Privacy Policy

1. Introduction

Calypso ("we", "our", "us") is a sports streaming application for Android. This Privacy Policy explains what information we collect, how we use it, and the rights you have over your data when you use the Calypso app and website.

Calypso uses YouTube API Services. When you connect a YouTube channel, the app uses the YouTube API Services to manage your live broadcasts. By using that feature you agree to be bound by the YouTube Terms of Service. The data Google collects and processes through YouTube is governed by the Google Privacy Policy (http://www.google.com/policies/privacy). Section 4 explains exactly what Calypso accesses through YouTube and how you can revoke it.

2. Information We Collect

• Account information: when you sign up, we collect your email address, display name and authentication identifier through Firebase Authentication.
• Team content: team names, logos and any images you upload are stored in Firebase Storage and Firestore so they can be used during your streams.
• Streaming configuration: RTMP keys and destinations (YouTube, Twitch, custom servers) you configure in the app. Stream keys are stored only to enable broadcasting.
• Usage data: basic technical information such as device model, OS version and crash reports for stability and improvements.

3. How We Use Your Data

• To provide authentication and protect your account.
• To store and serve the team logos and content you upload.
• To deliver your live streams to the platforms you choose.
• To improve app stability, fix bugs and develop new features.

We do not sell your personal information.

4. Google User Data and YouTube

Calypso uses the YouTube API Services. If you connect a YouTube channel, the app uses them to manage your live broadcasts from inside the app. By doing so you agree to be bound by the YouTube Terms of Service, and the data Google processes on its side is governed by the Google Privacy Policy.

What we ask for. A single scope,youtube.force-ssl, which is the narrowest one that allows creating and ending a broadcast. With it the app can:

• read your scheduled broadcasts and the ingestion details the encoder needs;
• create a new broadcast and bind it to a stream key;
• create, rename and delete your own stream keys;
• end the broadcast when the match is over;
• set the broadcast thumbnail, if you choose one.

What we do not do. We do not read or store comments, viewer data, channel analytics or information about your subscribers. We never post anything to your channel that you did not request from within the app. We do not use this data for advertising, and we do not sell it or share it with third parties.

What we store, and where. For each channel you connect we store its identifier, name, profile picture URL and public subscriber count, so the app can list your channels and let you switch between them. The refresh token issued by Google is kept on our backend (Google Cloud Functions and Firestore, hosted in the European Union) and is not accessible from the app or from your device. It is used only to obtain a short-lived access token when you perform an action.

How long we keep it. The channel name, picture and subscriber count are refreshed from YouTube every time you use the YouTube features of the app. If a channel goes 30 days without being used, we revoke our access and delete its token and data automatically; you can reconnect it at any time.

How to revoke access. You can revoke Calypso's access to your YouTube data at any time from the Google security settings page: https://myaccount.google.com/connections?filters=3,4&hl=en. Once revoked, our token stops working immediately, and the next time the app tries to use it we delete the token and the channel data we hold.

How to delete your data. In the app, open Settings → Delete account. This deletes your Calypso account and, within minutes, revokes every YouTube token and deletes all channel data we hold. You can also ask us to delete your data by email (see Contact); we do so within 7 days.

5. How We Protect Your Data

We apply the following measures to every piece of Google user data the app handles, including the YouTube data described above:

• Encryption in transit. All communication between the app, our backend and Google's APIs travels over TLS (HTTPS). The app makes no plain-text connection to our services.
• Encryption at rest. Data is stored in Google Cloud and encrypted at rest by Google Cloud using AES-256 with Google-managed keys. Your account data and any Google token are held in Firestore and Cloud Functions located in the European Union. Images you upload, such as team badges, are stored in a Cloud Storage bucket located in the United States; that transfer is covered by Google Cloud's standard contractual clauses.
• Tokens never reach the device. The Google refresh token is held only on our backend. It is never sent to the app, never written to a log and never included in analytics or crash reports.
• Only genuine installations can reach our backend. The app is protected with Firebase App Check and Google Play Integrity, so requests from modified or forged clients are rejected.
• Least-privilege access. Our backend runs with service accounts scoped to the minimum permissions they need. Administrative access to the Google Cloud and Firebase projects is limited to the developer account, which is protected with two-step verification.
• Deletion. Revoking access from your Google Account, or deleting your Calypso account, deletes the stored token and channel data. Nothing is retained after that for the purpose of accessing your YouTube channel.

If we ever become aware of a security incident affecting your data, we will notify affected users and the competent supervisory authority as required by the GDPR.

6. Limited Use of Google User Data

Calypso's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data to serve advertising, we do not sell it, and we do not allow humans to read it except with your explicit consent, to resolve a support request you have raised, for security purposes, or where required by law.

7. Information Stored on Your Device

The Calypso app stores and accesses information directly on your device, and allows the third-party SDKs listed below to do so:

• Session: Firebase Authentication keeps your sign-in session on the device so you stay logged in.
• App settings: your stream, camera, language and overlay preferences, stored in the app's private storage.
• Cached content: team badges and images used in overlays, and any recording you choose to save.
• Identifiers set by SDKs: Firebase (installation ID, App Check and Crashlytics), Google Play Integrity and RevenueCat (an anonymous purchase identifier) store identifiers on the device to protect the service, report crashes and restore purchases.

No YouTube token is ever stored on your device. This website does not use cookies for advertising or tracking; it uses Vercel Analytics, which is cookieless, and the Firebase SDK only when you submit the waitlist form. Uninstalling the app removes everything it stored on the device.

8. Third-Party Services

Calypso relies on the following providers:

• Google Firebase (Authentication, Firestore, Storage, Cloud Functions, Crashlytics, App Check), see the Google Privacy Policy.
• YouTube API Services, when you connect a YouTube channel (see section 4).
• RevenueCat, to process and restore subscriptions purchased through Google Play.
• YouTube, Twitch and other RTMP destinations only when you connect them; their own terms and privacy policies apply.

9. Data Retention and Deletion

Account data and uploaded content are kept while your account is active. You can delete your team content at any time from within the app. To delete your account and all related data, use Settings → Delete account in the app, or write to us at the email below; we complete deletion within 7 days. YouTube data follows the retention rules in section 4.

10. Your Rights

You have the right to access, correct, export or delete your personal data, and to withdraw consent at any time. To exercise these rights, email us at the address below.

11. Children's Privacy

Calypso is not directed to children under 13. We do not knowingly collect personal data from children under 13.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The date at the top of this page indicates when it was last revised. Continued use of the app after changes means you accept the updated policy.

13. Contact

For any privacy-related question, write to calypso.sport.stream@gmail.com.