NanaCast Privacy Policy

This is a translation. If it differs from the Korean original (PRIVACY_POLICY.txt), the Korean original prevails.

Gyunana (the "Operator") complies with the Korean Personal Information Protection Act and related laws in providing the NanaCast viewer, exporter and related web services (nanacast.app, auth.nanacast.app; the "Software"). This policy explains what information the Software handles, where, and how.

The Software has no sign-up and no advertising, analytics or usage statistics (telemetry). Most information is processed only on your PC and is never sent to the Operator.

a. CHZZK connection — only if you press "Connect CHZZK"

•CHZZK authorization tokens (access token, refresh token) and their expiry

•The channel ID and channel name of the connected channel

•Live broadcast events: donations (donor nickname, amount, message, donation type), chat (author nickname, message, role), subscriptions (subscriber nickname, tier, months)

How it is handled

•Tokens and channel information are stored on your PC in %APPDATA%\NanaCast\chzzk.dat, encrypted with Windows Data Protection (DPAPI). Only the same Windows user on the same PC can read them.

•Broadcast events are processed only in your PC's memory to show them on screen. The recent-event list (up to 30 entries) disappears when the program closes and is never saved to a file or sent anywhere.

•The Operator never receives your CHZZK password. You sign in on CHZZK's (NAVER's) official page.

b. Sign-in relay server (auth.nanacast.app)

Issuing CHZZK tokens requires the Operator's app secret. To keep that secret off your PC, the Operator's relay server requests token issuing, refreshing and revoking on your behalf.

•When signing in: it exchanges the authorization code from CHZZK for tokens and keeps them for up to 5 minutes. They are deleted as soon as the viewer collects them, and automatically after 5 minutes otherwise.

•When refreshing or disconnecting: it only forwards the token sent by the viewer to CHZZK and does not store it.

•The relay server runs on services of Cloudflare, Inc. Cloudflare may process access records (IP address, request time, browser information, etc.) to provide and secure its service. The Operator does not collect or analyse these records.

c. Camera and microphone

•When webcam face/body tracking or microphone lip sync is on, video and sound are analysed in real time on your PC only. They are never saved or sent anywhere.

d. Connections to other programs

•iFacialMocap, the VMC protocol, VRChat (OSC), OBS (WebSocket) and Spout communicate directly with your PC or devices you specify on your local network. Nothing is sent to the Operator.

•Your OBS password is stored in the settings file on your PC.

e. Files stored on your PC

•Settings: %USERPROFILE%\AppData\LocalLow\NanaCast\NanaCast\settings.json

•Program log (for troubleshooting): Player.log in the same folder

•Content and captures: Documents\NanaCast (or a folder you choose)

These files are not sent to the Operator unless you send them yourself.

f. Website and package repository (nanacast.app)

•When you view the website or download exporter packages (including through VCC), Cloudflare may process access records. The Operator uses no cookies or tracking tools.

•To receive CHZZK broadcast events (donations, chat, subscriptions) and show them on screen

•To show the CHZZK connection status (channel name) and keep you signed in

•To provide the Software's features such as tracking, staging and output

•CHZZK tokens: "Disconnect" deletes the file on your PC immediately and asks CHZZK to revoke the tokens. A refresh token expires at CHZZK after 30 days without use.

•Temporary tokens on the relay server: deleted automatically after at most 5 minutes.

•Broadcast events: gone when the program closes.

•Settings and log files: remain on your PC until you delete them (see section 5).

4.Disclosure to third parties, outsourcing and international transfer

•The Operator does not provide your information to third parties.

•Outsourcing: operation of the relay server and website is entrusted to Cloudflare, Inc.

•International transfer: Cloudflare runs its service in data centres around the world, including the United States, so the following may be processed abroad:

•Recipient: Cloudflare, Inc. (United States)

•Items: CHZZK authorization codes and tokens (kept up to 5 minutes), access records

•When and how: at sign-in, token refresh and disconnect, sent over an encrypted connection (HTTPS)

•Retention: tokens up to 5 minutes; access records per Cloudflare's policy

If you do not want this transfer, simply do not use the CHZZK connection. All other features keep working.

•The CHZZK connection itself is subject to NAVER Corp.'s privacy policy.

•Disconnect: "Connect → CHZZK → Disconnect" in the viewer deletes the tokens on your PC and requests revocation. You can also remove the connection in CHZZK's settings.

•Delete files: deleting these folders removes everything the Software left on your PC:

•%APPDATA%\NanaCast

•%USERPROFILE%\AppData\LocalLow\NanaCast

•Documents\NanaCast (it holds your avatars, stages and captures — move what you need first)

•For other requests (access, correction, deletion, suspension), contact us below and we will respond without delay.

•Tokens are stored encrypted with Windows Data Protection (DPAPI).

•All server communication is encrypted with HTTPS.

•The CHZZK app secret is kept only in the relay server's secret store, never in the program.

•Only the minimum CHZZK permissions are requested (user info, donations, chat messages, subscriptions).

The CHZZK connection follows CHZZK's (NAVER's) terms. Users under 14 must have consent from a legal guardian.

•Privacy officer: Gyunana

•Contact: X (Twitter) @Gyunana_VRC

In Korea you can also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972).

Changes to this policy are announced on nanacast.app 7 days before they take effect.

This policy takes effect on October 16, 2026.