Privacy policy
Updated 9 October 2026
1. Controller and contact
PEXTO s.r.o., company ID 24831981, Počernická 272/96, 108 00 Prague, Czech Republic (Prague Municipal Court, C 178450), provides Sport Stream Studio under the Pexto Entertainment brand. For privacy requests, email developer@pexto.cz. There is no separate Sport Stream Studio account required for local match setup; connected platform accounts and purchase verification are optional according to the feature used.
2. Camera, files and local settings
Camera and microphone data are processed on the device for capture, graphics, stabilization and replay. Team settings, selected logos and sponsor images are stored locally. Only selected images are imported. The rolling replay buffer holds up to approximately 40 seconds; temporary recordings are replaced or cleared as capture is reset. Files you explicitly export remain until you remove them. Preview alone does not publish video. After you start a stream, the chosen destination receives the program picture, audio and its stream key.
3. Google / YouTube: use and recipients
Optional Google authorization and YouTube API Services access account identifiers, email where provided, channel name/ID/avatar, authorization credentials and broadcast information. They are used to connect the channel, list/create/manage broadcasts, obtain its stream key, upload a selected cover image, and check or change broadcast status. Google/YouTube receives the authorization and API requests and, when streaming starts, video and audio. The audience you select can see published content; sharing a link sends a video identifier to the chosen recipients, not OAuth tokens or stream keys. A custom RTMPS destination receives only its stream key and program media, not Google account credentials. For Android browser sign-in, PEXTO’s server hosted by WEDOS/VEDOS exchanges a one-time code for Google tokens and stores them encrypted for one-time retrieval, valid for up to two minutes; retrieval deletes them. Expired records are removed during subsequent sign-ins. The refresh token is then stored on the device encrypted with Android Keystore. To renew access, the server forwards that token to Google and returns a new access token without persistent storage. Technical IP fingerprints limit abuse. Google passwords, video, audio, channel details and stream keys do not pass through this sign-in server. Android PRO-MO identity verification is a separate optional flow described below. Read Google’s Privacy Policy and YouTube’s Terms.
4. Google data sharing and Limited Use
Google user data is not sold, rented, shared with advertisers or data brokers, or used for targeted advertising, credit scoring, surveillance or training general-purpose AI. Our use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including Limited Use. PEXTO and its email provider receive information you voluntarily send for support, only for handling that request. People do not routinely read device-only Google data. Access is limited to your explicit support authorization or necessary security/legal cases permitted by Limited Use. Data actually held may be disclosed where legally required or necessary to address abuse. Transfer of Google user data in a merger or asset sale would require prior explicit consent.
5. Facebook / Meta and deletion
Optional Facebook Login for Business accesses tokens, available Page IDs/names and broadcast details to let you select a Page and manage its live video. We do not receive your Facebook password. A PEXTO server on WEDOS/VEDOS exchanges the one-time authorization code and holds the resulting token encrypted for one-time retrieval for up to two minutes. Retrieval deletes it; expired records are cleaned up on subsequent sign-ins. IP-related technical data supports abuse prevention. Your device then communicates with Meta directly, including sending the stream and title. Video never passes through this login server. Facebook tokens are stored in the iOS Keychain or encrypted with an Android Keystore-protected key. We do not sell Facebook data or use it for targeted ads. See Meta’s Privacy Policy. To remove the local connection, stop the broadcast and choose Disconnect in Facebook settings in the app. Revoke access in Facebook Business integrations or Apps and websites. Published videos must be removed on Facebook itself.
6. Remote match control
The optional Remote service sends operator names, temporary pairing credentials, scoreboard state, sponsor names/display settings and control commands through PEXTO’s WEDOS/VEDOS hosting. The broadcasting device approves controllers. Remote does not receive camera video, audio, social-account credentials or stream keys. Sessions expire within six hours; stopping Remote revokes access. Expired session files are removed by subsequent cleanup. Short-lived IP hashes and technical request data limit abuse. The web controller keeps session credentials in memory, not persistent browser storage.
7. Purchases and PRO-MO
Apple processes iOS purchases. Google Play processes Android purchases; the app sends the product ID and purchase token to PEXTO’s WEDOS/VEDOS backend, which verifies and acknowledges purchases through Google Play Developer API. We receive no card numbers or bank credentials. For optional Android PRO-MO redemption, the backend receives the code and a short-lived Google authorization token, verifies it with Google, and keeps a keyed one-way account-ID hash (HMAC), code, activation and expiry. The authorization token is not kept in the promo ledger. Minimal redemption records may remain after expiry while needed to prevent repeated one-use claims. These data are shared only with PEXTO, its hosting provider and Google for verification, access restoration and fraud prevention. Apple and Google retain their own transaction records. iOS verifies signed StoreKit transactions and checks trusted server time for time-limited access.
8. Disconnecting and retention
Disconnect YouTube or Facebook in the app’s destination settings to remove the local connection. You may also revoke Google access at Google account permissions; iOS requests Google revocation during disconnect. Android stores the channel connection encrypted until disconnection or revocation. Disconnecting does not delete provider-hosted videos, broadcasts or purchases. Keychain records may survive uninstalling on iOS, so disconnect first. Local files remain until changed or removed on the device. For identifiable PEXTO-held data, contact developer@pexto.cz and specify the relevant support, Remote or PRO-MO use without sending passwords or tokens. We delete data no longer needed and explain any minimum records retained for legal obligations, claims or fraud prevention.
9. Website, support and legal grounds
The website uses WEDOS/VEDOS hosting and security services. IP address, requested page, time and browser information are processed for delivery and protection; necessary security mechanisms or cookies may be used. We add no advertising trackers or analytics SDKs. Support email includes your address, message and attachments and is retained while needed for support, complaints, claims or legal duties. Contract performance is the basis for requested services (GDPR 6(1)(b)); legitimate interests cover security and claims (6(1)(f)); legal obligations use 6(1)(c). Permissions or consent can be withdrawn where relevant. Recipients are the providers identified above, your chosen stream destination/audience and email/hosting providers. International providers may process data outside the EEA using the safeguards described in their policies, including standard contractual clauses.
10. Your rights and changes
Under applicable conditions you can request access, correction, deletion, restriction or portability and object to processing based on legitimate interests. You can withdraw consent where processing relies on it. We normally respond within one month, subject to lawful extensions. You may complain to the Czech data protection authority or your local authority. We do not make solely automated decisions with legal or similarly significant effects. Broadcasters must respect participants’ rights, especially when filming children, and choose the correct audience setting. Material changes to this policy will be communicated appropriately.