Legal

Privacy Policy

Last updated: October 1, 2026

This Privacy Policy explains how XFrame Live (“the App,” “we,” “us”) handles information when you use the Android application and the website xframelive.com (together, the “Service”).

XFrame Live uses YouTube API Services; see section 3.3 for what that means for your data.

We designed XFrame Live so that most streaming work happens on your device and with the platforms you choose. We do not operate a separate XFrame Live user-account database for your streams, and we do not sell personal information.

1. Who is responsible

XFrame Live is operated for the XFrame Live project. For privacy questions or requests:

• Email: support@xframelive.com
• Website: https://xframelive.com

2. What this App does

XFrame Live captures camera and microphone on your phone and can broadcast live to destinations you configure (Twitch, Kick, YouTube, or a custom RTMP/RTMPS server). Optional features include dual camera / picture-in-picture; live chat on the phone and on the stream; stream overlays you compose (text, scrolling text, browser sources, and images); Pro live-data overlays (speed, clock, steps, distance goal, on-stream chat, and a GPS map); local recording; background capture while streaming; on-device AI denoise (Pro); optional Disconnect Protection via XFrame relay servers (including a custom hold still or short loop); and Google Play purchases.

3. Information we process

3.1 Device permissions & capture

• Camera — video for preview, live stream, and optional local recording (including dual-camera / PiP where the device allows).
• Microphone — audio for streaming and recording, including built-in, USB, and Bluetooth microphones when selected.
• Network / Internet — to send your stream, refresh ingest keys, load chat/audience stats where supported, and talk to Google Play / OAuth providers.
• Notifications & foreground service — Android may require a persistent notification while you stream or record so capture can continue reliably.
• Photos / media (optional) — when you save or access local recordings on your device.
• Nearby devices / Bluetooth (as needed) — to discover or route to wireless microphones on supported Android versions.
• Location (optional, foreground only) — asked only when you turn on a live-data overlay that needs it (speed, distance goal, map, or a clock that shows sunrise/sunset). The App does not request background location.
• Physical activity (optional) — asked only when you add the step-counter overlay. The count is read from the phone’s sensor on device.
• Advertising ID — used by Google’s analytics / ads libraries so we can measure installs and in-app conversions. See section 3.10.

3.2 Credentials you connect (stored on device)

If you connect Twitch, Kick, YouTube (Google), or enter a custom RTMP URL and stream key, related tokens, keys, and settings are stored locally on your device so you can go live. Protect your device; never share stream keys. Disconnecting a platform in Settings removes that connection from the App’s local storage. For YouTube, see 3.3 YouTube API Services.

3.3 YouTube API Services

XFrame Live uses YouTube API Services. When you connect YouTube, you sign in with Google and the App calls the YouTube Data API and YouTube Live Streaming API on your behalf. By using those features you agree to the YouTube Terms of Service, and Google processes your information under the Google Privacy Policy.

What the App accesses through YouTube API Services

• your Google account display name (or email address if no name is set), to show which account is connected;
• your YouTube live streams — the ingest URL and stream key — so the App can send your video to YouTube;
• your live broadcasts — the App creates a broadcast when you go live, binds it to your stream, sets the title you type, reads its status, and moves it to live and complete;
• live chat messages of your broadcast (author name and message text), to show them on the phone and, if you choose, on the stream;
• your channel’s subscriber count and your broadcast’s concurrent viewer count, for the on-screen display.

How it is used

This data is used only to provide the YouTube streaming features you ask for. We do not use it for advertising, we do not sell it, and we do not use it to train AI or machine-learning models. XFrame Live’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What is stored on your device

XFrame Live stores, and allows Google/YouTube to access, information on your device as follows: the Google sign-in tokens, your account display name, and your YouTube stream key are kept in the App’s private storage, which is excluded from Android backups; the ids of broadcasts the App created and up to 300 recent chat messages are kept in the App’s settings storage. Subscriber and viewer counts are held in memory only and are never written to storage. The App shows no third-party ads. XFrame Live has no user-account server and does not store YouTube data on its own servers.

Who it is shared with

• Google / YouTube, to perform the actions you request;
• XFrame relay servers, only if you turn on Disconnect Protection: the relay receives the YouTube ingest URL including your stream key for that live session only, so it can forward your stream, and discards it when the session ends;
• your viewers, only for chat you choose to draw on the stream, which becomes part of the video.

Analytics receives only event names and the platform name (for example that a YouTube account was connected), never YouTube data (see 3.10). Bug reports remove stream keys, tokens, and email addresses and never include chat (see 3.12).

How long it is kept, refreshed, and deleted

• The stream key is fetched again from YouTube every time you go live.
• The stored display name and stream key are refreshed from YouTube at least every 30 days. If they cannot be refreshed, they are deleted. Broadcast ids not refreshed by a go-live within 30 days are deleted.
• YouTube chat messages are deleted from the device after 30 days.
• When you tap Disconnect for YouTube in Settings, the App deletes the sign-in tokens, display name, stream key, broadcast ids, and YouTube chat from the device, and revokes the App’s access with Google.
• You can also revoke XFrame Live’s access at any time on the Google security settings page. When the App next finds that its access is gone, it deletes the stored YouTube data as if you had tapped Disconnect.
• Uninstalling the App deletes all of it.

Questions about YouTube data: support@xframelive.com.

3.4 Purchases, Pro, and add-ons

Pro features (such as multistream, Custom RTMP, dual camera PiP, 2K / 4K, AI Denoise, and the live-data overlays) may require a Google Play subscription (monthly, half-year, or yearly). Text, scrolling text, browser, and image overlays stay on the Free tier. Disconnect Protection is a separate monthly add-on and is not included in Pro. Payments are processed by Google Play Billing. We receive purchase/entitlement status needed to unlock features; payment card details are handled by Google, not by us.

3.5 Overlays, images & live data

Overlay text, positions, sizes, colors, image files you pick, and any browser-source web address you add are stored locally on your device with your other settings. They are not uploaded to us, except a custom Disconnect Protection still or loop you choose (see 3.9).

An image overlay uses the system photo picker. The App does not request gallery-wide photo access. The picture you pick is kept on device and drawn into your outgoing stream.

A browser source loads the web address you enter inside the App so it can be drawn over your video. That page is fetched directly from the site you chose, so — exactly as in a normal browser — that site can see your IP address, approximate location derived from it, and anything its own scripts or cookies collect. Its content is rendered on your device and composited into your outgoing stream. We do not proxy, log, or inspect that traffic. Only add sources you trust, and review that site’s privacy policy.

Live-data overlays (Pro) draw changing values on the stream: speed, clock, steps, distance toward a goal, on-stream chat, and a GPS mini-map. Those readings are computed on your device and leave it only as pixels in the video you send to destinations you choose — not as a separate location or fitness feed to XFrame Live.

3.6 Location, map tiles & steps

If you enable speed, distance goal, map, or a clock with sunrise/sunset, the App reads precise location while the App is in use so those overlays can update. Location is not requested to open the camera, and it is not used in the background. We do not upload your coordinates, routes, or a location history to XFrame Live servers.

The map overlay downloads nearby street tiles from CARTO (OpenStreetMap data) so the mini-map can be baked into your broadcast. Those tile requests include the map area you are in (and your IP address, as any website request does). Attribution (“© OpenStreetMap © CARTO”) is drawn on the overlay. CARTO’s processing is described in CARTO’s privacy policy.

The step counter reads the phone’s pedometer when you add that overlay. The count stays on the device except as drawn on your stream. We do not store a step history on our servers.

3.7 On-device AI Denoise

If you enable AI Denoise (Pro), microphone audio is processed on your device in real time to reduce background noise before encoding. This processing is for the live stream / recording path you control. We do not upload your mic audio to an XFrame Live cloud for model training. Denoised (or raw) audio still leaves your device only as part of the stream or file you send to destinations you choose.

3.8 Live chat & audience

If you connect a platform, the App can fetch chat messages and viewer / follower counts from that platform’s APIs so you can see them on the phone HUD and, if you enable it, draw chat on the outgoing stream. Those requests go to Twitch, Kick, or YouTube / Google — not to an XFrame Live chat server. We do not store your chat history or audience numbers on our servers. Chat you put on the stream is part of the video those platforms (and their viewers) receive.

3.9 Disconnect Protection hold stills

If Disconnect Protection is on, your live video and audio are sent to XFrame relay servers for that session (see section 6). You may also choose a custom “be right back” still (JPEG) or a short loop (MP4). That file lives on your device until you go live with protection on; then it is uploaded to the relay for that session only, so viewers see it if your phone drops. We process it in real time to hold the destination stream. We do not keep a VOD library of your streams or hold stills after the session ends.

3.10 Analytics

The App uses Google Analytics for Firebase to understand which features are used and to measure Google Ads conversions (for example connecting a platform, going live, starting a trial, or completing a Play purchase). That SDK may read the device’s Advertising ID and send event names plus coarse parameters such as platform (twitch / kick / youtube), whether AI Denoise or Disconnect Protection was on, and overlay kind ids (for example map or streamChat).

We do not send chat text, GPS coordinates, stream keys, destination URLs, account names, or overlay wording to Analytics. You can reset or limit the Advertising ID in Android settings. Google’s processing is described in Google’s privacy policy.

3.11 Website, newsletter & Discord

Our marketing website may receive standard server or hosting logs (for example IP address, browser type, and pages requested) as operated by our hosting provider.

If you press Accept in the cookie banner, the website uses Google Analytics to count visits and see which pages are read. It then sets cookies and sends Google the pages you view, how you arrived (for example from a search or a link), your browser and device type, and an approximate location derived from your IP address. We use these figures only in aggregate. If you press Reject, Google Analytics is not loaded and no analytics cookies are set. Your choice is saved in your browser, and you can change it at any time with Cookie settings at the bottom of every page. The App’s own analytics are described in 3.10.

If you subscribe to the newsletter, your email address is sent to Mailchimp (Intuit) so we can send product updates. You can unsubscribe from any email, or write support@xframelive.com. Mailchimp’s processing is described in Mailchimp’s privacy policy.

If you join our Discord community, that use is between you and Discord. We do not require a Discord account to use the App. See Discord’s privacy policy.

3.12 Bug reports

While the App runs it keeps a rolling log of its own activity on your device, covering only the last 30 minutes; older entries are deleted continuously. Nothing from it leaves your device on its own.

If you choose Create bug report in Settings → Other, the App saves a file to your phone’s Downloads folder with that log, the buttons and screens you used, your phone model and Android version, camera capabilities, network type, and technical stream settings. Stream keys, passwords, sign-in tokens, email and IP addresses, and location are removed before the file is saved. Chat messages, photos, and recordings are never included, and you can see the full contents before saving.

The file is not sent automatically. It only leaves your phone if you share it yourself (for example by email or Discord), and we use a report you send us only to find and fix the problem.

4. Why we process information (purposes)

• Provide live streaming, recording, chat, stream overlays (including live-data overlays), and related features;
• Authenticate to platforms you connect and manage ingest / broadcasts;
• Process and restore Pro and add-on purchases via Google Play;
• If you enable Disconnect Protection, forward your live session through XFrame relay servers for that session (including a short hold and any custom still or loop you upload for that session);
• Fetch map tiles around you when the map overlay is on, so the mini-map can be drawn on your stream;
• Keep capture running safely while the App is backgrounded during a live session;
• Measure product use and advertising conversions with Firebase Analytics;
• Send the newsletter if you subscribe;
• Respond to support requests you send us;
• Find and fix problems using a bug report you choose to send us;
• Comply with law and enforce our Terms of Service.

5. Legal bases (EEA / UK and similar)

Where applicable privacy laws require a legal basis, we rely on:

• Contract / requested service — providing the App features you use (streaming, OAuth connections, billing unlocks);
• Consent — device permissions (camera, microphone, location, activity, notifications), optional connections you approve, and bug reports you choose to send us;
• Legitimate interests — securing the Service, basic website operations, and measuring how the App is used (including advertising conversions) in ways that do not override your rights;
• Legal obligation — when we must retain or disclose information to comply with law.

6. Where data goes (third parties)

By default we do not host your live video. When you go live or use chat, audience, map, analytics, or newsletter features, data is processed by the parties below, under their own terms and privacy policies:

• Twitch, Kick, YouTube / Google, and/or
• any custom RTMP/RTMPS server you enter,
• any website you load as a browser-source overlay, which your device contacts directly,
• XFrame relay servers, only if you turn on Disconnect Protection. In that case your live video and audio — and any custom hold still or loop you chose — are sent to our relay for the duration of the session, including up to a few minutes of hold if your phone drops, so we can keep the destination stream alive. We process that media in real time to forward it. We do not offer stored VOD of your stream on our servers.
• CARTO, if you enable the map overlay, for nearby street tiles,
• Google (Firebase Analytics and Google Analytics), for the App events described in 3.10 and website visits described in 3.11,
• Mailchimp, if you subscribe to the newsletter,
• Discord, if you join the community server.

Google also processes OAuth and Play Billing under Google’s policies.

7. Retention

• On device: settings, tokens, overlay images, custom hold stills, and recordings remain until you change/delete them, clear App data, or uninstall.
• YouTube data: refreshed from YouTube at least every 30 days or deleted; YouTube chat is deleted after 30 days; everything is deleted when you disconnect YouTube. See section 3.3.
• Relay sessions: live media and any uploaded hold still exist only for the active Disconnect Protection session.
• Analytics: Firebase / Google retain events under Google’s retention settings for that project.
• Newsletter: your email stays on the Mailchimp list until you unsubscribe or we delete it.
• Bug reports: the on-device log covers only the last 30 minutes. A saved report stays in your Downloads folder until you delete it. A report you send us is kept only as long as needed to fix the problem.
• Support emails: kept only as long as needed to resolve your request and for ordinary business records.
• Platforms: retention of your live VODs, chat, and analytics is controlled by those platforms, not by XFrame Live.

8. Security

We use reasonable technical measures appropriate for a mobile client (including on-device credential storage practices and HTTPS for API calls). No method of transmission or storage is 100% secure. You are responsible for securing your phone and stream keys.

9. Children

The Service is intended for users 13+ (or the higher digital-consent age required in your country). We do not knowingly collect personal information from children under that age. If you believe a child provided information, contact us and we will take appropriate steps.

10. Your choices & rights

You can:

• Deny or revoke Android permissions in system settings (including location, activity, and Advertising ID);
• Turn off live-data overlays so location, steps, and map tiles stop;
• Disconnect platforms and clear destinations in App Settings;
• Revoke XFrame Live’s access to your Google account on the Google security settings page;
• Delete local recordings, overlay images, and custom hold stills from your device;
• Manage or cancel Play subscriptions in Google Play;
• Unsubscribe from the newsletter via any email or by writing to us;
• Uninstall the App to remove local App data (subject to Android behavior).

Depending on where you live (for example EEA, UK, California), you may also have rights to access, correct, delete, or restrict certain processing, and to lodge a complaint with a supervisory authority. To exercise rights regarding information we hold (such as support email content), contact support@xframelive.com. We may need to verify your request. Because most App data stays on your device, many requests are fulfilled by using in-App controls or clearing App data.

California: We do not “sell” or “share” personal information as those terms are commonly defined under the CCPA/CPRA for cross-context behavioral advertising.

11. International users

The App is used globally. Third-party platforms you connect may process data in other countries. Use of those platforms is subject to their rules and transfer mechanisms.

12. Changes

We may update this Policy from time to time. The “Last updated” date will change when we do. Material changes may also be noted on xframelive.com. Continued use after an update means you accept the revised Policy.

13. Contact

Privacy questions: support@xframelive.com

This Policy is provided for transparency. It is not formal legal advice. If you need jurisdiction-specific counsel, consult a qualified attorney.