Privacy Policy
This notice explains how NekoSuneVR, operator of the official CastNexus hosted OAuth service (referred to as “CastNexus”, “we”, “us” or “our”), handles personal information. It applies to the public service at castnexus.nekosunevr.co.uk. Independently operated, self-hosted CastNexus installations are controlled by their respective operators, not by us, except when they communicate with this hosted service.
1. Who is responsible
NekoSuneVR is the controller for personal information processed by the official hosted OAuth service. Privacy questions and data-rights requests may be submitted through the CastNexus contact and issue page. Please do not include passwords, access tokens, stream keys or other secrets in a public issue; request a private contact route where necessary.
2. Information we process
| Information | Purpose |
|---|---|
| OAuth transaction identifier, PKCE challenge, signed state, provider choice, status and timestamps | Complete and secure the connection requested by your CastNexus installation. |
| Twitch user ID, login, display name and profile image URL | Identify the Twitch account to your installation and issue a limited CastNexus broker credential. |
| Google/YouTube OAuth access and refresh tokens and granted scope | Return the authorisation once to your installation and refresh short-lived YouTube access when your installation requests it. |
| Network and security information, such as IP address, request time, user agent and failed-request indicators | Operate, rate-limit, secure and investigate abuse of the public service. |
| Messages you send when requesting support or exercising rights | Respond to you and maintain necessary support records. |
We do not request your Twitch or Google password. Provider login pages are operated by Twitch or Google. The YouTube integration requests the youtube.upload scope so a user can upload a recording they select from their own CastNexus installation.
3. How information is used
- Authenticate and connect the account you selected.
- Provide Twitch stream and video discovery needed by CastNexus.
- Refresh a YouTube access token when your installation presents its encrypted-at-rest refresh token.
- Prevent replay, open redirects, automated abuse and attacks.
- Diagnose faults and comply with legal obligations.
We do not sell personal information, use Google user data for advertising, or use provider data to train general-purpose AI models.
4. Lawful bases under UK data-protection law
- Contract: processing necessary to provide the OAuth connection and related CastNexus features you request.
- Legitimate interests: securing, monitoring, maintaining and improving the service, preventing fraud and abuse, and supporting users. We consider these uses proportionate and expected for an internet authentication service.
- Legal obligation: where processing is necessary to comply with applicable law.
- Consent: provider access is granted through the Twitch or Google consent screen and may be withdrawn through provider settings or CastNexus disconnect controls.
Your right to object: you may object to processing based on legitimate interests. We will stop unless we demonstrate compelling legitimate grounds or the processing is needed for legal claims.
5. Token handling and retention
- Incomplete OAuth transactions and their temporary results expire after approximately 10 minutes and are held in application memory during the beta service.
- After successful one-time exchange, the hosted transaction and temporary provider result are deleted from broker memory.
- Twitch OAuth access tokens used for login are not returned to, or retained for continued use by, the installation. CastNexus issues its own signed, limited broker credential, normally valid for up to 30 days.
- A Google refresh token is returned once to the requesting installation. The broker does not persist it after transaction exchange. It is processed transiently when that installation later requests a short-lived YouTube access token.
- Rate-limit information is short-lived in memory. Infrastructure security logs, where enabled, should normally be retained for no longer than 30 days, unless an incident, legal requirement or active abuse investigation requires longer.
- Support and rights-request records are retained only as long as reasonably needed to resolve and document the request.
6. Self-hosted installations
Your self-hosted CastNexus instance stores its own state, destination URLs, provider authorisations, recordings, music and uploaded media under the control of you or its operator. Those materials are not automatically sent to us. For YouTube uploads, the video normally travels directly from the self-hosted installation to Google; it does not pass through our OAuth broker.
7. Sharing and international transfers
Information is shared only as needed with Twitch, Google/YouTube, hosting and security infrastructure providers, professional advisers, or authorities where legally required. Twitch and Google may process information outside the UK under their own terms and transfer safeguards. Our infrastructure providers may also process limited operational data outside the UK subject to applicable contractual or legal safeguards. Refer to the provider privacy notices shown during authorisation for their processing.
8. Security
Controls include HTTPS, S256 PKCE, signed and expiring state, single-use transactions, strict callback handling, encryption of refresh tokens within the self-hosted application, rate limiting, limited request sizes, security headers and redacted operational errors. No internet service can guarantee absolute security. Please report suspected vulnerabilities privately rather than publishing exploit details.
9. Your rights
Depending on the circumstances, UK data-protection law gives you rights to access, correct or erase personal information; restrict or object to processing; receive portable data; and withdraw consent. You also have the right not to be subject to solely automated decisions producing legal or similarly significant effects; CastNexus does not perform such decision-making.
We may need information to verify your identity. You may complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint, although we encourage you to contact us first.
10. Children
The hosted service is not directed to children under 13. Users must also meet the minimum ages required by Twitch, Google and applicable law. Contact us if you believe a child supplied personal information improperly.
11. Changes
We may update this notice when the service, law or provider requirements change. The effective date above identifies the current version. Material changes affecting provider-data use will be communicated or presented for renewed consent where required.