Summary
- Jawjack runs on your computer. Google and YouTube API requests go directly from your computer to Google and YouTube.
- Google sign-in is optional. Native YouTube integration is currently available for development; production releases show Coming soon.
- Saved sign-in credentials use Windows Credential Manager on Windows or the desktop system keyring on Linux. They are separate from ordinary settings files.
- Jawjack does not send analytics or telemetry to Zombie Digital and does not sell Google user data, use it for advertising or use it to train AI models.
Google and YouTube data
When access is requested
Jawjack requests Google authorization when you choose Connect Google account under Settings → Connections → YouTube. It requests https://www.googleapis.com/auth/youtube.force-ssl for the YouTube features below. An optional API key provides read-only access without Google sign-in; it does not authorize posting or moderation.
Data accessed and its uses
For YouTube streams you choose, Jawjack reads stream titles, channel information, broadcast/live-chat identifiers, chat messages, author display names and channel identifiers, and the badges and live-chat events returned by YouTube. It uses this information to display the selected chat and its source, and to resolve live-stream links. When enabled for your connected account, it checks that account's owned broadcasts, including scheduled chats, to establish owner controls.
When you submit a chat message, Jawjack sends that text to the selected YouTube chat. When you request an available moderation action and your account has the required authority, Jawjack can delete the selected chat message, time out a selected chatter, or ban that chatter from the channel's chat. These actions affect YouTube itself. Jawjack does not upload, edit or delete videos, manage ordinary video comments, change subscriptions or perform unrelated operations enabled by the broader wording of Google's permission.
How Google user data is protected
- Encrypted network connections: Google API and token requests use HTTPS/TLS with certificate verification, which protects credentials and API data in transit.
- Authorization protection: the desktop sign-in flow uses PKCE (S256), random state checked on the callback, and a temporary callback listener bound to the local computer's loopback address.
- OS credential protection: persistent Google refresh credentials are stored through Windows Credential Manager or the Linux system keyring, using that service's access controls and protection. Jawjack does not fall back to a plaintext credential file when that service is unavailable. It reports storage failures; a sign-in that cannot be saved can remain available only for the current session.
- Separation from other services: Google credentials are used for Google/YouTube requests, not sent to Twitch, emote providers, OBS, Streamer.bot or a Kick relay. Google API traffic is not routed through Zombie Digital.
OS credential protection depends on the availability and security of your credential service, user account and device. Ordinary local app settings, saved drafts, backups and user-created text files are not encrypted by Jawjack. The OS credential store protections above do not mean that all local files are encrypted.
Storage, retention and deletion
Google access tokens are held in the running app; refresh credentials needed to restore your connection are retained in the OS credential store until you remove the saved connection. Received YouTube chat is kept in the app's bounded in-memory history. Your local workspace can save stream identifiers, unsent drafts and reply context so your work can be restored. Local workspace backups may retain older copies. Jawjack's current automatic text chat logger accepts Twitch channel names; it does not automatically create YouTube chat log files.
You can sign out under Settings → Connections → YouTube. This invalidates the current session and requests removal of saved Google credentials. If the credential service cannot remove them, the app reports that failure so you can unlock the service and retry. Local sign-out does not revoke the grant at Google or delete messages you already posted.
To revoke the Google grant, use your Google account's third-party access controls. You can remove local drafts, workspace data and backups from your computer separately. Files you explicitly copy or export, and backups maintained by your operating system or other software, remain under your control; uninstalling the executable alone does not necessarily remove them. Zombie Digital has no hosted copy of these local Google credentials or workspace files.
Sharing and Limited Use
Jawjack does not send your Google credentials or Google API responses to Zombie Digital for storage, analytics, advertising, resale or AI training. Your deliberate YouTube posts and moderation requests are sent to Google/YouTube; they are handled under those services' terms and policies. If you deliberately copy information, open a source link, share a recording or enable development control, the information exposed by that action depends on what you choose to share.
Jawjack's use and transfer of information received from Google APIs will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements.
YouTube API Services and limits
Jawjack uses YouTube API Services. By using those services through Jawjack you agree to theYouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy.
API use is subject to the credential project's daily allowance, shared by users of that project. It resets at midnight Pacific time. OAuth verification and approval of additional API quota are separate processes.
Twitch, emotes and optional integrations
Twitch sign-in uses Twitch's OAuth flow and the OS credential service. Twitch, 7TV, BTTV and FFZ provide chat, channel information, emotes and related presentation data directly to your computer under their respective policies. Optional OBS and Streamer.bot connections use the endpoints you configure. Development-only Kick support can use a configured relay and has a separate account/connection path; it does not receive Google credentials or proxy YouTube API calls.
Settings, layouts, channel lists, drafts, private chatter notes and enabled Twitch text logs are local files. You control their retention and removal, including local backups. Automatic app update checks contact Zombie Digital's download service; opening external links contacts the selected website and is subject to its policy.
Changes and contact
If Jawjack's data handling changes, this policy and its update date will change. Questions about this policy or your data can be sent to[email protected] or through thecontact form.