Back

※1 If there is any issue or discrepancy with other terms pages, the Japanese Terms of Service shall prevail.
※2 These translations are generated by machine translation. For accurate terms, please refer to the Japanese version.

NyanCast Privacy Policy

KuronekoServer (the “Organization”) appropriately handles information processed in the desktop application “NyanCast” and its connection signaling service (collectively, the “Service”) in accordance with this Policy, Japan’s Act on the Protection of Personal Information, and other applicable laws.

Introduction: Key privacy points

  • Screens, cameras, and audio selected by DJs are transmitted directly to the VJ’s device using WebRTC. The Organization’s signaling servers do not relay, record, or store shared media.
  • To establish connections, the Organization’s Cloudflare Worker processes IP addresses, room IDs, roles, DJ display names, random device identifiers, SDP, ICE candidates, and similar information.
  • P2P connections may disclose public IP addresses, ports, and similar information to the connected peer. Network information is also sent to Cloudflare STUN and the backup Google STUN service.
  • Optional room passwords are sent to the signaling service over encrypted HTTPS connections. Plaintext passwords are not stored; salted PBKDF2-SHA-256 verification data is retained until the room closes.
  • The application’s display language, recent room settings, display name, input devices, quality settings, and startup settings are stored on the User’s device. Room passwords, shared media, and connection tokens are not included in saved device settings.
  • The Service does not serve advertisements, perform advertising tracking, or profile user behavior. Cloudflare operational logs and aggregate metrics are used for incident response and safety.
  • It is not technically possible to prevent legitimately connected recipients from recording shared content using external functions or equipment. Always check whom you are sharing with and what you are sharing.

1. Scope and Roles of the Parties

  1. This Policy applies to people who create rooms, share screens, cameras, or audio, receive such content, view related pages, or inquire about the Service.
  2. The Organization determines the purposes and methods of handling information for the signaling service and the operational logs it manages.
  3. Media shared from DJs to VJs is sent directly to recipients selected by Users. If a VJ or other recipient records, uses, or provides shared content to third parties, that recipient is responsible for complying with applicable laws, agreements with the sharer, and necessary rights clearance.
  4. This Policy does not mean that the Organization is the entity responsible for handling recordings, streams, storage, or disclosures to third parties undertaken by Users outside the Service.

2. Information Collected or Processed

2.1 Signaling Service

When Users connect to the Service, the Organization and Cloudflare, the signaling infrastructure provider, collect or process the following information.

  1. Source IP addresses, ports, access dates and times, request destinations, HTTP methods, HTTP headers, response statuses, errors, and other technical information associated with communications
  2. User-entered room IDs, VJ or DJ roles, DJ display names, and connection dates and times
  3. A randomly generated 32-character device identifier created when the application starts. This identifier is not an account ID and is regenerated each time the application restarts.
  4. SDP, ICE candidates, corresponding destination identifiers, and connection errors needed to establish WebRTC connections
  5. Temporary host tokens issued to VJs, temporary join tokens issued to DJs, and each token’s expiration time
  6. WebSocket connection status, participant roles, device identifiers, DJ display names, and join dates and times
  7. Status indicating whether a room is being created, accepting connections, or closed

SDP and ICE candidates may contain Users’ IP addresses, ports, network configuration, or technical information about their devices. The Service’s application forwards them to the connected peer in real time and does not store them in a persistent database.

2.2 Room Passwords

  1. If a VJ sets an optional room password, it is sent to the signaling service over an encrypted HTTPS connection.
  2. The signaling service does not persistently store plaintext passwords. It converts them into PBKDF2-SHA-256 verification data using a random salt and 100,000 iterations, and uses that data to verify room entry.
  3. Host tokens and password verification data created before the VJ connects are valid for up to 5 minutes. After the VJ connects, password verification data is retained until the room closes.
  4. DJ join tokens are valid for 60 seconds and are deleted upon their first connection or when the room closes. Expired join tokens are also deleted by the time the room closes.
  5. The Organization cannot recover passwords. Do not use passwords used on other services or personal information as room passwords.

2.3 Shared Media and P2P Data

  1. DJ-selected screens, application windows, camera video, microphone audio, and computer output audio
  2. Input status, including sharing type and pause status, sent from DJs to VJs over an encrypted WebRTC data channel
  3. Connection statistics calculated and displayed on Users’ devices, such as traffic volume, bitrate, round-trip latency, and packet loss rate

These are transmitted directly between DJ and VJ devices or calculated on those devices. The Organization’s signaling servers do not relay, record video or audio, analyze, or store shared media or data channel contents.

2.4 Information Disclosed to P2P Peers and STUN Services

  1. To establish direct WebRTC connections, public IP addresses, ports, communication methods, and other network information may be disclosed to the connected peer.
  2. The Service prioritizes Cloudflare STUN and uses Google STUN as a backup. Because it attempts to connect to both STUN services during candidate gathering, each provider may process IP addresses, ports, access dates and times, and other technical information associated with the connection.
  3. The Service does not use TURN relays. It does not send shared media to Cloudflare or Google STUN servers.

2.5 Information Stored or Processed on Users’ Devices

  1. Display language
  2. Recently used VJ or DJ role, room ID, and DJ display name
  3. Sharing type, screen-sharing source identifiers and names, camera or audio device identifiers, and horizontal mirroring settings
  4. Video and audio quality settings, monitoring output destinations, and startup display settings
  5. Screen, camera, and microphone access permission status managed by the OS or WebView
  6. Screen or window thumbnails temporarily generated on the device to select a sharing source

The desktop application uses Tauri Store, and the browser version uses localStorage. If saving is disabled, recent room settings, display names, device references, and quality settings are not saved. Room passwords, shared media, participant lists, connection status, host tokens, and join tokens are not included in saved device settings.

2.6 Inquiries and Reports

When receiving inquiries, rights infringement notices, abuse reports, or vulnerability reports, the Organization may collect names or display names, email addresses, inquiry details, room IDs, incident dates and times, logs, screenshots, and other information necessary to investigate and respond.

3. Purposes of Use

The Organization uses collected or processed information for the following purposes.

  1. Creating rooms, verifying eligibility to join, connecting participants, and forwarding connection information between VJs and DJs
  2. Enforcing participant limits, roles, connection permissions, message formats, and other restrictions
  3. Establishing P2P connections, displaying connection status, and checking communication quality
  4. Providing and maintaining the Service, analyzing failures, improving quality, and aggregating usage information
  5. Detecting, investigating, and preventing attacks, unauthorized access, brute-force attempts, excessive load, violations of the Terms, and other abuse
  6. Responding to inquiries, reports, rights infringement notices, objections, and vulnerability reports
  7. Fulfilling legal obligations, addressing disputes, and protecting the rights and safety of the Organization or third parties

The Organization does not use information processed in the Service for advertising, advertising tracking, credit assessment, or profiling user behavior.

4. Storage Locations and Retention Periods

  1. Settings on a device are retained until the User clears them in the application or deletes application data using browser or OS functions.
  2. Room status, password verification data, WebSocket connection information, and unused join tokens in the signaling service are, as a rule, deleted when the VJ disconnects and the room closes.
  3. Signaling messages such as SDP and ICE candidates are forwarded to the connected peer in real time and are not persistently stored by the Service’s application.
  4. Cloudflare Workers invocation logs may contain requests, responses, errors, and related metadata. These logs are retained for up to 7 days, depending on the Cloudflare plan in use.
  5. Aggregate Cloudflare Workers metrics, including request counts, errors, and execution times, may remain available for viewing for up to 3 months to monitor service operations.
  6. Information relating to abuse, security incidents, rights infringements, inquiries, or disputes may be retained for as long as reasonably necessary to respond, fulfill legal obligations, or preserve rights.
  7. Where a lawful preservation request is received under applicable law or from a court or other competent authority, necessary information may be retained beyond the periods stated above.

5. Service Providers and Transmission to Third Parties

5.1 Cloudflare

The Organization uses Cloudflare to provide signaling APIs, WebSocket, Durable Objects, STUN, DDoS protection, operational logs, and aggregate metrics. Cloudflare processes end-user IP addresses, traffic routes, requests, connection information, and operational data to the extent necessary to provide the Service.

Cloudflare Privacy Policy

5.2 Google

The Service registers Google’s public STUN service as a connection candidate in case Cloudflare STUN cannot be reached. Because WebRTC candidate gathering also attempts to connect to Google STUN, Google may process IP addresses and technical information associated with the connection.

Google Privacy Policy

5.3 Connected Peers

When a User creates or joins a room and starts a P2P connection, public IP addresses, ports, and other connection information may be sent to the connected peer. When a DJ chooses to start sharing, the selected shared media and input status are sent to the VJ. These transmissions are necessary to enable communications with the peer in the room specified by the User.

5.4 Other Disclosures

The Organization does not provide collected personal data to third parties without the User’s consent, except in the following cases.

  1. Where required or permitted by law
  2. Where necessary to protect a person’s life, body, or property and obtaining the person’s consent is difficult
  3. Where particularly necessary to improve public health or promote the sound development of children and obtaining the person’s consent is difficult
  4. Where cooperation is needed for a national or local government body or similar entity to perform duties prescribed by law, and obtaining the person’s consent could impede those duties
  5. Where all or part of the handling is outsourced to the extent necessary to achieve the purposes of use
  6. Where information is provided in connection with a merger, business transfer, or other business succession

The Organization does not sell personal information collected or processed in the Service.

6. Processing outside Japan

  1. Cloudflare Workers may process requests at locations close to Users. No regional restriction is set for each room’s Durable Object; as a rule, it is placed in a Cloudflare data center close to the initial request, so information may be processed or stored outside Japan.
  2. Connections to Google STUN may also be processed on equipment outside Japan.
  3. When using overseas service providers, the Organization endeavors to provide necessary supervision and information protection through contracts, providers’ security measures, and other methods compliant with applicable laws.

7. Security Measures

The Organization takes reasonable measures, including the following, to prevent leakage, loss, or damage to information it handles and otherwise ensure its security.

  1. TLS encryption for signaling APIs and WebSocket
  2. WebRTC encryption of shared media and data channels in transit
  3. Conversion of room passwords into salted PBKDF2-SHA-256 verification data
  4. Short-lived, single-use host and join tokens
  5. Signaling restricted to the VJ and the relevant DJ, without a public room directory
  6. Validation of room IDs, device identifiers, display names, SDP, ICE candidates, and message sizes
  7. Restrictions on personnel and permissions for access to operational information

These measures do not guarantee complete prevention of all unauthorized access, information leakage, recording on devices, or communication risks.

8. User Controls and Choices

  1. Sharing begins when a DJ selects a sharing source and starts sharing. A pre-sharing confirmation screen, pause function, and leave function are available.
  2. Users can change screen, camera, and microphone access permissions in OS settings. Revoking permissions may make some or all sharing functions unavailable.
  3. Recent VJ and DJ settings can be cleared in the application’s settings. The browser version also allows use of the browser’s site-data deletion function.
  4. There is no function to save room passwords on the device. Closing a room deletes that room’s connection status and password verification data.

9. Requests for Disclosure, Correction, Deletion, and Other Actions

  1. Under applicable laws, Users may request notification of purposes of use, disclosure, correction, addition, deletion, cessation of use, or cessation of provision to third parties of information the Organization holds about them.
  2. To make a request, contact support[at]krnk.org. Replace [at] with @ when sending. The Organization may request information necessary to verify identity and identify the relevant information.
  3. The Service does not use accounts, device identifiers change at every startup, and much connection information is deleted when a room closes. As a result, the Organization may no longer hold the relevant information or may be unable to associate it with the requester. Where possible, provide the date and time of use, room ID, role, and DJ display name.
  4. Requests may not be fulfilled for information that must be retained for legal obligations, investigations of abuse or rights infringements, dispute resolution, or protection of third-party rights. In such cases, the Organization will explain the reasons unless notification is prohibited by law.

10. Information about Minors

Minors must obtain their legal representative’s consent and complete other procedures required by law before using the Service. If the Organization confirms that it has collected information about a minor without necessary consent, it will delete the information or take other necessary action to the extent legally and technically possible.

11. Changes to This Policy

  1. The Organization may amend this Policy in response to changes in laws, Service features, information handling, or external services used.
  2. For significant changes, the Organization will announce the changes and their effective date on the official website, within the application, or by other appropriate means. Separate consent will be obtained for changes that require consent under law.

12. Contact

For inquiries about this Policy, information handling in the Service, or requests for disclosure and other actions, contact support[at]krnk.org. Replace [at] with @ when sending.

To report security vulnerabilities, use the vulnerability reporting contact.

Established: 2026/09/03