Privacy

What we collect, and why

Last updated 27 September 2026

TrackStream is in early access and run by a small team in the United Kingdom. It covers the TrackStream Bridge (the in-car streaming unit), the dashboard at dash.trackstream.live, and the TrackStream companion app. This page describes what the service actually does with your data. It is deliberately specific rather than generic — if something here doesn’t match what you see, that’s a bug worth telling us about.

Who is responsible

TrackStream is the data controller for the information described here. Contact us at privacy@trackstream.live about anything on this page.

What we collect

Your account details

You can sign in with Google, with Apple, or with an email address (password or emailed sign-in link). We receive your email address, your user identifier, and — where the provider supplies them — your name and profile picture URL. We never receive your Google or Apple password, and signing in does not give us access to any other part of those accounts.

What you set up in the service

Your Bridges and their names, broadcasts (titles, schedules, overlays, timing settings), overlay images you upload, and the streaming destinations you add — including the ingest address and stream key for any custom RTMP destination. This is stored because it is the service.

Information from your Bridge

A Bridge reports its status so you can see and control it remotely: battery level, temperature, software version, streaming state and bitrate, mobile signal strength and network operator, the SIM’s identifier and APN, the WiFi network name it is joined to, mobile data usage, and error and diagnostic information. The Bridge does not send its location to us.

Video

Video from your Bridge passes through our relay server on its way to your viewers and to any destinations you have set up (such as YouTube). It is relayed live and not recorded or stored by us. When you use the overlay editor, we grab a single frame from the live stream to show you, and do not keep it. Anything you send to YouTube or another platform is then held by that platform under its own terms.

Ordinary technical logs

Our hosting providers and our relay server record standard request and connection information, including IP addresses, for security and reliability. Stream keys are masked in our logs. We do not use analytics, advertising, tracking pixels, or fingerprinting, and we do not build profiles of visitors.

Google and YouTube data

If you choose to connect a YouTube channel, TrackStream asks Google for access to your YouTube account (the youtube permission). This is separate from signing in with Google, and entirely optional. We use it only to:

• read your channel’s name, handle, and thumbnail so you can pick it;
• create, update, and delete live broadcasts and live streams on that channel when you ask us to, so your Bridge’s video can go live there.

We do not read, modify, or delete your existing videos, playlists, comments, or subscriptions, and we do not use YouTube data for advertising or to train any model. Google gives us a long-lived access credential (a refresh token), which we keep on our servers, inaccessible to browsers and apps, alongside your channel’s name, handle, and thumbnail. When you remove a channel in the dashboard, we ask Google to revoke that credential and delete it along with the channel details. You can also revoke TrackStream’s access at any time from your Google account permissions page.

TrackStream uses YouTube API Services. By connecting a channel you are also agreeing to the YouTube Terms of Service, and Google’s handling of your data is covered by the Google Privacy Policy.

TrackStream’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Why we’re allowed to hold it

Account, Bridge, and configuration data is processed to perform the contract between us — you asked us to run the service and we cannot do so without it. Technical logs are processed on the basis of our legitimate interest in keeping the service secure and working.

Watch links are public to anyone who has them

Each Bridge and each broadcast has a watch link so that people without an account can see the stream. Anyone who has that link can watch. It is unlisted rather than secured — much like an unlisted video — so treat it as public the moment you send it, and assume it may be forwarded. A watch page shows the live video, the Bridge or broadcast name, whether it is online, and any timing overlay you have configured. It never shows your account details or anything else in your account. Overlay images you upload are likewise viewable by anyone who has their address, because they appear on the stream.

Timing data

Lap times, positions, and gaps shown in overlays come from public live timing published by race organisers and timing providers. We fetch it from them; we do not send them any of your data.

Who else touches it

Google Cloud Platform and Firebase host the dashboard, sign-in, database, and file storage, and process data on our instructions as our processor.

Our relay server runs on a virtual server we rent from a hosting provider. It carries live video and Bridge status messages.

Google and Apple handle sign-in if you choose them. YouTube and any other destination you add receive the video you send to them. Expo delivers companion-app updates, and so receives your phone’s IP address when the app checks for one.

No one else receives your data. We do not sell it, and we do not share it for advertising.

Where it is stored

On Google Cloud infrastructure and on our relay server. Some processing may take place outside the United Kingdom, under the safeguards our providers offer for international transfers.

How long we keep it

Account and configuration data is kept while your account is open. Removing a Bridge, channel, destination, or broadcast deletes it. If you ask us to delete your account, we remove your personal data and everything you own in the service, other than anything we are legally required to retain. Technical logs and diagnostic records are kept for a short period and then discarded.

What you can ask for

Under UK data protection law you can ask us for a copy of your data, ask us to correct it, ask us to delete it (including deleting your account), ask us to restrict or stop certain processing, or ask for it in a portable form. Email privacy@trackstream.live and we will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk.

The companion app

The app uses your camera only to scan the QR code on a Bridge, and uses WiFi and local network access only to connect to a Bridge’s own hotspot while setting it up. It does not access your location, contacts, or photos, and contains no analytics or advertising code. Bridge hotspot passwords and access tokens are kept in your phone’s secure storage.

Cookies and browser storage

This site sets nothing at all. The dashboard stores your sign-in session and your light/dark theme choice in your browser, and sets one short-lived cookie while you connect a YouTube channel, to protect that step against forgery. All of these are strictly necessary and none is used for tracking — which is why you are not being asked to dismiss a banner.

Children

The service is not intended for children under 13, and we do not knowingly collect their data.

Changes

If we change this page materially we will update the date at the top and, where the change affects you, tell account holders directly.