Privacy Policy

This Privacy Policy applies to Hibiki — Streamer Studio ("Hibiki", "we", "us"), its official website at hibiki.risefall.org, and associated authentication, synchronization, streaming integration, moderation, billing-entitlement, and support services operated by Risefall. It does not govern third-party sites and products linked from Hibiki.

Contact: support@risefall.org. For personal data requests, use the instructions in Delete your Hibiki account. Where applicable law requires additional operator details, these will be provided to the individual upon a valid request.

Important distinction: You connect your own accounts and decide which optional integrations to enable. Connecting a platform is not permission to use its data for unrelated purposes. Availability and permissions depend on the particular integration and authorizations you grant.

Different features require different data. Depending on what you choose to use, this may include:

• Hibiki account and authentication: unique Hibiki account identifiers, sign-in provider identifiers, account names or images supplied by the authentication provider, access/session records, security events, and preferences linked to your account.
• Connected platform information: authorized account/channel identifiers, display names and avatars, connection status, OAuth scopes and tokens, stream/broadcast/live-chat identifiers, and limited API responses necessary for requested features.
• Live activity: chat messages, timestamps, author names and channel/user identifiers, moderator/broadcaster roles, membership and paid-message indicators, emotes, viewer/event information, moderation actions, and stream-status changes provided by supported platforms.
• Your workspace: app settings, widget and overlay configuration, local session markers, notes, filters, user preferences, mute/speech settings, and app state necessary to display or sync the features you use.
• Billing and subscriptions: subscription or purchase status, entitlement, billing-provider customer/reference identifiers, renewal or cancellation events, and limited transaction metadata; full card numbers are handled by the payment provider, not Hibiki.
• Website and communication: email address and consent record for launch notices, signup source, timestamps, unsubscribe status, support messages, and technical data processed by the web server to operate the site.
• Technical and security information: app version, OS, errors, feature-usage diagnostics, request timestamps, and server connection/network records (which may include IP addresses in hosting or security logs).

We do not ask for your YouTube or Google password. Never email us your password, recovery codes, or OAuth tokens. Chat messages, even public messages, may contain information about individuals; streamers should use them responsibly and consider the privacy of their viewers and moderators.

Hibiki uses YouTube API Services when you expressly connect a YouTube account. You sign in to Hibiki with Google separately from granting permission for YouTube features. Google’s authorization screen displays the permissions requested. We do not ask for or receive your Google or YouTube password.

Specific YouTube API Data accessed and used:

• Connected YouTube channel: channel ID, channel name, profile image and information returned with the approved authorization. Purpose: identify the connected channel in the app and maintain its authorized connection.
• Live broadcasts: broadcast/video identifiers, broadcast title and live status, associated live-chat ID and available viewer or event indicators. Purpose: find active broadcasts, let you choose the broadcast to monitor and keep the live view synchronized.
• Live-chat messages and participants: message IDs and text, message times, author/channel identifiers, names, profile images, broadcaster or moderator roles, badges and other metadata available from YouTube. Purpose: display chat and identify its source, allow streamer-selected filtering, favorites, notes, important-message highlighting, speech and moderation interfaces.
• Live events: membership and paid-message information, including supported amounts, currency, stickers and other event metadata when available. Purpose: display events and enable relevant streamer alerts and overlays.
• Authorization: approved OAuth scopes, access and refresh credentials where required, connection status and related channel identifiers. Purpose: perform authorized requests and maintain or disconnect your integration. Credentials may be handled securely by Hibiki’s backend; they are not embedded in public OBS links.

How this information is used: live chat appears in the desktop app; when enabled by the streamer, selected messages can be read aloud via text-to-speech, shown in an always-on-top overlay, displayed through an OBS browser-source widget, marked as important, added to favorites or saved in notes. A streamer can locally hide a message from speech or widgets while still viewing it in the application’s moderation interface. This is a Hibiki presentation preference and does not remove or modify the original message on YouTube. Authorized moderators may be shown content or controls expressly shared with them.

Where the information goes: live API responses are processed by the desktop application and, where needed for connected-service authorization, optional TTS, OBS browser-source delivery or moderator features, may pass through Hibiki’s supporting services or a selected voice/AI provider. Streaming chat displayed on a public OBS overlay can be seen by the streamer’s viewers. We do not sell YouTube API Data, use it for targeted advertising, create cross-platform viewer profiles, perform surveillance or train general-purpose AI models using it. More on recipients appears in Sharing and TTS and AI.

Stored session history: the stream-history feature is stored on the user’s own computer and is not uploaded or synchronized as a history archive to Risefall’s servers. It may include stream dates, locally measured duration and counts of messages observed during a stream. You can open history and use its one-click clear-all-data action to remove the local history. Any saved YouTube-derived content or statistics remains subject to the YouTube API storage, refresh and deletion rules, including when it is stored on your computer. Local-only storage does not create an exception to those rules.

The exact fields collected depend on your selected broadcast, enabled features, consented OAuth scopes and responses provided by YouTube; features cannot access data beyond the permissions granted. Hibiki’s YouTube functionality is subject to the YouTube Terms of Service and the YouTube API Services Terms of Service; see the Google Privacy Policy. YouTube API access itself is not separately sold; any paid Hibiki features concern our software and infrastructure.

If you sign in through Google, we receive the identity and profile information made available under the authorization you approve, such as a Google account identifier, display name, email address or avatar when included in the granted scope. Signing into Hibiki and connecting a YouTube channel are distinct purposes even when both use Google’s authorization framework. We only request the scopes needed by available functions and do not request your Google password.

Access or refresh credentials needed for connected services may be handled through the Hibiki backend; some app preferences and history reside on your device. OAuth credentials should not be embedded in public links or logs. We use Google user data only to operate or improve the user-facing features for which access was granted, subject to applicable Google API Services policies, including their Limited Use requirements where applicable. We do not provide user data to advertising networks for targeted advertising.

Third-party policies: Google Privacy Policy, Google API Services User Data Policy, YouTube Terms. You can withdraw access by using Google’s third-party access settings independently of Hibiki.

Hibiki may connect to Twitch, TikTok and supported music services such as YouTube-based playback, Spotify, or other providers as specific features become available. Availability differs by product version, provider rules and operating environment. The specific features you enable may involve access to channel/account metadata, chat messages, events, playback metadata, authorized playback controls, and connection tokens.

Providers’ independent terms and privacy policies apply. Depending on the feature, the provider may receive the data needed to authorize and fulfill the request. A provider shown as Coming soon is not a representation that its full integration or data flow is currently active. You can stop using optional integrations and revoke their permissions through the relevant provider when offered.

Hibiki is a desktop-first app. The stream-history feature records stream sessions on the user’s own computer, rather than in a cloud history account. Its records can include stream date, elapsed time and message counts. History is not uploaded or synchronized as a saved archive to Risefall’s servers. Open Hibiki’s stream history to view it or use the one-click action to clear the locally stored history. Deleting local history cannot delete the source livestream or messages stored by YouTube. Files that the user separately exported or copied to backups may need to be removed separately.

App settings, temporary chat presentation state, favorites, notes, filters and widget configuration can be processed or saved as needed for user-enabled functions. Local storage is not an exemption from YouTube API Data restrictions. YouTube-originated messages, author information, metadata and API-based counters must follow the applicable retention and refresh rules, even when held in a local database.

Our backend supports authentication, entitlement checks, connected-platform authorization and selected real-time services. Live messages can be passed through those services while delivering features such as TTS or OBS widgets; this is distinct from uploading a permanent archive of the user’s stream history. An OBS browser-source URL may display messages or events to the streamer’s audience. Keep secret widget URLs private because anyone with access to a permitted source may be able to view the streamer’s selected output.

If you authorize another person as a moderator, that person may see or act on stream information within the permissions you give them. Actions inside Hibiki that hide a message from TTS or a widget do not automatically remove the message from YouTube. You remain responsible for whom you authorize as moderators and what you choose to display publicly.

If you turn on text-to-speech, chat messages or your selected text may be sent to a voice-generation provider or processed by Hibiki’s backend to synthesize speech. Optional AI-assisted features may process the text, prompt or context necessary to fulfill the feature. This can include content written by viewers, not just the account holder.

These features may involve external subprocessors with their own security and data-handling terms. Do not submit sensitive personal information or confidential material through public chat, AI or TTS fields. We do not promise that AI-generated output is accurate, error-free or suitable for every broadcast. Disable these features if you do not want the associated processing; alternative manual workflows may remain available.

We process relevant information to: authenticate accounts; run requested streaming features and integrations; store user-selected settings; operate billing and subscriptions; deliver user-requested launch email; respond to support; prevent fraud, abuse and security incidents; diagnose performance and enforce applicable rules; and meet legal obligations.

Where privacy laws require a legal basis, depending on the data and context that basis may be performance of a contract, consent for optional integration or mailing-list features, legitimate interests in secure and reliable operation (balanced against user rights), or legal obligation for certain records. Consent can be withdrawn without affecting processing that already had a lawful basis.

We share data only as needed for the purposes described here, such as:

• Platforms you connect (Google/YouTube, Twitch, TikTok or music services) to complete authorized API requests and account connections.
• Infrastructure, hosting and delivery providers for the database, infrastructure, website, error reporting or transactional messages, under applicable service agreements.
• Text-to-speech / AI processors only when you enable a feature requiring content processing.
• Payment and storefront providers such as Paddle or Steam for purchase, tax, fraud-prevention and subscription management.
• Moderators or browser-source/OBS viewers you designate through the access and sharing choices you make.
• Authorities or professional advisers when required by law, necessary to protect rights or investigate abuse, subject to applicable safeguards.

We do not sell personal data. Hibiki does not knowingly share Google/YouTube user data with advertising brokers. Third-party content, embeds and externally opened pages may process information under their own policies.

We retain information only as needed for the features you choose and subject to applicable privacy laws and third-party platform policies. The periods depend on the data type and whether it is stored by Hibiki, on your device, or by an independent third party.

• Google / YouTube OAuth credentials: held only as needed for an authorized active connection, and revoked or removed following a disconnection or invalidated consent in accordance with Google’s requirements.
• YouTube chat messages, authors, broadcast metadata and other non-exempt API Data: under the YouTube Developer Policies, these records must be refreshed from YouTube or deleted within 30 calendar days of retrieval. This applies to Hibiki-controlled local caches as well as server-side copies. Information that cannot lawfully be refreshed must be removed within the applicable period.
• Authorized YouTube statistics: specific authorized statistics may be kept longer where the YouTube rules permit, but authorization and the underlying resource must be reconfirmed at least every 30 days. Statistics obtained without authorization do not have this general longer-term exception. Other derived metrics or special extended retention require the applicable YouTube permissions or approval.
• Locally stored stream history: a streamer may view prior sessions, including their locally recorded dates, elapsed time and message counters, and clear this history from within Hibiki with one action. This stored history is not synchronized to our servers. Where a history field is YouTube API Data or is based on YouTube API Data, the applicable YouTube retention restrictions still apply; the fact that it is local, or that a user can manually delete it, does not by itself authorize indefinite retention.
• Hibiki settings and notes that are not YouTube API Data: may remain on your device for the application’s functionality until you delete them or remove the application data.
• Account records, subscriptions, security records and website communications: kept for legitimate operation or legally required periods; certain tax or payment records may be maintained by independent payment processors.

Your deletion controls: you can erase local stream history directly in Hibiki and request account or connected-service data deletion at Account & Data Deletion. A verified deletion request covering YouTube data must be acted on as soon as possible and no later than 7 calendar days, and revocation of Google consent is handled under the relevant Google revocation rules. Removing an app copy does not erase the original information stored by YouTube.

Implementation note: publishing a Privacy Policy does not itself enforce time-based purging, data refresh, token revocation or local backup removal. Those actions depend on Hibiki’s software, backend and the user’s device. Contact support@risefall.org if you believe data requiring deletion remains in the app.

You may withdraw YouTube authorization at any time. In Hibiki, open Connections → YouTube and use the disconnect action. You may also independently revoke Hibiki’s access from Google Account → Third-party access. After revocation, Hibiki can no longer make new authorized API requests with that grant.

When a user revokes authorization from Hibiki, the YouTube Developer Policies require prompt programmatic revocation of the relevant credential and deletion of authorized API data obtained under that grant as soon as possible, no later than 7 calendar days. When the user revokes access through Google Account permissions, applicable stored data must be removed as soon as possible and no later than 30 calendar days. You may also request data removal using the YouTube data deletion instructions.

Local stream history can also be cleared directly on the user’s computer using the history screen. A user may additionally need to remove separately exported files or backups they control. Revoking a connection or clearing Hibiki’s data does not delete YouTube livestreams, messages, channels, videos or other material held by YouTube. You must manage that content through YouTube. Revoking Google consent does not automatically cancel an unrelated Hibiki subscription.

You may ask us to erase your Hibiki account and server-side personal data, request removal of just a connected platform’s data, or ask what data is held. Visit Account & Data Deletion or send a request from your registered email address to support@risefall.org. Tell us whether you want account deletion, YouTube data deletion, or disconnection only. We may ask for proportionate proof of account ownership; never send a password or Google OAuth token.

We will process valid YouTube-data erasure requests within the deadlines explained above and other personal-data erasure requests within timeframes required by applicable law. We may preserve narrowly scoped records where law requires it or to investigate security misuse, and explain any applicable exception. You should also remove local Hibiki files, exports and backups on devices you control. Deleting a Hibiki account does not automatically cancel a subscription at the payment provider: cancel active renewals with that provider as well.

Depending on your location and applicable law, you may request access to personal data, correction, deletion, restriction or objection to processing, portability, and withdrawal of consent. You may also complain to a relevant supervisory authority where you have that right. Use support@risefall.org or the deletion guide; we will explain verification and applicable limitations.

You can separately unsubscribe from optional marketing or product-announcement emails using the unsubscribe link in the message. Unsubscribing does not block necessary security, billing or account notifications. You can control local data, integrations and optional output features in the app to the extent supported by your installed version.

The Hibiki website is built on WordPress. It may use essential cookies for administrator login, sessions, security, forms or site functionality, and the web host may keep necessary access/error logs. If nonessential analytics, advertising trackers or new embedded third-party services are introduced, they must be disclosed and consent handled where required. At present, this policy does not describe or authorize undisclosed behavioral-advertising tracking.

Opening a YouTube video, embedded media, external store, payment checkout or other third-party site may cause that provider to process device/network data under its own policy. Browser settings can limit some cookies but may affect function.

Hibiki is available over the internet; processors, hosting and platform services may operate in countries other than yours. Where applicable law requires safeguards for cross-border transfers, we apply appropriate measures. We use technical and organizational safeguards designed to protect authentication credentials, application services and personal data, but no internet service can promise perfect security.

Protect your streaming accounts, moderate access to widgets and moderator sessions, use strong account security including provider multi-factor authentication, and report suspicious activity promptly to support@risefall.org.

Hibiki is designed for streamers and their authorized teams, not for children below the age permitted to use the applicable connected platform or digital service under local law. We do not intentionally request sensitive-category data for account setup. Public chat and external integrations may nonetheless contain information about other people; do not use Hibiki to target, profile or expose individuals unlawfully.

If you believe a child has provided personal data contrary to applicable requirements, contact us for review and deletion.

We may update this policy to reflect product changes, new providers, legal requirements or security improvements. The date above will change when we publish an update. Where law or a platform rule requires notice or renewed consent for materially different processing, we will request it before using the newly covered data. An earlier authorization is not automatic consent to an unrelated purpose.

Privacy and support: support@risefall.org. Operator: Risefall. Website: hibiki.risefall.org.

• Delete account or connected data
• Disconnect YouTube / Google authorization
• Google Privacy Policy
• Google account third-party permissions
• YouTube Terms of Service
• Hibiki Terms of Service