Privacy Policy

Effective date: May 7, 2026 · Last updated: August 13, 2026

This Privacy Policy describes how the applications maintained by Victor Cavalcante (operating as "ViktorKav") ("we", "our", "us") collect, use, store, and share information when you authorize and use them. Most of our applications are personal content production tools that run locally on the operator's own machine, integrating with third-party APIs including Google APIs for YouTube data. One of them, the Members Area of this website, runs on a server and is used by visitors; wherever that difference matters, it is called out explicitly below.

By authorizing or using our applications, you acknowledge that you have read and understood this Privacy Policy.

1. Applications covered

This Privacy Policy applies to the following applications, and to any future applications by Victor Cavalcante that share this OAuth client configuration:

• Members Image Generator. A local desktop tool that generates a 4K image listing the paying members of the operator's own YouTube channel, used in end-of-video credit screens. It uses the YouTube Data API v3 endpoint members.list under the OAuth scope https://www.googleapis.com/auth/youtube.channel-memberships.creator.
• Stream-tools. A self-hosted server application for live stream alerts and live chat moderation. It uses the YouTube Data API v3 (live chat endpoints) under the OAuth scopes https://www.googleapis.com/auth/youtube.readonly and https://www.googleapis.com/auth/youtube.force-ssl. It also integrates with Twitch and LivePix APIs (governed by their respective policies).
• Members Area (viktorkav.com.br/membros). A website section reserved for paying members of the operator's YouTube channel. Unlike the two applications above, this one is used by visitors, not by the operator: you sign in with your Google account so the site can confirm that you are a member of the channel, and then read the members-only content. It uses the YouTube Data API v3 endpoint channels.list under the OAuth scopes openid, email and https://www.googleapis.com/auth/youtube.readonly.

2. Information we access

From the YouTube Data API

• Members Image Generator accesses, via members.list: members' public display names, public channel URLs, current membership level (e.g. "Adepto", "Mecenato"), the date each member joined, and the total membership duration in months.
• Stream-tools accesses, via the live chat endpoints: public live chat messages and their authors' public display names, channel IDs, badges, profile image URLs, and event types (membership, super chat, regular message). When the operator performs moderation, it accesses message IDs and target channel IDs only as needed to execute the requested moderation action.

We do not access or process: payment information, private messages, viewer location data, or any non-public personal information.

The Members Area requests the openid and email scopes because Google requires them alongside any YouTube scope in order to show the consent screen. We never read your email address: the only API call the sign-in makes is channels.list, which does not return it.

From the OAuth flow

• Desktop applications: refresh tokens and access tokens issued by Google's authorization server, used solely to call the APIs listed above on the operator's behalf.
• Members Area: a short-lived access token, used for a single channels.list call and then discarded immediately. It is never written to a cookie, to disk, or to a log, and no refresh token is ever requested for visitors, so the site cannot act on your account after you close the sign-in.

3. How we use the information

• Members Image Generator: the members list is rendered into a static PNG/JPG image used in the end credits of the operator's YouTube videos: exactly the same names YouTube already displays publicly on the channel's "Members" tab.
• Stream-tools: live chat messages are displayed in stream overlays and used to trigger configured visual/audio alerts. Moderation actions (delete, timeout, ban) are executed only when manually requested by the operator through the admin interface.
• Members Area: your channel ID is compared against the list of the channel's active members, to decide whether you may read the members-only content. Your display name is used only to greet you on the page ("signed in as …"). Neither is used for anything else: no profiling, no mailing list, no advertising.
• OAuth tokens are used exclusively to authenticate API requests for the purposes above.

4. Compliance with Google API Services User Data Policy

In particular, we confirm:

• We only use Google user data to provide the user-facing features described in section 3 of this policy.
• We do not use Google user data to serve advertisements, including retargeting, personalized, or interest-based advertising.
• We do not sell Google user data to data brokers, advertisers, or any other third party.
• We do not transfer Google user data to any third party, except as necessary to provide or improve user-facing features prominent in the requesting application's user interface and only with the user's consent.
• No humans read Google user data, except: (a) with the user's affirmative agreement for specific messages, (b) when necessary for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) for the application's internal operations and only when the data has been aggregated and anonymized.

5. Where the data is stored

For the desktop applications, all data is stored locally on the operator's own infrastructure. We do not operate any cloud server that aggregates user data. Specifically:

• OAuth tokens are stored in a local .env file on the user's own machine, with restricted file permissions. Tokens are never transmitted to any third party.
• Members list cache (Members Image Generator) is stored in a local membros.csv file on the user's own machine and is overwritten each time the application runs. It is not shared.
• Live chat messages (Stream-tools) are processed in memory during an active stream and are not persisted to disk for permanent history.
• Configuration data for Stream-tools is stored in config.json and secrets.json files on the user's own server, with restricted file permissions.

The only "output" that becomes public is the credit image at the end of YouTube videos (containing publicly visible member names), published as part of the video by the operator's choice.

Members Area

The Members Area is the one part of this policy that runs on a server: a single virtual private server rented by the operator in Brazil, not a third-party cloud platform that aggregates user data. What is kept there:

• Your session lives in a cookie in your browser, not in a database on the server. It is signed so it cannot be forged, and it contains three things only: your channel ID, your display name, and the moment it was issued. The server keeps no session table and no login history.
• The members list is a file containing channel IDs only (no names, no emails), plus the timestamp of when it was last collected. It exists so the site can answer "is this visitor a member?" without asking YouTube on every page load.
• Server logs record that a sign-in happened and whether it succeeded, but never the Google token and never the contents of your session.

6. Sharing with third parties

We do not share Google user data with any third party. Specifically:

• No analytics services, tracking pixels, or telemetry are connected to our applications.
• The data is not sold, rented, or monetized in any form.
• The data does not leave the user's personal infrastructure.

7. Data retention and deletion

The user controls all data, since everything is stored locally. To delete data collected by our applications:

• Members Image Generator: delete the files .env and membros.csv in the project directory.
• Stream-tools: delete server/data/secrets.json and server/data/config.json.

For the Members Area, where the data is about you rather than about the operator:

• Sign out at viktorkav.com.br/membros/sair. This deletes the session cookie from your browser immediately. Since the session lives only in that cookie, signing out is a complete deletion: there is no server-side copy to erase.
• Do nothing and the session expires on its own after 7 days.
• Your channel ID in the members list comes from your membership of the YouTube channel. It disappears from the list when your membership ends, the next time the list is collected. If you want it removed sooner, email the address in section 12 and it will be removed on request.
• Note that ending your membership does not sign you out instantly: an already-issued session stays valid until it expires, up to 7 days. Sign out to end it immediately.

To revoke our applications' access to your Google account at any time:

• Visit https://myaccount.google.com/permissions
• Find the application in the list of apps with access to your account.
• Click "Remove access". The OAuth tokens become invalid immediately.

8. Children's privacy

Our applications are not directed to children under 13. We do not knowingly collect personal information from children under 13.

9. Cookies and tracking on this website

The website viktorkav.com.br uses no tracking cookies, analytics, fingerprinting, or advertising pixels anywhere, including this page. Nothing on this site tries to work out who you are or what else you do online.

The Members Area does set two cookies, and neither of them tracks you: they are strictly necessary to sign you in and keep you signed in. Both are HttpOnly (unreadable by JavaScript), Secure (sent over HTTPS only), SameSite=Lax, and scoped to the /membros path, so they are never sent while you browse the rest of the site.

This Privacy Policy page loads its web fonts from Google Fonts, which means your browser makes a request to fonts.googleapis.com and fonts.gstatic.com when you open it (subject to Google's Privacy Policy). The Members Area does not: its fonts are served from viktorkav.com.br itself.

10. Changes to this policy

Material changes to this Privacy Policy will be reflected by updating the "Last updated" date at the top of this page. If the changes are significant, we will notify users through the operator's YouTube channel or via email when applicable.

11. Compliance with related policies

By using our applications, you also agree to comply with:

• YouTube Terms of Service
• Google Privacy Policy

12. Contact

If you have questions about this Privacy Policy or want to exercise your privacy rights:

• Email: [email protected]

This Privacy Policy is maintained by Victor Cavalcante (ViktorKav), an independent content creator based in Brazil.

Versão em português: esta política está disponível em inglês como versão canônica para verificação Google. Para esclarecimentos em português, contate via email acima.