> ## Documentation Index
> Fetch the complete documentation index at: https://ogh.riturajbasak.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# How Ogh Protects Your Credentials and Keeps Streams Private

> Security and privacy in Ogh: how credentials are encrypted, where your stream travels, what data is retained, and how to delete it all.

Ogh is built around a simple principle: your data stays on your device and your stream goes directly to your chosen destinations. There is no Ogh account, no Ogh server, and no third-party telemetry. This page explains every security and privacy measure in detail so you can make informed decisions about how you use the app.

## Local-first architecture

Ogh does not operate a backend, media relay, recording server, or intermediary of any kind. When you tap **Go Live**, your encoded video and audio travel directly from your Android device to the destinations you have enabled in Settings. Ogh has no analytics service, no advertising system, and no telemetry pipeline. Nothing about how you use the app is reported anywhere.

## Encrypted storage

The following values are considered sensitive and are always encrypted before being written to your device:

* OAuth access tokens and refresh tokens
* Connected channel identifiers
* Manual stream keys

All of these are encrypted with **AES-256-GCM** using a non-exportable key held in the Android Keystore. Because the key is non-exportable, it cannot be extracted from the device, even by Ogh itself. Encrypted values are stored as `Base64(IV + ciphertext)` with a 12-byte IV and a 128-bit authentication tag. Ogh has no plaintext fallback for sensitive storage: if the Keystore is unavailable, the operation fails rather than falling back to unprotected storage. Tokens and stream keys are never written to diagnostics or application logs.

<Note>
  Ogh excludes all app data from Android cloud backup and device transfer. Your credentials and preferences are not synced to Google Drive or transferred to a new device through Android's backup system.
</Note>

## Data Ogh accesses from providers

### YouTube

When you connect YouTube, Ogh requests the OAuth scope `https://www.googleapis.com/auth/youtube`. Ogh uses this scope exclusively to:

* Identify your YouTube channel
* Create and configure a live broadcast and ingestion stream
* Bind the stream to the broadcast
* Manage the broadcast lifecycle you request (start, pause, end)

Ogh does **not** use this access to read your videos, subscribers, comments, or any other channel data. Your Google user data is never sold, transferred to Ogh's servers, or shared with third parties. Ogh's use of Google API data adheres to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including its Limited Use requirements.

### Twitch

When you connect Twitch, Ogh requests the scope `channel:read:stream_key`. This scope is used only to read your Twitch ingest stream key immediately before a streaming session begins. No other Twitch channel data is accessed.

Ogh does not use data from either provider for advertising, analytics, profiling, credit decisions, or training AI models.

## Stream security

<Warning>
  Plain RTMP does **not** encrypt your stream key or video in transit — anyone on a shared or monitored network could observe them. Use **RTMPS** whenever your destination supports it to protect your credentials and content end-to-end.
</Warning>

Provider ingest credentials — such as the YouTube RTMP ingestion URL and Twitch stream key — are held **in memory only** for the duration of a session. They are never written to disk, logs, or any persistent storage, and are cleared from memory as soon as the session ends.

All OAuth authorization flows and provider API calls use HTTPS. TLS validation is never weakened.

## Data retention

| Data                                                    | Retained until                                                                  |
| ------------------------------------------------------- | ------------------------------------------------------------------------------- |
| OAuth tokens and channel identifiers                    | You disconnect the provider, clear app data, or uninstall Ogh                   |
| Manual stream keys                                      | You delete the destination, clear app data, or uninstall Ogh                    |
| Provider ingest credentials (e.g. RTMP URL, stream key) | End of the streaming session (memory only — never persisted)                    |
| Custom pause image                                      | Ogh holds only a read-permission URI; the image stays in your document provider |

### Disconnecting a provider

When you disconnect YouTube or Twitch from **Settings → Platforms**, Ogh first requests token revocation from that provider, then deletes all locally stored tokens and account information. After disconnection there is no record of that account remaining in Ogh.

YouTube users can also revoke Ogh's access independently at [https://myaccount.google.com/connections](https://myaccount.google.com/connections).

### Custom pause image

If you set a custom pause image, Ogh stores a persistent read-only document URI so it can display the image during a paused stream. The image itself stays with your document provider (such as your local Photos library) — Ogh does not copy, cache, or upload it. Switching back to the default Ogh logo releases the retained URI permission immediately.

### Removing all data

Uninstalling Ogh or using **Android Settings → Apps → Ogh → Clear data** removes all locally stored records, including encrypted credentials, stream settings, and destination configuration.

<Tip>
  For maximum privacy, use a manual RTMP destination with an RTMPS URL. No provider account is required, no OAuth flow is initiated, and your stream key never leaves your device except as part of the encrypted RTMPS connection to your chosen server.
</Tip>