computer, deleting your account removes that account's settings, event logs, analytics, supporter and loyalty data, alert history, backups, uploaded alert media and badges, saved sign-ins, and Rumble login. It doesn't remove log files, the 30-day record of incoming alerts, crash dumps, files you exported, or a few app-wide settings. You can delete those yourself, as described below.

You can also email support@konduit.gg to ask us to delete your account. We'll remove your records from our systems, subject to records we're legally required to keep (e.g., billing history for tax purposes).

Uninstalling doesn't delete your data. Removing the Konduit app leaves its data on your computer. To remove it, delete the app's data folder (~/Library/Application Support/konduit on macOS, %APPDATA%\konduit on Windows), the Konduit-Logs folder in your Documents folder, and the konduit-session-logs folder on your Desktop. Your computer's Keychain (macOS) or Credential Manager (Windows) also keeps a few small Konduit entries used for encryption and plan checks, which you can delete there.

Your choices

• Turn off crash reporting in Settings → Privacy.
• Disconnect, or permanently revoke, any platform or service inside the app.
• Disconnect any AI app in Settings → Connect your AI.
• Delete the app's log files whenever you like.
• Delete your account in Settings → Account.
• Email support@konduit.gg with any privacy question or request.

Security

Credentials on your device are encrypted using OS-level secure storage. Connections to our servers use HTTPS/TLS, and our database limits each account to its own records. Payment data is handled entirely by Stripe, a PCI-DSS certified processor.

Children

Konduit is not directed at children under 13, and we do not knowingly collect data from them.

Changes

If this policy changes materially, we'll post the update here with a new effective date.

Contact