About this project
UniversalCollab is an independent desktop app and self-hosted streaming relay developed by JBug. This policy describes the current release candidate. A relay operator controls their own server; connecting to a server does not make it a service operated by JBug.
Platform accounts and permissions
UniversalCollab uses YouTube API Services and Twitch APIs. When you connect a platform, you authorize access through its sign-in service. The app does not ask for your Twitch or Google password. It receives authorization tokens and account or channel identifiers, and uses them for the features you choose: stream metadata, broadcast preparation, chat and authorized moderation.
The desktop app stores platform tokens and application settings in its local operating-system encrypted storage. It also saves local workspace preferences, server profiles and prepared stream information. Keep your device and keyring protected. The app does not send your platform authorization tokens to the relay.
What your relay receives
When you prepare a broadcast, the selected relay receives destination URLs and stream keys, stream titles, selected destinations and recording choices. It receives your server username, collaboration requests, approvals and layout preferences. OBS sends the video and audio to that relay. The server operator can access server-side records and media, so choose a host you trust.
Approved collaborators’ feeds may appear in your outgoing video. When you enable chat overlays, rendered chat frames go to your relay and may appear in the broadcast and its recording. Viewers’ names and messages can therefore become part of the stream.
Chat, recordings and backups
The desktop app keeps a recent chat buffer in memory for viewing and moderation. Clearing the local view does not delete messages on Twitch or YouTube. Moderation commands act on the selected platform using your permissions.
If the host enables recording and you select it, the relay stores a recording on that server. Completed recordings can be downloaded or deleted by their owner when host policy allows. Hosts control storage limits; there is no universal automatic deletion schedule.
Encrypted settings backups are files you explicitly export. They can include saved logins and stream destination details. You control where copies are kept and when they are deleted. Protect the backup password.
Third-party pages and this website
Custom browser panels load websites you choose. Those sites may receive connection information and use their own cookies or storage. Their content is not automatically censored. External providers process information under their own policies.
This static project website has no analytics scripts, advertising, sign-in form or donation widget. Its hosting provider, GitHub Pages when deployed there, may log visits and IP addresses. Clicking Ko-fi opens Ko-fi, which handles contributions and associated information under its own policy; this website does not collect payment details.
Disconnect, revoke and delete
- Use Disconnect account in the app to remove a platform login locally. The app attempts to revoke platform access; if that fails, revoke it directly with the provider.
- You can revoke Google access from Google Account connections and Twitch access from Twitch Connections.
- Removing a saved server from the desktop app removes that local saved connection, not the server account or recordings. Ask the relay operator to remove server-side records and any retained copies.
- Delete local exported backups separately. Uninstalling the app does not necessarily remove its saved settings.
- Ending a broadcast or expiring a guest invitation does not erase existing recordings or server account records.
Provider policies
Google processes information under the Google Privacy Policy. See also Twitch’s Privacy Notice, GitHub’s Privacy Statement and Ko-fi’s Privacy Policy.
Contact and changes
For questions about UniversalCollab’s privacy practices, contact JBug through the creator’s Ko-fi page. For data held by an independently operated relay, contact its operator. Include the relevant app version and the type of data involved, without sending account secrets. Changes to this policy will be reflected on this page.