Storage and privacy
What is stored where
| Data | Stored | Exported |
|---|---|---|
| Connections, sources, accounts, rules, custom games, boards | Local storage | Yes |
| WebSocket and OBS passwords | Memory only | No |
| Webhook headers | Local storage | No |
| REST ingest tokens | Local storage | No |
| Twitch refresh token | Local storage | No |
| Twitch access token | Memory only | No |
| YouTube refresh token | Encrypted managed gateway state | No |
| Google client ID and secret | Operator gateway environment | No |
| YouTube access token | Gateway memory only | No |
| YouTube channel metadata | Separate app-local storage | No |
| Gateway device access and refresh tokens | Separate app-local storage (stream-pulse.gateway.v1) |
No |
| Kick refresh token | Companion credential file | No |
| Kick client secret | Companion environment | No |
| Kick access token | Companion memory | No |
| Companion pairing credential | Separate app-local storage | No |
| Standalone Pro license key and activation instance | Separate app-local storage (stream-pulse.pro.v1) |
No |
| Overwolf identity token and short-lived Pro grant | Memory only | No |
| Companion paired-device token hashes | Companion pairing store | No |
| Webhook delivery/channel URLs | Local configuration | No |
| LLM API key | Memory only | No |
| Activity log (capped at 100 entries) | Memory only | No |
Passwords and LLM API keys must be re-entered after restarting. The simulator and the Overwolf app have separate storage origins.
Pro credentials are sent only to the build-configured Stream Pulse managed gateway, which verifies them with Overwolf or Lemon Squeezy. They are never sent to user-provided gateways or written into portable configuration. See StreamPulse Pro for activation, deactivation and the platform-specific payment policy.
Export and import
Settings > Export JSON / Import JSON moves configuration between the simulator and Overwolf, or between machines. Imported configurations are validated before replacing anything. Secrets are never exported, so re-enter passwords, webhook headers and tokens, and sign in to Twitch and YouTube again after an import. Kick configuration contains only account metadata and a loopback companion origin. The companion stores credentials separately; never share its credential file or expose its local control routes through a tunnel.
Event data
Real GEP payloads are not retained in the activity feed or written to files. Dry-run mapped payloads can be inspected in the simulator.
Managed YouTube authorization
The managed gateway receives Google authorization responses and stores refresh tokens encrypted at rest when persistent gateway storage is enabled. Access tokens remain in gateway memory. YouTube API requests and responses pass through the gateway; channel metadata is returned to the app, never Google tokens. Signing out revokes the gateway device session. When the last device disconnects, the gateway removes its stored Google authorization and requests revocation from Google. Users can also remove Stream Pulse access in their Google account settings. Disconnect remains available when Pro expires. Old device-code tokens and user-entered Google credentials are no longer used and are removed locally during migration.