Skip to content
CueStream
tr

Privacy Policy

Last updated: 2 November 2026

This policy explains what personal data CueStream collects, why, and what rights you have under the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK).

1. Who we are

The data controller is Newa Produktion, owner Ahmet Azad Göcer, Berlinerstr. 8, 51063 Köln, Germany. Contact: privacy@cuestream.de.

2. The short version

  • Guest audio and video are never stored on our servers. Media flows directly and encrypted (DTLS-SRTP) between the guest's browser and the host's studio. If a direct connection is not possible, an encrypted TURN relay forwards packets it cannot decode.
  • Guest names and chat messages are kept in memory only for the lifetime of a room and are never written to our database.
  • We do not use advertising or third-party analytics, and the website does not set tracking cookies. The only cookie is the strictly necessary sign-in cookie (__Host- prefixed, HttpOnly, Secure). It is set only when you sign in, keeps you signed in for up to 30 days (7 days without use) and is deleted when you sign out. Because it is required for the service you request, it needs no consent (§ 25 (2) TDDDG).
  • Card details are handled by Stripe and never reach our servers.

3. Data we collect

Account holders

  • Email address and a one-way password hash (Argon2id). We never store your password itself.
  • Stripe customer ID and subscription status.
  • For each activated machine: a SHA-256 hash of the machine identifier (the raw hardware ID never leaves your computer), the machine name you choose, operating system and app version, and last-seen time.
  • Room metadata (room name, creation time, number of guests), but not the content of the show.
  • Security logs including IP addresses, kept for at most 30 days.

Guests

  • The display name you enter and chat messages, kept in memory only while the room exists.
  • Technical connection data (IP address and network candidates) needed to establish the WebRTC connection. Your local IP address is hidden by your browser (mDNS).

4. Why we use it (legal bases)

  • Providing the service and your subscription: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
  • Security, fraud and abuse prevention: legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
  • Invoicing and tax records: legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)).

5. Processors and transfers

We use these processors, each under a data processing agreement:

  • Hetzner Online GmbH, Gunzenhausen, Germany: servers for the API, database and guest connections (data centre in Nuremberg, Germany).
  • Cloudflare, Inc., San Francisco, USA: DNS, website hosting and network protection; every request to our website and API passes through Cloudflare.
  • Stripe Payments Europe, Ltd., Dublin, Ireland: payments and invoices; card details go only to Stripe.
  • ActiveCampaign, LLC (Postmark), Chicago, USA: sending account emails (address confirmation, password reset).

Cloudflare, Stripe and Postmark may process data in the USA. These transfers rely on the EU–US Data Privacy Framework and/or the EU standard contractual clauses (GDPR Art. 45 and 46); for KVKK, on Art. 9.

6. Retention

  • Account data: until you delete your account.
  • Security logs with IP addresses: at most 30 days.
  • Billing records: kept by Stripe and by us for the period required by tax law.
  • Guest names and chat: deleted when the room closes.
  • Cancellation declarations (name, email, date, content): 3 years, as proof of the cancellation (legal obligation and legitimate interests, GDPR Art. 6(1)(c) and (f)).

7. Your rights

You can request access, correction, deletion, restriction, portability and object to processing, and you may lodge a complaint with your data protection authority (in Türkiye, the Personal Data Protection Authority, KVKK). You can delete your account from the account page or by writing to privacy@cuestream.de. Deleting your account removes your sessions, machines and personal data; Stripe keeps billing records for the legally required period.

8. Security

We use TLS for all connections, store only hashes of passwords and session tokens, encrypt database backups and limit access on a need-to-know basis.

9. Changes

We will announce material changes on this page and, where appropriate, by email.