Official Legal DocumentView Terms of Service →

Privacy Policy

Effective Date: October 16, 2026 • Last Updated: October 16, 2026

This Privacy Policy explains how MCast ("MCast", "we", "our", or "us") collects, uses, encrypts, and handles your information when you visit https://mcast.fun, interact with the MCast centralized backend services, or use the MCast LiveStatus Minecraft plugin.

Privacy Highlights & Our Commitments

•Read-Only YouTube Access: We strictly request read-only access (youtube.readonly) solely to detect active Minecraft live broadcasts.
•AES-256-GCM Encryption: Google OAuth refresh tokens are encrypted at rest with authenticated 256-bit encryption before storage.
•Zero Token Exposure to Server Admins: Minecraft server administrators never receive or access your Google tokens or client credentials.
•No Ads or Data Resale: We never sell, rent, or transfer your personal or YouTube data to advertising networks or data brokers.
•Complete User Control: You can disconnect your YouTube channel at any time in Minecraft (/link youtube unlink) or via Google Security settings.

1. Overview & Description of MCast

MCast is a centralized platform connecting Minecraft servers with YouTube Live broadcasting. The ecosystem consists of:

The Web Portal: Hosted at https://mcast.fun, offering creator linking flows and public documentation.
The Central Backend API: Hosted at https://api.mcast.fun, managing secure Google OAuth 2.0 token exchanges, cryptographic CSRF checks, and batch live-stream status checks.
The Minecraft Plugin: A Paper 1.21+ server plugin (LiveStatus) that renders a non-destructive LIVE indicator on player nametags and sends in-game chat broadcasts when an authorized streamer goes live.

Our architecture centralizes OAuth credentials so individual server owners never need to set up Google Cloud projects, manage API keys, or handle sensitive authentication tokens.

2. Information We Collect

We practice data minimization and collect only information strictly necessary to provide live stream synchronization:

A. Minecraft Account Data

When a server links your streamer profile, we store your Minecraft Universally Unique Identifier (UUID) and in-game username (e.g. PokeHowlet) to associate your game character with your YouTube channel.

B. Public YouTube Channel Metadata

Upon completing the Google OAuth flow, we query the YouTube Data API for your public channel profile:

YouTube Channel ID (e.g. UC...)
Channel Display Title
Custom URL or YouTube Handle (e.g. @YourChannel)
Public channel avatar image URL (for display on your linking success and dashboard cards)

C. Google OAuth Credentials (Encrypted)

We securely store an encrypted OAuth 2.0 refresh token received from Google during channel linking. This allows our backend to refresh short-lived access tokens to query your live broadcast status automatically without requiring you to re-authenticate repeatedly.

D. Stream Broadcast Status & Cache Data

While your channel is linked, our polling service checks whether you have an active live broadcast. We temporarily cache:

Broadcast status (LIVE_MINECRAFT, LIVE_NOT_MINECRAFT, OFFLINE, or UNKNOWN)
Active YouTube Video ID and watch URL
Broadcast title (used for in-game chat announcements)
Timestamp of last status check (cache TTL: 30–60 seconds)

E. Single-Use Link Session Codes

When you initiate /link youtube in-game, a cryptographically random, short-lived session code is created with a strict 5-minute time-to-live (TTL). Once consumed or expired, the session is invalidated.

F. Server Registration Metadata

Participating Minecraft servers register with a random server ID, server name, plugin version, and salted secret hash (HMAC-SHA256) used solely for server-to-backend authentication.

What MCast NEVER Collects or Stores

We never collect, view, or store:

Your Google password or login credentials
Your Gmail emails, contacts, calendar, or Google Drive files
Your personal search or YouTube watch history
Your private, unlisted, or members-only video files
Your payment methods, credit card details, or banking information

3. Google OAuth Authentication & YouTube Account Connections

MCast uses standard Google OAuth 2.0 authorization code flows:

Initiation in Minecraft: An authorized player types /link youtube. The plugin requests a temporary link session from https://api.mcast.fun.
Cryptographic State Binding: When the player visits the linking URL (https://mcast.fun/link/<code>) and clicks "Connect with Google & YouTube", our backend signs a tamper-proof HMAC-SHA256 state token binding the browser session to that specific Minecraft player UUID.
Google Consent Screen: The player is redirected to Google's official OAuth consent screen (accounts.google.com) where they inspect the requested read-only permissions and grant access.
Direct Server-Side Exchange: Google redirects back to our central backend callback (https://api.mcast.fun/v1/oauth/callback). Our backend validates the signed state token, exchanges the authorization code directly with Google for tokens, encrypts the refresh token, and maps the YouTube channel to the Minecraft UUID.
Confirmation: The player is redirected to the confirmation page on mcast.fun, and their in-game server confirms the link in chat.

Security Isolation: At no point during or after this flow does the Minecraft Paper server or its administrators receive, touch, or process your Google tokens. All OAuth exchanges and token storage occur strictly on our hardened central backend.

4. Google & YouTube API Data Requested

We request strictly the minimum OAuth scope required to operate our service:

Scope URI	Permission Level	Exact Purpose
https://www.googleapis.com/auth/youtube.readonly	Read-Only	Allows MCast to view your YouTube channel profile and query whether your channel has an active live stream. We cannot modify, delete, upload, or manage any videos or comments.

Our backend communicates with the following specific YouTube Data API v3 endpoints:

GET /youtube/v3/channels?part=snippet&mine=true: Used only once upon initial linking to retrieve your channel ID, title, handle, and avatar.
GET /youtube/v3/liveBroadcasts?part=snippet,status: Used during scheduled polling to check if your broadcast status is actively streaming.
GET /youtube/v3/videos?part=snippet,topicDetails: Used to inspect the video category (categoryId = 20, Gaming) and topic metadata to ensure the stream is Minecraft gameplay before enabling the badge.

5. Google API Services User Data Policy Compliance

Mandatory Compliance Disclosure:

MCast's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In accordance with Google's Limited Use requirements:

Specific Feature Use Only

We use Google user data solely to provide and improve user-facing features—specifically displaying your in-game live nametag and chat broadcast on your authorized Minecraft servers.

No Transfer or Resale

We do not transfer or sell user data to third parties, advertising platforms, data brokers, or information resellers under any circumstances.

No Advertising Use

We do not use or transfer user data for serving personalized, retargeted, or interest-based advertisements.

No AI/ML Model Training

We do not use data obtained through Google Workspace or YouTube APIs to train generalized artificial intelligence (AI) or machine learning (ML) models.

Strict Limits on Human Inspection:

No human beings at MCast are permitted to read or inspect your Google user data, unless:

You have given your explicit affirmative consent to inspect a specific issue (e.g. debugging a failed live detection);
It is necessary for security purposes (such as investigating a bug or system abuse); or
It is required to comply with applicable laws, regulations, or legal processes.

6. Purposes for Which Data Is Accessed and Processed

User data is processed exclusively for the following operational purposes:

Live Broadcast Verification: Checking whether your channel is streaming live and validating whether the broadcast is categorized as Minecraft gaming.
Nametag Synchronization: Informing your connected Minecraft server to append or remove the non-destructive LIVE suffix to your player nametag in real time.
Automated Chat Announcements: Triggering fair in-game chat broadcasts on your server when you start streaming, subject to server-configured cooldowns.
Streamer Dashboard: Allowing you to view your connected channel info, link status, and stream diagnostics on https://mcast.fun/dashboard.
System Integrity & Abuse Prevention: Verifying cryptographic session tokens, rate limiting API calls, and preventing unauthorized player impersonation.

7. Token Handling, Storage & Encryption at Rest

MCast enforces strict cryptographic controls to safeguard tokens throughout their lifecycle:

AES-256-GCM Token Encryption at Rest

Every Google OAuth refresh token is encrypted at rest using industry-standard AES-256-GCM (Galois/Counter Mode). For each encrypted token record, our backend generates:

A cryptographically unique 12-byte initialization vector (token_iv);
A 16-byte authentication tag (token_auth_tag) ensuring tamper detection;
An isolated 256-bit encryption key held strictly in secure production environment variables.

Volatile In-Memory Access Tokens

Short-lived Google access tokens (which expire after 1 hour) are stored exclusively in volatile, in-memory process cache (tokenCache). They are never written to disk, persistent databases, or public storage.

Automated Log Sanitization

Our logging pipeline implements rigorous string sanitizers (sanitizeApiError) that automatically scrub and redact Google access tokens (ya29...), refresh tokens, client secrets, and authorization codes before any log entries are written.

Secure Database Infrastructure

Our database is hosted with Supabase on Amazon Web Services (AWS) using TLS 1.3 transit encryption, encrypted PostgreSQL volume storage, and strict IP access controls.

8. Data Retention & Automatic Expiration

We retain user data only for the period necessary to deliver our services:

Data Element	Retention Period	Purge Mechanism
Link Session Codes	5 Minutes	Automatically invalidated upon consumption or after 300 seconds.
OAuth State CSRF Nonce	10 Minutes	Cryptographically signed with 10-minute validity timestamp.
Live Stream Cache	30–60 Seconds	Short-lived polling cache automatically updated every cycle.
Encrypted Refresh Token	Duration of active link	Purged upon unlinking or token revocation.
Minecraft Player UUID Mapping	Duration of active link	Deleted immediately when account is unlinked.

9. Third-Party Services & Subprocessors

MCast partners only with essential, trusted cloud and infrastructure providers to operate the service:

Google LLC / YouTube API Services: Identity authentication, OAuth token exchange, and broadcast status queries. Governed by the Google Privacy Policy and YouTube Terms of Service.
Supabase / Amazon Web Services (AWS): Secure PostgreSQL database hosting with encryption at rest and connection pooling.
Render Services, Inc.: Hosting for the central MCast backend microservice (api.mcast.fun).
Vercel Inc.: Hosting and edge delivery for the web portal at mcast.fun.

We do not sell, rent, license, or disclose your information to any third party for marketing, promotional, or data brokering purposes.

10. Cookies, Local Storage & Logging

No Tracking Cookies: The MCast website does not use tracking cookies, retargeting pixels, or third-party behavioral advertising scripts.

Technical Logging: Our cloud hosting providers record standard HTTP access logs (including visitor IP address, user-agent string, HTTP status code, and request timestamp) for security monitoring, DDoS mitigation, and operational diagnostics. These logs are retained for standard operational periods and purged automatically.

11. How to Disconnect Accounts & Revoke Permissions

You maintain total control over your YouTube channel association and can disconnect at any time using any of the following methods:

Method 1: In-Game Disconnect (Instant)

Log into any Minecraft server where your account is linked and run:

/link youtube unlink

This command immediately deletes the player link record, removes the nametag badge, and halts live status polling for your channel.

Method 2: Google Account Security Settings (Global Revocation)

You can revoke MCast's OAuth access directly through your Google account dashboard at any time:

Navigate to Google Account Third-Party Apps & Services (https://myaccount.google.com/permissions).
Select MCast (or Minecraft Server YouTube Live Connector).
Click "Delete all connections you have with MCast".

Once revoked, Google invalidates the refresh token. When our backend attempts its next status check, Google returns an invalid_grant error. Our system immediately flags the token as revoked, ceases all API requests to Google, and removes the in-game LIVE badge.

12. Data Deletion Requests (Right to Erasure)

Under GDPR, CCPA, and standard privacy principles, you have the right to request full and permanent deletion of any data associated with your identity.

To request complete deletion of your data:

1. Send an email to contact@mcast.fun with the subject line "Data Deletion Request".

2. Include either your Minecraft Player Username / UUID or your YouTube Channel ID (or custom handle) so we can locate your record.

3. Upon receipt and verification, our team will permanently purge your encrypted refresh token, channel metadata, player associations, and stream cache entries from our database within 30 days, and send you written confirmation.

13. Children's Privacy

MCast does not knowingly collect or solicit personal information from children under the age of 13 (or under 16 in the European Economic Area / UK), in accordance with the Children's Online Privacy Protection Act (COPPA) and GDPR.

Our services are intended for Minecraft players and content creators who are at least 13 years old. If we learn that we have collected personal data from a child under the applicable age without verifiable parental consent, we will promptly delete that information from our servers. If you believe a child has provided us with their YouTube account or Minecraft information, please notify us immediately at contact@mcast.fun.

14. Changes to This Privacy Policy

We may revise this Privacy Policy from time to time to reflect operational, technological, or regulatory developments, or updates to Google API policies.

When updates are made, we will update the "Last Updated" date at the top of this document. For material changes affecting the collection or processing of your information, we will provide prominent notice on https://mcast.fun or in the MCast software documentation. Your continued use of MCast after the effective date of an updated policy signifies your agreement to the updated terms.

15. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our security and data handling practices, please contact our team:

Project: MCast (LiveStatus)

Privacy Inquiries: contact@mcast.fun

Official Website: https://mcast.fun

Open Source Codebase: GitHub Repository