Privacy Policy

Information OverlayHub accesses

When you authorize a YouTube connection, OverlayHub requests the Google OAuth permission https://www.googleapis.com/auth/youtube.readonly. It receives an access token and, when Google issues one for offline access, a refresh token. It uses the permission to identify the connected YouTube channel and obtain relevant live broadcast, live chat, subscriber, and related stream activity. This may include channel identifiers and names; broadcast identifiers and status; chat messages, author names and identifiers, timestamps, subscription identifiers and dates, and platform-provided event details. Viewers' public live chat content may appear in your OBS overlay and local moderation view.

If you also connect other supported services, OverlayHub processes comparable account and live chat information needed for their respective integrations. Google access is optional until you connect YouTube.

How the information is used

OverlayHub uses connected account data to authenticate the integration, find the relevant live broadcast and chat, display activity in the overlay and local control page, and support local moderation actions. The refresh token lets the app request a new access token when the old one expires, so you can reconnect without repeating the browser authorization on every launch. The app does not use Google user data for advertising or sell it. The YouTube integration requests read-only access; it does not post to YouTube or change your channel settings.

Storage and sharing

OverlayHub stores the YouTube access token, refresh token, and token expiration time in a local configuration file on the streamer's Windows computer: %LOCALAPPDATA%\OverlayHub\Plugins\YouTube\Config\youtube-config.json. Access and refresh token values, and any local OAuth client secret, are encrypted using the Windows Data Protection API (DPAPI) with the current Windows user account before they are written to this file. This protects these credential values, not every field in the configuration file or every file saved by OverlayHub. On the next launch after this security update, OverlayHub reads an existing configuration and rewrites those values encrypted so the connected account can remain signed in. The encrypted values can be read only under the same Windows account; using another Windows account or computer may require connecting YouTube again. A hosted authorization service processes the authorization code and token refresh requests, using the app's client credentials to exchange data with Google's OAuth service and return tokens to the desktop app. The desktop app calls YouTube APIs to provide the integration. Communication with Google and the hosted authorization service uses HTTPS. The OAuth browser callback uses a loopback address on the local computer to return the authorization result to the desktop app; it is not a public callback server.

OverlayHub also saves a local subscriber state file at %LOCALAPPDATA%\OverlayHub\Plugins\YouTube\Data\subscribers.json. It records known subscriber identifiers, channel names, subscription dates, and when they were first observed so the app can recognize new subscriber activity. OverlayHub also saves viewer records and activity statistics, including YouTube-related records, in the shared local chatter registry at %LOCALAPPDATA%\OverlayHub\chatters.json. This data supports viewer recognition and engagement features. The subscriber state and chatter registry are not encrypted by the credential DPAPI mechanism. During a session, OverlayHub processes live messages and keeps recent entries available in the local moderation view. When you show an OBS overlay or broadcast it, visible chat content may be seen by your audience and by the streaming platforms you use. OverlayHub does not share Google user data with data brokers or advertisers.

The website is hosted by a third-party provider, which may process IP addresses, browser and request details, and technical logs needed to serve and secure the site. Community sign-in is handled by OpenAI; its authentication process may use browser cookies. The site uses account information from that sign-in to run the forum; the sign-in provider handles its own authentication data under its policies. Downloading the desktop app from the website does not require Google account authorization; YouTube authorization happens when you connect that integration in the app.

Retention and your choices

Live chat entries displayed in the overlay are temporary; the local moderation view keeps a recent in-session history. Locally saved YouTube credentials, subscriber state, and chatter records remain on your computer until their files are removed. To remove these saved records, close OverlayHub and delete the following files:

• %LOCALAPPDATA%\OverlayHub\Plugins\YouTube\Config\youtube-config.json — YouTube connection credentials and configuration.
• %LOCALAPPDATA%\OverlayHub\Plugins\YouTube\Data\subscribers.json — saved YouTube subscriber state.
• %LOCALAPPDATA%\OverlayHub\chatters.json — shared viewer records and activity statistics, including YouTube records.

Deleting only the YouTube configuration and subscriber files does not remove YouTube records from the chatter registry. Deleting chatters.json also removes saved viewer records and activity statistics for other platforms. If you reconnect and use OverlayHub again, the app may create new local records. You can separately revoke OverlayHub's Google access at Google security settings. Revoking access stops future authorized API requests. Revocation alone does not erase the local subscriber state or chatter registry, or chat content already included in a recorded or live broadcast. Remove the local files as described above as well as revoking access if you want to stop access and clear these saved records. If you need help removing local data or want to request deletion of data associated with your YouTube connection, contact the support address below. Deleting data in OverlayHub does not delete content stored by YouTube. Platform operators may retain data under their own policies.

Discord updates feed

The Updates page is prepared to display posts from a designated OverlayHub Discord announcements channel. When connected, a read-only bot retrieves message text, public author names, message identifiers and dates, and attachment links to display those updates publicly without requiring Discord sign-in. The site temporarily caches the feed for about five minutes; edited or deleted messages are reflected when the feed is refreshed. Images hosted by Discord are loaded by your browser, which may send Discord technical information such as your IP address and browser details. Discord handles information under its Privacy Policy.

Active client reporting

OverlayHub can send a small HTTPS heartbeat once a minute while the app is open, including when minimized. It contains a random installation identifier and the app version, not your platform account, viewer records, messages, credentials, or computer name. The website hashes the identifier and uses its own receipt time to count installations seen within three minutes. Administrators and moderators see aggregate active-client and download totals only. Expired entries are excluded immediately and removed as new reports arrive; this is not a permanent usage history. A separate Share live channel status option is off by default and can operate independently. When enabled, the client also sends platform names and consistent SHA-256 keys derived from the authenticated channel IDs for currently live connections. Raw channel IDs, channel names, credentials, chat, and stream titles are not sent by this option. These keys are pseudonymous, not anonymous: someone with a candidate public channel ID may be able to match its key. The keys deduplicate live-channel totals across installations; staff see aggregate totals only. This does not publicly list a stream. Live reports expire after three minutes and are removed as new reports arrive, without a retained channel-history feature. Turn off Report active client in desktop Settings to stop future reports. Turn off Share live channel status separately to stop live reporting. Your installation drops out of the active total within three minutes. The hosting provider may process technical request details as described above.

Website visit counting

The website counts anonymous browser-tab visits for staff activity statistics. A random identifier and the most recent page-navigation time are kept in your browser’s session storage. A new tab or 30 minutes without page navigation starts another visit. The website stores the random visit identifier and the time it was first counted; it does not attach your name, email, account identifier, IP address, or visited page to the counter. No tracking cookie or persistent browser identifier is used. Session storage is cleared when the browser ends the tab session, subject to browser session-restoration behavior. Counter records remain while the counter operates. These figures are visit sessions, not unique people; browsers that block JavaScript or storage may not be counted. Hosting providers may process technical requests as described above.

Download counting

When the Download page finishes preparing a complete ZIP package and hands it to your browser, the website records a random event identifier, the app version, and the time. These records are used to calculate a download total visible only to authorized staff with activity permission. The counter does not store your name, email, account identifier, or IP address and does not use tracking cookies. Repeat downloads count separately, and automatic app updates are excluded. Counter records remain while the counter operates. The hosting provider may still process technical request information as described above.

Embedded video

The Home page includes a YouTube video player in privacy-enhanced mode. When the player loads or you play the video, your browser connects to YouTube, which may process device, browser, and viewing information under the Google Privacy Policy. You can use the site and written setup steps without playing the video.

The Live streams page includes inline players from Twitch, Kick, and YouTube. Players may load as you browse the page and connect your browser directly to the relevant platform; the player may process technical request details, device information, cookies, viewing activity, and any account session you have with that platform. Previews do not autoplay. Playback and availability follow the streamer’s settings and platform restrictions. Leaving the page or removal of a listing removes its player. TikTok listings open TikTok rather than loading a live player here. See the Twitch Privacy Notice, Kick Privacy Policy, and Google Privacy Policy.

Community forum

Anyone can read approved community topics and replies. Posting requires Sign in with ChatGPT. The site receives a stable account identifier, email address, and optional name from that sign-in. Members choose a unique public display name; their email address is not shown publicly. We store the display name, avatar color or uploaded avatar image, optional signature, posts, replies, votes, reports, account role, moderation status, and recent moderator activity needed to run the forum. Moderators active within the last ten minutes may be listed by display name. Approved posts, images, signatures, and linked sources are public. First posts, image posts, and posts flagged by basic automated checks wait for review; other text posts may appear immediately. These checks are limited and do not make a determination about the truth or legality of a post. Members can report content for staff review.

Uploaded post and avatar images are stored with our hosting provider. Approved post images and member avatars may be publicly visible; images awaiting post approval are available to staff for review. Avatars may appear on public profiles and beside approved posts. Reports and moderation notes are visible to authorized staff, not other members. The site also stores custom role definitions, member role assignments, and staff action records containing the staff account identifier and display name, action, affected item or member, relevant details or reason, and time. Staff permissions determine access to these private tools and records. Action records are retained while the staff system operates for accountability and abuse resolution. We keep forum profiles and content while the forum operates, unless removed by moderation or following a deletion request sent to OverlayHubSupport@gmail.com. Archived posts are hidden from public discussion but may remain available to moderators. Deleting a post removes its associated uploaded image. ChatGPT sign-in is governed by OpenAI’s own terms and privacy practices.

Feedback and notifications

The Feedback page accepts messages without sign-in. We store the category, subject, message, and any name or reply email you choose to provide so staff can review and respond. Reports, feedback, and forum submissions awaiting approval also create notification records in the staff inbox. We send notification emails to OverlayHubSupport@gmail.com using Resend. Depending on the event, these emails include the feedback text and optional reply address, the reported content, or a preview and direct review link for a pending post. Resend and the support mailbox process those details to deliver and receive the email. Feedback and notification records remain in our staff systems for follow-up and moderation until removed; they are not displayed publicly. To request access to or deletion of your feedback or forum data, contact the support address. Some records may be retained where needed to resolve abuse, disputes, or legal obligations.

Supporting OverlayHub through Ko-fi

The Support page opens Ko-fi in a new tab. If you choose to tip the developer, Ko-fi handles the support flow and the connected payment provider, currently Stripe, processes payment. OverlayHub does not collect payment card information on this website. Ko-fi shares your supporter name or display name and email address with the creator; a message is shared if you provide one, and a public message may appear on the Ko-fi page unless you choose a private message. Stripe may provide the creator with payment details such as your name, email, and part of your billing address. The developer may use supporter and transaction details received through Ko-fi or Stripe to acknowledge support, respond to questions, and keep necessary payment records. These records are separate from the OverlayHub website’s feedback and community systems. For questions about information held by the developer, contact OverlayHub support. See Ko-fi’s Privacy Policy and Stripe’s Privacy Policy before supporting.

Optional public stream listings

If you connect your OverlayHub.studio account and select Display On OverlayHub in the desktop app, we receive your platform, authenticated channel identifier, channel name, channel link, and recent live status. Your channel name, platform, link, and website display name appear publicly while fresh reports arrive. This option is separate from private activity totals and is off by default. Public entries expire after three minutes without fresh reports. Turning display off or signing out of the app removes the listing when the website receives the request; otherwise it expires. Website sign-out alone does not disconnect installations. Manage or revoke desktop connections at /connect/. Connections expire after 30 days. The desktop credential is protected with Windows DPAPI; the website stores a hash. Short-lived linking records expire after ten minutes. Public listing records may remain for staff review after going offline until cleared by the client or removed by staff. Listing restrictions and staff audit records may remain to prevent abuse, including after reconnecting. Contact support for deletion requests. No extra platform ownership verification is required; live status and channel details are client-reported. Never approve a connection code sent by someone else.

Security

OverlayHub uses OAuth to request access rather than asking for your Google password. OverlayHub protects locally stored YouTube access tokens, refresh tokens, and any local OAuth client secret using Windows Data Protection API (DPAPI) encryption tied to the current Windows user account. Google and hosted authorization service connections use HTTPS in transit; the browser callback remains on the local computer. Other local data, including subscriber state and the chatter registry, is not encrypted by this credential protection mechanism. Protect your Windows account and device: software running as that account may be able to access the decrypted values while the app uses them. A copied encrypted configuration may not work under another account or on another computer. Access tokens expire, while refresh tokens may continue to work until revoked or invalidated. No system can guarantee absolute security.

Google and YouTube

OverlayHub uses YouTube API Services. By using the YouTube integration, you are also subject to the YouTube Terms of Service and Google Privacy Policy. Google permissions are requested through its consent screen and can be reviewed or revoked in your Google Account.

Updates and contact

We may update this policy when OverlayHub's features or data practices change. The effective date above will change when a revised version is published. For privacy questions or requests concerning your own OverlayHub installation, email OverlayHubSupport@gmail.com.