Privacy Policy

1. Who we are

Yellcano is a viewer-engagement platform for people who stream. A creator runs a private console and adds an overlay to their broadcasting software; their audience sends messages, sounds and clips from a shared page or from the creator's own chat, and those interactions air on the stream. “Yellcano”, “we” and “us” mean the operator of the Yellcano service. “You” means whoever is reading — a creator using the product, or a viewer interacting with a creator's page.

This policy covers the Yellcano service and this website. It does not cover the streaming platforms you connect to Yellcano; those are governed by their own policies.

2. Data we collect

If you are a creator

• Your account and sign-in details, and the settings that make your page yours — display name, page address, branding, published voices, prices, chat commands, blocklist.
• Your connected streaming platforms: which platform, which channel, and the credentials that platform issues so we can read your chat. Those credentials are always stored encrypted.
• Voice Lab material, if you create a custom voice: the reference recording you upload and the written release you accept with it. That recording, and the voice model built from it, are a voiceprint — a biometric identifier. The release records that they are a voiceprint; that they are used to generate speech for your stream and Yellcano’s voice features; that a short excerpt is sent with each line to a hosted speech provider in the United States; and that they are kept until you delete the voice or your account. Section 6 says the same about how long we keep them.
• Operational records of what aired on your stream, and of moderation decisions you made.

If you are a viewer

• What you send: the message text, the voice, sound or clip you chose, and the resulting receipt.
• Your identity, at the level you chose to give it. You can send as a guest with no account at all. If you sign in with Kick, Twitch or Google, we store the account identifier that provider returns and your display name, so your points, favourites and receipts follow you between devices.
• Your points balance and the ledger of how it moved.
• If you only ever typed in a creator’s platform chat, and never used Yellcano at all: where that creator has switched on the chatter list, we keep a per-channel record of your platform display name, the previous display names we have seen you use there, your platform id, and when we first and last saw you. On Twitch and Kick we also keep how many messages you sent; on YouTube we never count messages at all. We never keep what you said. If you chatted on YouTube and have no Yellcano account, that whole record is deleted 30 days after we last see you chat, with nothing kept behind it. In Yellcano, the creator of that channel and the Admins and Mods on their team can see your Twitch or Kick name while we hold it, but never your YouTube channel name. Section 4 sets this out in full, including how long each part is kept.
• Paid direct messages. If you spend points to send a creator a private message, we store the message itself — encrypted — along with who sent it, who it was for, when, and the purchase behind it. The creator’s reply is stored the same way. In the ordinary course nobody else reads either one, and section 9 says exactly when we can open one and what happens when we do.
• Your age bracket. A creator’s store is for buyers who are 18 or older. Where the store asks, it asks for your birth year on a paid purchase until you have answered; the month is optional. We never keep your birth year or month. We keep with your account only whether you are 18 or older, and when you answered or changed it. You can change your answer on Your account, though a change from under 18 to 18 or older may have to wait.
• If you pay for an interaction: the payment record and status. Card details go directly to our payment processor — Yellcano never receives or stores a card number.
• If you place a store order — including a paid private message, and any boost you buy on one — the order record, and the network address of the browser that placed it, kept with that order so that a dispute about that order can be answered, and for nothing else. We do not build or store a browser or device fingerprint — not for a store order, and not anywhere else.

Technical data, for everyone

• We do not keep ordinary request logs that identify you, and we do not store your IP address or user agent as data about you, with two exceptions. First, a store order keeps the network address of the browser that placed it, with that order, to answer a dispute about that order. Second, a security record, described in the next bullet.
• The security record. When a request is refused by a security control — a forged or expired link, session or grant; a failed human check; a rate, quota or flood limit; the broadcasting-bridge fence; a territory refusal — or is flagged as suspicious, we record that request's IP address and user agent, a digest (never the value) of any token it presented, which control refused it, and the time. That record exists to investigate abuse and attacks and to support a claim or a report about them. Section 6 says how long it is kept.
• To keep Yellcano fast, we measure how quickly pages and media load. These measurements contain no names, accounts or addresses.
• A derived, non-reversible key we use to recognise a returning sender for moderation purposes. When a creator blocks somebody, they act on a label — they never see the underlying key material.
• A human check, where one is shown. Some pages show a check that decides whether you are a person rather than an automated tool. It is run for us by an automated abuse-check service, and when it appears that service receives your network address and technical details of your browser in order to make that decision. It is not an advertising tool and sets no advertising cookie.

3. How we use it

We use data to do the things the product is for, and for nothing else:

• To run the service: accept an interaction, check it against the rules, render speech, and put it on the stream it was sent to.
• To enforce limits and safety: rate limits, quotas, the content floor, creator blocklists, blocks and mutes.
• To take a payment or move points, where the creator has priced an interaction and you elected to pay for it.
• To keep the service working: diagnosing faults, investigating abuse, and keeping backups.
• To defend the service: to investigate unauthorised access, security tampering and attacks on availability, and to bring or answer a claim or a report about them.
• To answer you when you contact us.

We do not sell your data. We do not share it with advertisers or data brokers, we do not use it to serve or target advertising, and we do not build advertising profiles.

We do not use your content to train AI models. Speech is generated for the interaction you asked for. Neither your messages nor data from a connected account is used to train or fine-tune any model.

4. YouTube live chat and connected accounts

This section is addressed to creators who connect a streaming account. One part of it reaches viewers who never connect anything — the chatter list below records people who type in a connected channel’s chat, whether or not they have ever used Yellcano, so if that is you, the chatter-list entries under “How we store it” and “How long we keep it” are yours to read. The rest applies only where you connect an account. It is written in full because the YouTube connection involves Google user data, and you are entitled to know exactly what happens to it.

What we access

We request exactly one Google permission: https://www.googleapis.com/auth/youtube.readonly. It is read-only. With it we make three kinds of request to the YouTube Data API, and no others:

• Your channel's identity — once, at the moment you connect, so we can show you which channel you just linked and let you confirm it is the right one. We receive the channel's name, its id, and its thumbnail.
• Your active broadcast — to find the live chat belonging to the stream you are currently running.
• The messages in that live chat — the message text, its id, and the display name and channel id of the viewer who sent it. This is the data the feature runs on.

We do not read your videos, your playlists, your subscribers, your analytics, your comments, or your private channel settings, because the permission we hold does not grant them.

What we cannot do

Yellcano cannot send a message, delete a message, moderate, ban, upload, or change anything at all on your channel. This is not a promise about our intentions — it is a property of the permission we hold, and there is a second lock behind it. The set of permissions Yellcano is allowed to request is a fixed list, and every write-capable YouTube permission sits on an explicit deny list that is checked when Google hands us the credential. If a credential ever came back carrying a write permission, we would reject it and the connection would fail rather than be saved.

Why this permission and not a narrower one

YouTube does not publish a chat-only or read-chat-only permission. youtube.readonly is the narrowest permission that authorises all three requests above. Every alternative that would let us read live chat — youtube, youtube.force-ssl, and the youtubepartner permissions — also grants write access to your channel. We will not ask for those.

How we use it

Google user data obtained through this connection is used for one purpose: operating the live interaction features you turned on. A message read from your chat is checked against the rules you configured and, if it qualifies, becomes an interaction on your stream. That is the whole of it.

How we store it

• Credentials. The access and refresh tokens Google issues are encrypted before they are stored, with keys held separately from the data, and each stored value is bound to the record it belongs to so it cannot be moved between records. They are never written in plain text, and never logged.
• Chat messages. Messages are read while you are live, turned into the on-screen interaction you configured, and are not kept as a chat archive. What persists is the record of the interaction that ran on your stream — your own product data, which you can moderate and review.
• Who chatted, if you turn on the chatter list. This is off unless you switch it on for your channel. When it is on, we keep a per-channel list of the viewers who typed: their platform display name, the previous display names we have seen them use in your channel (up to twenty of them), their platform id, when we first and last saw them, and how many messages they sent — except on YouTube, where we never count messages at all, because that count would be YouTube’s data rather than ours. We never keep what they said. The display name and the platform id are deleted 30 days after we last see that viewer chat — if they chat again the 30 days start over, and if they do not, both are removed. Each previous name is deleted on the same 30-day clock, counted from the last time we saw that name in use. What happens to the rest of the entry depends on whether that viewer has a Yellcano account. If they have one, the entry is kept with that account rather than on a clock, and it is deleted when we act on a deletion request. What decides this is the Yellcano account, not the platform’s chat identity. An entry is kept with an account from the first time we see that viewer chat while their platform identity is linked to a Yellcano account, and it stays with that account even if they later unlink the platform. If they have none and they chatted on YouTube, the whole entry is deleted on the same 30-day clock and nothing is kept behind it. If they have none and they chatted on Twitch or Kick, the entry stays once the name and the platform id are gone. A block you placed on a viewer is a separate moderation record: it is kept under the moderation key described in section 2, holds no platform name or id, and keeps working after their entry is gone. Where an entry does stay, what is left is a one-way code we compute with a key of our own — one for the viewer and one for each name we saw them use — the counts, the dates, and any moderation action you took. That record is what lets you answer “who was this, and what did I do about them” after the name is gone. The code is not the platform id, and nobody outside Yellcano can link it back to one. It is scoped to your channel alone and cannot be matched against any other channel’s list. We keep the key that produced it, which is what lets us find and delete a viewer’s entry when they ask us to (section 7).
• What you see in the chatter list. The list is shown only in your creator console, to you and to any Admins and Mods you add to your team. For a Twitch or Kick viewer it shows the name they use on that platform while we still hold it, the other names we have seen them use in your channel, the day we first and last saw them, about how many messages they sent, and whether they are signed in to Yellcano. For a YouTube viewer it never shows the channel name we receive, because on YouTube that is often a person’s real name: the viewer appears under a label we generate, a name search does not look at YouTube viewers, and their earlier names show only as dates and counts, and whether another viewer in your channel used the same name — never as the names themselves. Every entry says which of the rules above it is under. You never see a viewer’s platform id or the one-way codes. What you see follows the same clocks: a name leaves your view when we delete it, and an entry leaves your list when we delete it.
• Channel identity. The channel name, id and thumbnail are kept for as long as the connection exists, so the app can show you what is connected.

How we share it

Google user data is not shared with anyone. Data obtained from your connected YouTube channel is not sent to advertisers, data brokers or AI model providers, is not included in analytics, and is not transferred to any third party. It stays inside the feature you connected it for. Speech is synthesised from the message text of an interaction that has already been admitted; nothing else from the connection leaves our systems.

How long we keep it

• Credentials are retained only while the connection is active. They are deleted immediately when you disconnect the channel in Yellcano, when you revoke access from your Google account, or when your Yellcano account is deleted.
• Live chat messages are not retained as an archive. They are processed while you are streaming; only the record of the on-screen interaction they triggered persists, as your own product data.
• A chatting viewer’s display name, their previous display names and their channel id, if you turn on the chatter list, are kept for no longer than 30 calendar days after we last see that viewer chat, and are then deleted. If they chat again inside those 30 days the data we hold is refreshed from the API and the 30 days start over; if they do not, all of it is deleted. 30 days is the longest we keep it on any platform: we can set a shorter period, and nothing in Yellcano can set a longer one. For a YouTube viewer with no Yellcano account, the entire entry goes on that clock — the dates, the codes and everything else — and nothing is kept behind it. We never count a YouTube viewer’s messages at all, whether or not they have an account with us. Where an entry does remain, what is left is a one-way code for the viewer, one for each name we saw them use, and the counts and the dates. Those codes are not the channel id and nobody outside Yellcano can link them back to one, but we do keep the key behind them, which is what lets us act on a deletion request. Turn the chatter list off and nothing further is recorded, though what is already stored stays until it is deleted under the next bullet.
• What is left of a chatter-list entry — the one-way codes, the counts, the dates and any moderation action — is kept while the channel’s Yellcano account holds the chatter list. Where the viewer has a Yellcano account of their own, the entry is also kept with that account. Either way it is deleted when we act on a deletion request. A viewer can ask us to delete their entry by contacting us as described in section 7, and we act on that within 30 days. There is no self-service delete button for a single entry in the app today, and closing an account is a request we act on rather than something that removes these entries on its own.
• Channel identity is deleted when the connection is removed.

The limits we accept

How to disconnect or revoke access

Two independent ways, and either one is enough.

• From Yellcano. Disconnect the channel from your chat settings. The stored credentials are deleted immediately.
• From Google. You can revoke Yellcano's access to your Google account at any time from the Google security settings page at https://security.google.com/settings/security/permissions (also reachable at https://myaccount.google.com/permissions). Revoking there ends our access even if you never open Yellcano again.

Signing in with Google as a viewer

Viewers may sign in to a creator's page with Google. That is a separate, ordinary sign-in that requests only your basic profile and email address (openid, email, profile). It requests no YouTube permission and makes no YouTube API call on your behalf. It is revoked from the same Google page linked above.

Questions or complaints about a connected account

Use the contact form at yellcano.com/contact, choosing “Privacy”, with any question or complaint about how Yellcano handles data from your connected account. We respond within 30 days.

5. Sharing

Reported paid messages. If a paid direct message is reported for abuse we keep it for at least 90 days — longer where we make a report to an authority, or where an authority asks us to preserve it, for as long as that requires — and, where the law requires it, pass it to the relevant authority — for child sexual abuse material, that is the National Center for Missing & Exploited Children. We report rather than merely delete, and we say so here because it is the one case where something you sent privately leaves us.

We share data only in these circumstances:

• On the stream, by design. An interaction you send is meant to be seen and heard by that stream's audience. Send accordingly.
• With the creator you sent it to. A creator sees the interactions sent to their own page, so they can moderate them.
• Service providers who make the product work: hosting and infrastructure, our payment processor, and the speech providers used for custom voices. They handle only what their task requires, and only on our instruction.
• An automated abuse-check service, which — when a human check is shown to you — receives your network address and technical details of your browser in order to decide whether you are a person.
• A content-delivery and denial-of-service protection service, which every request to Yellcano passes through on its way to us and which therefore sees your network address and the address you asked for.
• Legal obligation — where we are compelled by valid legal process, or where disclosure is necessary to investigate abuse or protect someone's safety.
• To defend the service. To investigate or respond to abuse or an attack, we may share the security record described in section 2 and the records around it with law enforcement, with the platform whose identity was used, with our payment processor and the card networks, and with our hosting and network providers, and we may use them in a claim.
• Google user data is never shared with anyone, as set out in section 4.

For a custom voice, a short excerpt of the reference recording is sent, together with each line to be spoken, to a hosted speech provider in the United States. It generates the audio and does not keep the recording after the request completes. Section 11 says what that means for where your data lives.

We do not sell personal data, and we have never done so.

6. Retention

• Account data is kept while your account exists, and deleted when it is closed, except for the anti-abuse platform-identity marker described in section 7.
• Connected-account credentials are deleted immediately on disconnect, revocation, or account deletion.
• Live chat messages are not archived. See section 4.
• Chatter list entries. A chatting viewer’s display name, the previous display names we have seen them use in that channel, and their platform id are kept for 30 days after we last see them chat in that channel, and are then deleted. The 30 days restart every time we see them chat again, and 30 days is the longest on every platform. What is left after that depends on the viewer. If they have a Yellcano account, the entry — a one-way code for the viewer, one for each name they used here, the message count, the first and last dates, and any moderation action — is kept with that account, and with the channel’s, and is deleted when we act on a deletion request under section 7. An entry counts as theirs from the first time we see them chat while that platform identity is linked to a Yellcano account, and it stays theirs if they later unlink it. If they have no Yellcano account and chatted on YouTube, the entry is deleted in full on the same 30-day clock and nothing is kept behind it. If they have no Yellcano account and chatted on Twitch or Kick, the entry is kept on the same terms as the first case. We never keep a count of a YouTube viewer’s messages, with or without an account, because that count would be YouTube’s data rather than ours. Switching the chatter list off stops anything further being recorded; it does not delete what is already stored. The one-way code is not the platform id and nobody outside Yellcano can link it back to one; we keep the key behind it, which is how we find the entry when somebody asks us to delete it.
• Interaction records and receipts are kept so a creator can review what aired and a viewer can check a receipt; receipts and viewer sessions expire after 30 days, and a guest session expires after 24 hours of inactivity.
• Generated speech audio is swept automatically once it stops being used, on a short cycle. A line that is sent repeatedly is kept a while longer so it does not have to be regenerated; a line nobody sends again is deleted.
• Paid direct messages, where a creator offers them, are kept for twelve months after the creator replies or declines, and then deleted. A message nobody has answered is not deleted on a timer — it waits, with your points held, until the creator acts or you withdraw it. A message that has been reported is kept for at least 90 days from the report and cannot be deleted by anyone, including you, until that hold ends; if you ask us to delete your data while such a hold is open we will tell you the date.
• Payment records are kept as long as tax and accounting law requires.
• Request logs are kept for a short period for abuse investigation and then discarded.
• Speed measurements are kept for 30 days.
• The network address kept with a store order (a paid private message, and any boost bought on one, included) stays with that order for as long as the order record does, because it is there to answer a dispute about that order. It is used for nothing else, and it is not joined to the rest of your activity.
• Voice Lab material. A reference recording and the voice model built from it are kept while the voice exists on your account, and are deleted when you delete the voice or your account. The stored audio is erased by a sweep that runs a short time after the deletion rather than in the same instant. The written release you accepted outlives them, and holds no audio — it is the record of what you agreed to and when, kept as the evidence that the voice was permitted.
• The security record described in section 2 is kept for 90 days and then deleted, except that entries relating to a suspected attack, an open investigation, a claim, or a lawful preservation request are kept until that matter ends and are then deleted.
• Backups are encrypted and rotate on their own schedule, so deleted data can persist in a backup for a short window before it ages out.

7. Your rights and choices

Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, object to or restrict how we use it, or receive it in a portable form. You can exercise any of these through the contact form at yellcano.com/contact, choosing “Privacy” and telling us enough to identify your account. We respond within 30 days.

• Disconnect a platform at any time from your settings, or revoke from the provider's own security page.
• Send as a guest if you would rather not have an account at all. A guest can send, pay and track a receipt; a guest send is always anonymous.
• Ask a creator to remove an interaction from their own history; creators control their own page's records.

Deleting your account is how you exercise your right to erasure here. To prevent the same abandoned platform identity from being used to open a new account and claim a second welcome bonus, we keep a record that this platform identity was once used — nothing else about you — after your account is deleted.

If you are in the UK or EEA and you believe we have handled your data improperly, you may complain to your local data protection authority. We would rather you told us first.

8. Cookies and local storage

We use cookies only for things that cannot work without them, and never for advertising or cross-site tracking:

• Session cookies that keep you signed in, and short-lived cookies that bind an in-progress sign-in to the browser that started it.
• Local storage on your own device for conveniences: your recent sends, your favourite voices, and whether you had a panel open. It never leaves your browser, and clearing your browser data clears it.
• Sound preference (yc_sound) and matching local storage: whether the volcano animation's Sound control is on or off, on this site and on the pages a creator's shared link takes you to. It carries only that choice — no identifier — and is never used for advertising or cross-site tracking.

This marketing site sets that one preference cookie and uses matching local storage; it sets no other cookies. Clearing your browser data clears both.

9. Security

How a paid direct message is protected, precisely. Where a creator offers paid messages, your message is encrypted before it is stored, with a key the public part of our service does not hold — so the part of the system that faces the internet can write your message and cannot read it back. This is not end-to-end encryption: we hold a key that can open a message, and we would rather say so than imply a protection we do not offer.

We open one only when the creator has reported it, when the law requires us to, or in the narrow cases the Live Interactions Terms list. Every time we do, we record who opened it, when, why, and which message — before the message is opened, and that record is kept even after the message itself is gone. The creator you wrote to can read your message at any time, because it was addressed to them; that is the ordinary use of the feature and is not recorded as an access.

• All traffic is encrypted in transit.
• Platform credentials are encrypted at rest, with keys held separately from the data.
• The systems that serve the public are separated from the systems that hold creator and operator credentials, so a fault on the public side cannot reach those credentials.
• Stock-voice speech is generated inside our own systems, in an isolated environment that has no internet access; the text of your message is not sent to an outside voice provider.
• Backups are encrypted before they are stored anywhere.

No system is perfectly secure. If you believe you have found a vulnerability, report it through the contact form at yellcano.com/contact, choosing “Security”, and give us a reasonable chance to fix it before disclosing it. Our disclosure policy, including the safe harbour we offer good-faith researchers, is published at https://interact.yellcano.com/.well-known/security.txt.

10. Children

Yellcano is not directed at children. You must be at least 13 years old to use it, and old enough to hold an account on any platform you connect. If you believe a child has given us personal data, tell us through the contact form at yellcano.com/contact and we will delete it.

11. International transfers

The Yellcano service is hosted in Europe, and that is where your data lives. The service providers named in section 5 may process data in other countries; where they do, transfers rely on the safeguards those providers offer, such as standard contractual clauses.

Custom-voice synthesis is the one place a recording of you leaves Europe. As section 5 describes, a short excerpt of the reference recording is sent with each line to a hosted speech provider in the United States, which generates the audio and does not keep the recording afterwards.

12. Changes

We will update this policy when the product changes. The date at the top always reflects the current version. If a change materially affects how we handle your data, we will make that clear in the product rather than relying on you noticing a new date, and where the change requires your agreement we will ask for it.

13. Contact

Yellcano — the contact form at yellcano.com/contact.

That form reaches us for privacy questions, data requests, complaints, and anything about a connected account. We respond within 30 days, and usually much sooner. Copyright, trademark, likeness and voice complaints have their own route: see the Copyright and Takedown Policy and the reporting page.