Your stream content stays where you are: on your PC.

01Who’s responsible

The party responsible for the processing described here — the “controller”, in the language of Brazil’s General Data Protection Law (Lei nº 13.709/2018, the LGPD) — is PCL DE SOUZA TECNOLOGIA, registered under CNPJ no. 44.638.580/0001-12, which operates this website and the sign-in API.

The Corneta software is distributed under the MIT licence and its copyright belongs to Petro Cardoso, the project’s author. Authorship of the code and operation of the service are separate things: the company above is who answers for the data processed here.

For any privacy matter, including exercising your rights, the channel for data subjects is corneta@pitrol.dev.

In plain terms: the company is small enough that the law waives the formal “data protection officer” role, as long as there’s an open channel to you — which is the email above. That’s set out in ANPD Resolution CD/ANPD nº 2/2022. If an officer is ever appointed, their name will appear here.

02What this policy covers

This policy covers three distinct things, and the difference matters:

• This website — the public pages that present Corneta and offer the download.
• The sign-in API — a minimal service on this same domain that helps the app finish the Kick sign-in and find out which sign-in providers are available.
• The Corneta app — the program you install on Windows and that runs on your machine.

We don’t cover the streaming platforms (Twitch, YouTube, Kick, Facebook and others), the alert aggregators (Streamlabs, StreamElements) or OBS. Each has its own policy, and it’s with them that you deal about the data under their care.

03The principle: Corneta is local

Corneta was built to distribute your stream from your computer, without routing the video through a cloud of our own. That isn’t a marketing promise: it’s the architecture. Video leaves OBS, enters Corneta and goes straight from your machine to each destination platform.

As a result, we don’t receive your video, your audio, your stream keys, your chat, your alerts or your reports. There’s no dashboard of ours where that data shows up, because it never reaches us.

In the app, usage data requires your explicit activation, separate from accepting the terms. Without a previous choice, this purpose is off. Crash reports start on without a previous choice and can be turned off. The intended basis for usage data is consent (art. 7º, I); for crash reports, the proposed basis is legitimate interest (art. 7º, IX), subject to the controller’s assessment, not automatic approval by the software. You can withdraw usage activation or object to crash reporting in Settings without losing Corneta features. Your previous choices are kept; closing the notice does not enable usage data. A random installation UUID is created on first use with an active purpose. Turning both off stops new events but does not delete data already received by the processor. Copy the UUID before regenerating it or restarting the app with both purposes off if you want to request deletion. You can verify this behaviour in the source code.

04Data on the website

This site has no sign-up form, newsletter, support chat, advertising pixel or user profile. Its fonts are served by the site itself, so your visit generates no request to third-party font services.

We use PostHog in cookieless mode to measure only the route and language visited, which download button was used and redacted technical failures, together with the environment and build version. We do not collect query strings, URL fragments, visible text, typed fields, session replay, heatmaps, autocapture or network performance. The browser receives no persistent analytics identifier, we create no person profile and we do not connect the visit to the app’s optional installation UUID.

The connection reveals the IP address to the provider in transit, as every internet request does, but the project is configured to discard it at ingestion and not use geolocation. We honour Do Not Track and Global Privacy Control. You can also stop new metrics at any time through the control in section 16.

As with any website, the server that delivers it records technical access data — IP address, date and time, page requested, response code and browser information. Those records are generated and kept by the hosting provider, Vercel Inc., acting as a processor, and serve to deliver the site, keep it secure and diagnose failures.

The download button points to the installer. When you download it, the provider hosting the file may record the same kind of technical access data.

05Data in the sign-in API

For you to sign in with your account and use chat, alerts and automatic broadcast creation, the app needs to complete a sign-in (OAuth) flow with each platform. Two of the three platforms talk directly to your computer; only Kick requires a server secret, and that’s why it comes through here.

What this API does not do

• It doesn’t store tokens. The code and the tokens exist only in memory during the request and go on to your app, which keeps them in your system’s vault. There’s no database, file or cache holding those values.
• It doesn’t create accounts or sessions. There’s no sign-up, no website login, no session cookie and no user profile.
• It doesn’t log request contents. When an unexpected failure happens, the server may send PostHog only a random request identifier, categorised route and provider, error code, response class and a duration bucket. An unexpected failure includes a redacted type and stack. Request bodies, platform responses, query strings, tokens and authentication headers never enter that event. The telemetry UUID and operation identifier accompany a request only when the app has the corresponding purpose active; otherwise, correlation is ephemeral and limited to that request.

Abuse protection

To reduce abuse, each server instance limits attempts based on the IP to 20 code exchanges and 60 token refreshes per 60-second window. Counters are not shared between instances. In the limiter’s memory, the key is an identifier derived from the IP with a temporary secret (HMAC), not the IP itself. The limiter neither persists these counters nor sends them to a remote database; hosting access logs are handled separately.

Twitch sign-in uses the device code flow and YouTube uses PKCE straight with Google. In both of those cases, no sign-in data passes through our servers.

06Data on your computer

The app keeps, on your machine, what it needs to do its job. None of the content described below is sent to us. Only the technical data expressly listed further down may be sent when collection is configured and the corresponding purpose is active. Before a choice on first use, only crash reports and their minimal startup marker may be sent, never usage data.

• Stream keys and access tokens live in the operating system’s credential vault (on Windows, Credential Manager). The config file stores only the fact that a key exists, never the key.
• Settings — destinations, per-platform quality, preferences, profiles, stream title — live in a local config file that you can export and import whenever you want.
• Chat, alerts and viewer counts arrive from the platforms straight to your app and are shown in the interface. The history is not sent to any server of ours.
• Post-stream reports — stability, audience, chat rate, alerts, marked moments — are written to local files.
• Stream recording— off by default. If you turn it on, the app saves the video that went out (and, as a separate option, chat messages along with the name of whoever wrote them) as files in the folder you pick, on your computer. None of it is sent to us or anywhere else. Other people’s messages that you choose to record are your responsibility: you decide how long to keep them, and you can delete them at any time from the report itself or from the folder.
• Support diagnostics — if you request an export, the app generates a file containing only a structured technical summary and allowlisted operational events. It does not include raw logs, channel or destination names, titles, paths, URLs or credentials. Logs can be opened separately on your computer; you decide whether and to whom to send the diagnostic file.
• Telemetry with independent controls — “usage data” sends only after explicit activation: version, language, categorised system family, architecture and GPU, operation stages and outcomes, enumerated platforms, destination count and bucketed durations. “Crash reports” may send the error code and stage, type, redacted stack and random error/operation identifiers, plus a minimal startup marker with the version and whether the previous exit was clean, to contextualise failures without enabling usage metrics. Without a previous choice, usage is off and crash reports are on. Enabling usage does not send events from before activation, including onboarding stages. Previous explicit choices, on or off, are preserved when the notice changes. Even when active, we never send video, audio, chat, alerts, stream title, channel, keys, tokens, RTMP URL, hostname, full local path, raw logs or configuration.
• Telemetry preference and UUID — these live in a separate local file that does not travel with configuration exports or imports. The UUID is created on first use with an active purpose, including before a choice on first use if crash reports are active. This does not enable usage data. Turning both off stops new events and clears SDK persistence. The ID remains available in the current session so you can copy it and request deletion of previous events; copy it before restarting or regenerating it. Regenerating the ID does not delete data held by the processor.
• The OBS overlay — when on, the app starts a server that answers only on your computer (127.0.0.1), so OBS can read alerts and chat as a Browser Source. It is not exposed to the internet.
• Your acceptance of these documents — the date and version of the terms you saw on the welcome screen are kept locally, only so the app knows when it needs to tell you again. That record doesn’t travel with the config export and is never sent to us.

Without a valid token or host, or with the build telemetry kill switch active, the app does not send these events. Telemetry network failures do not prevent using the app or starting and ending a stream; events may be lost. Turning collection off does not undo a request already in flight.

Uninstalling the app does not guarantee removal of credentials or all local data. Before uninstalling, disconnect your accounts in Corneta and revoke access on the platforms. To check remaining credentials, open Windows Credential Manager and remove only entries identified as Corneta (service br.com.pitroldev.corneta); do not delete other apps’ credentials. If the app reports a failure when disconnecting, cleanup may be incomplete.

Settings, reports, recordings and exported copies are separate data: review the locations you use before removing them. Telemetry events sent before then follow the period in section 11; to request earlier deletion, note the UUID shown in Settings before removing local data and use the channel in section 13.

07Legal bases

For the few processing activities we carry out, the LGPD legal bases are:

• Performance of a contract (art. 7º, V) — processing Kick’s code and tokens is what lets us deliver the sign-in feature you asked for when you clicked sign in.
• Legitimate interest (art. 7º, IX) — technical access records, the per-IP limit, API failure diagnostics and strictly aggregate cookieless site metrics exist to keep the service available, secure and understandable, at the minimum needed for those purposes. The site offers a direct opt-out and honours browser privacy signals.
• Consent for usage data (art. 7º, I) — this purpose sends only after explicit activation and can be turned off at any time without affecting Corneta features. It helps understand usage stages and outcomes to guide improvements. We do not recover events from before activation. Accepting the terms or closing the notice does not replace this choice.
• Legitimate interest for crash reports (art. 7º, IX) — the proposed basis for automatic failure reporting is to find defects and guide fixes. Without a previous choice, this purpose starts on. Processing must be limited to what is necessary (art. 10, §1): a closed list of technical properties, no stream content, no geolocation, and no request for an identified profile. You can object to crash reporting at any time in Settings (art. 18, §2), with immediate effect and without affecting how Corneta works. The draft balancing assessment is published in the repository; the suitability of the legal basis depends on legal review, not on the existence of the switch.
• Compliance with a legal or regulatory obligation (art. 7º, II) — where keeping access records is required by law.

08Google and YouTube data

If you connect your YouTube account, Corneta asks for the “manage your YouTube account” permission (the https://www.googleapis.com/auth/youtube scope). It is used exclusively to:

• Create and end your live broadcast, get the matching stream key and set the title you typed into the app, so you don’t have to open YouTube Studio for every stream. The title change affects only the broadcast in progress — no video already published on your channel is modified.
• Read and send live chat messages, which is what makes unified chat and replying from the app possible.
• Read the viewer count of the broadcast in progress, to show your combined audience.

This data is requested by the app installed on your machine, directly from Google, and stays there. YouTube sign-in uses the official PKCE flow for installed apps and does not pass through our servers: not the authorisation code, not the token, not the refresh. The tokens are kept in the Windows credential vault.

Limited Use

Corneta’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In practice, that means Corneta:

• does not transfer Google data to third parties, except as needed to provide the very feature you asked for or where required by law;
• does not use that data for advertising, profiling or sale;
• does not use that data to train artificial intelligence models, generalised or not;
• does not allow humans to read that data, except with your explicit consent, for security purposes, to comply with the law, or over aggregated and anonymised data.

You can revoke access at any time at myaccount.google.com/permissions. Revoking platform access and deleting local credentials are separate actions. Also disconnect the account in Corneta; uninstalling does not guarantee that vault entries are deleted. See section 6 for local cleanup guidance.

09Third parties and the app’s connections

We don’t sell, rent or share data with third parties for advertising — we have no ads, no data sponsor and no marketing partnership. What does exist are connections your computer makes for the app to work. They leave your machine, not ours:

• Destination platforms — the video ingest servers (RTMP/RTMPS) your stream is sent to.
• Platform APIs — Twitch, YouTube/Google and Kick, for sign-in, chat, viewer counts, alerts and broadcast creation.
• Emote services — BetterTTV, FrankerFaceZ and 7TV, to show chat emotes, plus the platforms’ own image CDNs.
• Alert aggregators — Streamlabs and StreamElements, only if you set those sources up; the token stays in your vault.
• Speed test — the upload meter sends throwaway data to a public Cloudflare endpoint (speed.cloudflare.com) to estimate your bandwidth. None of your content is transmitted in that test.

On our side, the processors are the hosting provider for the site and API, named above, and PostHog Inc.. PostHog receives only the technical events and redacted exceptions described in this policy, for product metrics, operations and diagnosis; it does not receive your stream content and is not used for advertising.

10International transfers

The site and the API are hosted on Vercel Inc., a company based in the United States, which may process requests on servers outside Brazil. Telemetry is processed by PostHog Cloud US, in Virginia, United States. The streaming platforms, alert aggregators and emote services named above also operate abroad.

When you use those features, the data needed for the communication travels internationally, per each service’s policies and per arts. 33 and following of the LGPD. None of your stream’s content passes through those servers: the video leaves your machine straight for each platform.

11How long we keep things

12Security

We take technical measures proportional to what the service does: sensitive credentials live in the operating system’s vault instead of text files; API responses are not cached; request size is capped; sign-in return addresses are validated against a fixed list; and there’s a per-IP attempt limit. The OBS overlay answers only on the local address. Before every telemetry event, a closed property list and a redactor remove secrets, free text, URL parameters and local paths; an event outside the schema is dropped.

No system is infallible. If we identify a security incident with relevant risk, we will notify the data subjects and Brazil’s National Data Protection Authority (Autoridade Nacional de Proteção de Dados, ANPD) as the law requires.

Found a flaw? Talk to us at corneta@pitrol.dev before disclosing it publicly. We reply, and we credit whoever reports.

13Your rights

The LGPD grants you, among others, the right to confirm that processing exists, access the data, correct incomplete or outdated data, request anonymisation, blocking or deletion of unnecessary data, request portability, obtain information about sharing, withdraw consent and object to processing based on legitimate interest.

To exercise any of them, write to corneta@pitrol.dev. We’ll answer within the statutory deadline. Since we keep no account, most data concerning you is already under your direct control. For telemetry sent by the app, include the UUID you can copy from Settings so we can locate and delete the events. Cookieless site telemetry creates no persistent identifier with which to isolate a past visit; the control below prevents new sends in this browser.

14Your viewers’ data

When you use chat and alerts, your computer receives other people’s data: nicknames, messages, donation amounts, subscription notices. That data arrives from the platforms straight to your app and does not pass through us.

For that processing, you’re the one deciding what to do with the data — including whether it shows up in the overlay inside your stream. We recommend care when displaying the name and amount of whoever supports you, and care when sharing recordings and screenshots.

15Children and teenagers

Corneta is a production tool for people who stream live and is not directed at children. Streaming platforms have their own minimum age, and your use must respect it. If you’re a teenager, use the app with the knowledge and assistance of whoever is responsible for you.

16Cookies and local preferences

PostHog runs in cookieless mode: it writes no analytics cookie or persistent analytics identifier, performs no fingerprinting and creates no person profile. One functional cookie, corneta.locale, stores your language choice for up to one year.

If you turn metrics off, the browser stores only the value “disabled” under the corneta:site-telemetry:v1 local-storage key. That preference is not sent to PostHog. Do Not Track and Global Privacy Control also keep capture off. Because there is no advertising or analytics cookie, we provide the direct control below instead of a cookie banner.

17Changes to this policy

If the product changes in a way that alters data processing — say, if one day there’s an optional feature that depends on a server — this policy will be updated before that change reaches you, with a new revision date at the top of the page. The current version is September 9, 2026.

The Terms of use complement this policy and explain the rules for using the software and the sign-in service.