A summary of which data is processed when you use Keci, why, and how it is protected.

1. In Short

Keci processes the data needed for you to broadcast and does not sell it. We do not use tracking cookies for advertising or analytics. Your broadcast video and audio pass through our servers to your channels; they are not recorded on our servers. Your card details never reach Keci.

The legal notice on the processing of personal data is in the Personal Data Notice (KVKK); this page explains what it means in practice in the app.

2. Your Account Details

Your full name, email address and phone number are kept for your membership; your username, gender and date of birth are kept in your profile only if you choose to enter them. Your password is stored irreversibly (with bcrypt).

To decide whether paid plans are offered in your country, your country is found from your IP address (with DB-IP’s country database kept on our servers; your IP address is not sent to third parties), and only the country code is stored on your account.

3. Sign-in Security

When you sign in from a new device, a 6-digit code is sent to your email. A browser whose code is confirmed is remembered for 90 days; for this, a cookie is kept in the browser and only a digest (hash) of that cookie and the browser/operating system name are kept on the server. To prevent abuse, your IP address is used in short-lived attempt counters.

4. Platforms You Connect

When you connect a platform account, the channel name, channel ID, profile picture and the access tokens the platform issues are stored. Tokens are encrypted with AES-256-GCM and used only to prepare broadcasts you start. Stream keys of channels you add manually are also stored encrypted.

When you remove a channel, the connection is deleted and the permission on the platform is revoked.

5. YouTube API Services

If you connect your YouTube channel, Keci uses the YouTube API Services. By connecting, you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms); how Google processes data is explained in the Google Privacy Policy (https://policies.google.com/privacy).

From your YouTube account, Keci reads only your channel name, channel ID and profile picture; for broadcasts you start, it creates a live broadcast, sets its title, description and visibility, gets the broadcast’s address and closes it when the broadcast ends. It does not access your videos, comments or other channel data; it does not use this data for advertising, profiling or any other purpose and does not share it with third parties.

Access tokens are stored encrypted. You can end the connection at any time by removing the channel in Keci or by revoking Keci’s access in your Google account’s security settings (https://myaccount.google.com/permissions); when the channel is removed, the tokens are deleted and the permission on Google is revoked too.

6. Broadcasts, Guests and Graphics

The broadcast title, description, duration, the channels it was sent to and its status are stored for the list of past broadcasts. Video and audio are not recorded; the “local recording” feature downloads the recording only to your own computer.

Your guests’ video and audio are sent directly to your browser (through a relay server when needed, without being recorded). For a guest, only the invitation link, the display name they choose and the invitation’s status are stored.

Your studio scene, layers, uploaded images and templates are stored on the server; you can delete them at any time.

7. Payments

Payments are taken through the infrastructure of PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş.; you enter your card details on PayTR’s secure page and they are not passed to Keci. Keci stores the order number, plan, period, amount, payment status and date together with the buyer’s name and email. Payment records are kept as required by tax law, even if your account is closed.

8. Emails

Service emails such as verification codes, password resets, payment receipts and plan expiry reminders are sent. These emails are needed for your account to work; no marketing emails are sent.

9. Security

All connections are encrypted with TLS. Access tokens and secret settings are kept encrypted in the database; session cookies cannot be read by JavaScript (httpOnly). Administrator actions are written to an audit log.

10. Your Rights and Contact

To access, correct or delete your data and to exercise your other rights under the KVKK, you can write to [Data protection email]. Details are in the Personal Data Notice (KVKK).