Privacy Policy

Controller and contact

The controller is NET-LINE Online-Dienste GmbH, Wannenäckerstr. 25, 74078 Heilbronn, Germany. Privacy requests can be sent to datenschutz@netline-services.de; product support is available at support@vorocast.app and +49 170 7917661.

Our data protection officer is Peter Herrmann and can be reached at datenschutz@netline-services.de.

Data processed by VoroCast

The app can be used without an account. Local preferences, destination settings, and external RTMP stream keys are stored on the iPhone; stream keys are protected in the iOS Keychain.

If you create an optional VoroCast account, we process the username, display name, optional email address, password hash, language, account identifier, creation and last-login timestamps, IP address, hostname, user agent, and client type. Passwords are not stored in plain text.

If you use Sign in with Apple or Google, we receive the provider user identifier, verified email address where available, and the name you choose to share. We never receive your Apple or Google password.

When you scan a managed-workspace invitation, the QR code is read on the device. We process its short-lived challenge identifier and the relevant account and streaming-profile identifiers to complete the requested connection; VoroCast does not upload or retain a camera image of the QR code.

When you start a stream, camera video, microphone audio, destination information, session identifiers, and technical connection data are processed to establish, relay, monitor, and stop the selected stream. VoroCast does not create a recording by default.

For security, support, and fault diagnosis, our services may process request time, IP address, user agent, API route, response status, session or call identifiers, and technical error details. We do not use advertising SDKs and do not track users across third-party apps or websites.

When you visit vorocast.app, the hosting and delivery systems process the requested URL, time, IP address, user agent, referrer where supplied, and response status to deliver and secure the static website. The public website does not use analytics, advertising, tracking cookies, or browser storage.

Purposes and legal bases

We process data to provide requested account, streaming, restream, support, and security functions under Article 6(1)(b) GDPR. Device permissions for camera and microphone are controlled by you in iOS and can be withdrawn in iOS Settings.

We process limited technical records to secure the service, prevent misuse, diagnose failures, and defend legal claims based on Article 6(1)(f) GDPR. Where a legal retention obligation applies, processing is based on Article 6(1)(c) GDPR.

Our legitimate interests are reliable service delivery, attack and fraud prevention, troubleshooting, and the establishment, exercise, or defence of legal claims. Account and destination details required for a requested feature must be provided for that feature to work; creating an account and entering an email address remain optional. We do not make decisions based solely on automated processing that produce legal or similarly significant effects.

Streaming destinations and service providers

VoroCast uses infrastructure and network providers, including Amazon Web Services, to operate account, website, logging, and API services. Authorized processors receive only the data needed for their contracted task.

Apple and Google process authentication data under their own privacy policies when you choose the respective sign-in option. VoroCast uses the returned identity only for account access and security, not for advertising or cross-service tracking.

For VoroCast Live, audio, video, and session data are relayed through media.guppy.cloud. If you select Twitch, YouTube, or a custom RTMP destination, VoroCast sends the live signal and required connection credentials to that destination only after you start the stream. The destination provider processes data under its own terms and privacy policy.

A restream request sends the selected destination and stream credential to media.guppy.cloud so the outgoing connection can be established. Do not enter credentials for a destination you are not authorized to use.

We require processors acting on our behalf to protect personal data to at least the level described in this policy and required by applicable law. A destination you select, such as Apple, Google, Twitch, YouTube, or a custom RTMP provider, may process data outside the European Economic Area as an independent provider. Where we arrange a transfer to a third country, we rely on an applicable adequacy decision, including the EU-US Data Privacy Framework where available, or appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Retention and deletion

Optional account data is retained while the account is active. An account created in VoroCast can be permanently deleted in the app under Account. The deletion immediately disables login and atomically anonymizes direct profile, credential, email, and recent IP or user-agent fields while retaining a minimal deletion receipt.

If in-app account deletion is unavailable, contact support or the privacy address for account assistance or deletion. Local stream keys remain on the device until you remove them in Setup or erase the app's Keychain data.

Live media is processed for the active transmission and is not recorded by VoroCast by default. Operational logs are retained only for the period required for service security, fault diagnosis, legal obligations, or legal claims, then deleted or anonymized according to the applicable service policy.

Retention is determined by data type and purpose: live media exists only for the active transmission unless you use a destination that records it; short-lived invitation challenges expire automatically; account data remains until deletion; support correspondence and security records remain only while needed to resolve the request, prevent abuse, meet documented legal duties, or defend claims. We then delete or anonymize the data.

Your choices and rights

You can deny or later revoke camera and microphone access in iOS Settings, remove external stream keys in the app, use VoroCast without an account, sign out, or delete a VoroCast-created account in the app.

Subject to applicable law, you may request access, rectification, erasure, restriction, portability, or object to processing. You may withdraw consent with future effect and lodge a complaint with a competent data protection authority. Contact datenschutz@netline-services.de to exercise these rights.

The supervisory authority responsible for our establishment is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW), www.baden-wuerttemberg.datenschutz.de. You may also contact the authority at your habitual residence, place of work, or the place of an alleged infringement.

Minimum age

VoroCast is intended for users aged 13 or older. Where applicable law requires permission from a parent or legal guardian, the service may be used only with that permission.

Changes

We update this policy when the app, providers, or legal requirements change. Material changes will be identified by a new effective date and, where required, communicated in the app or through the account contact channel.