Overview
LiveBand Sunday Stream (“SundayStream”) and LiveBand Studio – LiveStream (“Studio”) — together “the App” — are developed by GraniteVector Systems, LLC (“we”, “us”, “our”). This policy describes how they handle your data. SundayStream runs on iPhone, iPad and Mac; Studio is a separate Mac app for livestreaming. Sections marked (LiveBand Studio – LiveStream) apply only to Studio; SundayStream itself does not livestream.
Summary
We do not collect any personal data. The App does not use analytics, advertising, or tracking services. All app data is stored locally on your device unless you choose to enable iCloud sync or use an optional feature that sends content where you direct it (Cloud AI, streaming, YouTube/Facebook accounts, remote guests), each described below. None of it is sent to us.
Data We Collect
None. The App does not require an account, login, or registration with us. (Signing in to YouTube or Facebook in Studio is optional and goes directly to those platforms — see below.) We do not collect names, email addresses, phone numbers, location data, device identifiers, or any other personal information.
Data Stored on Your Device
The App stores the following data locally:
- Songs, lyrics, chord charts, and setlists you create or import
- Learning progress and practice statistics
- App preferences and settings
- (LiveBand Studio – LiveStream) Stream configuration (RTMP URLs, SRT settings) if you use streaming features
- (LiveBand Studio – LiveStream) Stream keys and passphrases, stored securely in your Mac’s Keychain
- (LiveBand Studio – LiveStream) Recordings you make — program/ISO video files and, if you enable multi-track audio recording, one local audio file per mixer channel plus the master mix (with a small session manifest for editing software). These are ordinary local files in your chosen recordings folder; they are never transmitted to us
- (LiveBand Studio – LiveStream) The Web Remote’s self-signed TLS certificate, stored in your Mac’s Keychain (see “Web Remote Control” below)
- (LiveBand Studio – LiveStream — not available in version 1.0; a later version) If you sign in to YouTube or Facebook, the sign-in session (access and refresh tokens) that platform issues, stored in your Mac’s Keychain (see “YouTube and Facebook Accounts” below)
- (LiveBand Studio – LiveStream) Your graphics designs (including pictures you add to them), macros, button panel, extra destinations (their stream keys in the Keychain) and a scheduled go-live time
- (SundayStream, Mac and iPad) Presentations, looks, pictures, videos and sounds you add to the Present tab, its timers, key bindings, MIDI mappings and timecode cues, and the web browser remote’s self-signed TLS certificate (in the Keychain)
- Show Mode PIN (iOS Controller), stored only as a salted SHA-256 hash in your device’s Keychain — we never store the PIN itself, and it is never transmitted
- Device-pairing credentials for App-Link remote control, companion-camera connections, the connection between SundayStream and Studio (LiveBand Link), and the Presenter Remote — the pairing PIN (as a salted hash) and a per-device pairing key are stored in your device’s Keychain (this-device-only); trust is bound to that key, not to a device name, so only devices you have paired can reconnect. None of this is transmitted to us
- Crash diagnostics from Apple’s MetricKit framework, stored locally with file-level encryption and never transmitted to us. Reports older than 7 days are automatically deleted
- Studio diagnostics trail (LiveBand Studio – LiveStream, off by default). If you switch on Developer Diagnostics in Studio’s Live Settings, the App records a local troubleshooting log of your studio session — which controls you used, scene and take operations, sources added or removed, stream/record start and stop, and how smoothly window and divider drags performed. It is written only to a file inside the App’s own container on your Mac. It contains no personal data, no audio, and no video; stream destinations are reduced to their host name so stream keys and pairing PINs are never written. Nothing is transmitted to us — the log is included in a diagnostics export only if you choose to create one and send it. The switch is off unless you turn it on, and Clear Trail deletes the file
- LiveBand AI assistant conversations — the assistant keeps multiple saved chats (each auto-titled from its first question), stored locally so they persist between sessions. You can reopen, continue, or delete any conversation, or Clear All, at any time. Answers are generated on your device by default; if you turn on the optional Cloud AI feature, your questions and the related context described under “On-Device AI” below are sent to your chosen provider (Anthropic, OpenAI, or Google) to generate the answer. Nothing is sent to us in any case
- AI insight cache — the automatic insight cards (Bible chapter summaries and cross-references, setlist suggestions and flow notes, practice and transition tips, library insights) are kept in the App’s local cache folder for 7 days so they don’t regenerate every time you look; entries expire on their own and Erase All Content & Settings deletes them
- AI diagnostics — a local record of the last 40 assistant calls (which feature, whether it ran on-device or in the cloud, how long it took, token counts, which tools it used, whether web search ran, and any failure kind) stored in the App’s own container and included only in a Diagnostics export you choose to create. It never contains your question or the answer (a short prompt preview is recorded only while you have the developer AI debugger switched on). Erase All deletes it
This data stays on your device. It is not sent to us, and not sent to any third party except where an optional feature you turn on says so below (iCloud sync, Cloud AI, streaming, web import, Band Sync).
iCloud Sync (Optional)
If you enable iCloud sync in the App’s settings, your songs and setlists — including any Scripture readings you’ve added to a setlist — are synced to your personal iCloud account via Apple’s CloudKit service. This data is managed by Apple under Apple’s Privacy Policy. We do not have access to your iCloud data. You can disable iCloud sync at any time.
Streaming (LiveBand Studio – LiveStream)
When you use Studio’s livestreaming features, audio and video content is transmitted directly to the streaming destination you configure (for example, YouTube, Facebook, or a custom RTMP/SRT server). This content goes directly from your device to your chosen destination. We do not receive, store, route, or have access to your streamed content. You are responsible for your streaming destination’s privacy practices.
Local Network
The App may use your local network to discover and control audio mixers (via OSC), PTZ cameras (via VISCA-over-IP) and MIDI devices; to connect SundayStream with Studio, with a Presenter Remote or Stage Display, and with a backup Mac or iPad; to serve the Present tab’s optional web browser remote; to receive companion-camera video in Studio; to send tally signals from Studio; and to find other LiveBand Sunday Stream devices for Band Sync. All local network communication stays on your network. No data from these connections is transmitted to us.
SundayStream ↔ LiveBand Studio – LiveStream (LiveBand Link) and the Presenter Remote
If you connect SundayStream to Studio (SundayStream Settings ▸ LiveBand Studio – LiveStream), SundayStream sends your songs, setlists and what the room’s screen is showing to Studio on your Mac, and Studio can send previous/next commands back. Studio keeps a copy of the songs and setlists it receives on that Mac. If you pair an iPhone or iPad as a Presenter Remote or Stage Display for SundayStream on a Mac or iPad, the two exchange commands, the current and next slide, the operator’s message and notes, and the timers. A second Mac or iPad set up as a backup receives the same service state from the primary. These connections are paired once with a PIN, then encrypted, and stay on your local network; nothing is sent to us.
Web Browser Remote (SundayStream Present Tab)
On a Mac or iPad, SundayStream’s Present tab can run an optional web browser remote — a small web server on your device that phones, tablets and computers on your local network can open to step the slides. It is off until you turn it on. It is HTTPS by default, with a self-signed certificate made on your device and kept in its Keychain (its fingerprint is shown so you can check it); every request needs the access code, which travels after the # in the address. A plain-HTTP mode for old browsers is off by default and warns that the access code would then cross your network unencrypted. The page shows only the live and next slide text, and nothing from it leaves your local network or reaches us.
iPhone Companion Camera
If you use an iPhone or iPad as a wireless camera for Studio, the video and audio captured by that iPhone are sent over your local network to your own Mac, and nowhere else. The connection is discovered with Bonjour and made directly between your two devices; the content is not uploaded, stored by us, or routed through any server of ours. If you then broadcast, that video leaves your Mac only as part of the stream you have configured (see “Streaming” above).
Pairing is protected by a PIN that your Mac generates for each pairing session. Only a salted hash of that PIN is stored, in your Mac’s Keychain; the PIN itself is shown on screen while you pair and is never written to disk, logged, or transmitted. A paired iPhone is remembered by a per-device key so it can reconnect without a PIN, and you can revoke any paired camera — individually or all at once — at any time, which disconnects it immediately.
Remote Guests (LiveBand Studio – LiveStream and SundayStream on iPhone)
Studio can invite a remote guest who is not on your network. Studio makes an invite code holding your Mac’s public and local addresses, a port, a random encryption key and an expiry time (12 hours); you send that code to the guest yourself. A guest who chooses Companion Camera ▸ Join as Remote Guest in SundayStream on an iPhone sends their camera video and microphone sound over the internet directly to your Mac, encrypted with the key in the code. There is no relay server and nothing passes through us. To learn your public address and what kind of network you’re on, Studio sends small network-check requests (STUN) to a public STUN server (by default stun.stunprotocol.org); like any internet server, that server sees your public IP address, and nothing else about you or your stream. Anyone who has the invite code can try to join, so share it only with your guest; Stop Inviting ends it.
Live Captions (LiveBand Studio – LiveStream)
If you turn on Live Captions, Studio transcribes speech in your program mix using Apple’s Speech framework with on-device recognition required, so no audio is sent to Apple or anyone else. Captions appear only on your own outputs and stream; transcripts are not stored. Captions need your permission for speech recognition.
YouTube and Facebook Accounts (LiveBand Studio – LiveStream, optional)
Not available in LiveBand Studio – LiveStream 1.0. Platform sign-in ships in a later version; until then Studio makes no request to YouTube or Facebook and stores no account session. The paragraph below describes how it will work.
Studio can sign in to YouTube and Facebook so it can create broadcasts, show your live chat and comments, and show viewer counts. Sign-in happens on the platform’s own page in the system sign-in sheet — Studio never sees your password. The session the platform issues is kept in your Mac’s Keychain. While signed in, Studio talks directly to that platform’s API (Google’s YouTube Data API, Meta’s Graph API) to do what you ask: create a broadcast with the title, description, privacy, start time and thumbnail you enter; start and end it; read your broadcast’s chat and comments and viewer counts; and post the replies you type. Nothing passes through us. Those platforms’ own privacy policies apply to what they receive. These features need a developer app registered with each platform. LiveBand Studio – LiveStream 1.0 ships without one, so the sign-in feature is not shown and Studio makes no request to these APIs; stream keys you paste work without any account. Signing out removes the session from your Mac.
Band Sync
When you use Band Sync to synchronize setlist playback and song content with other band members, the App can communicate in two ways:
- Local (Bluetooth / Wi-Fi): Uses Apple’s MultipeerConnectivity framework to communicate directly between nearby devices. All communication is encrypted and stays between the connected devices. Local sessions use pairing codes for secure connections.
- Cloud (CloudKit sharing): When local connectivity is unavailable, Band Sync can optionally share session state and song content with anyone you give the session link to, using Apple’s CloudKit sharing (CKShare). The session leader creates the session inside a private area of their own iCloud account (a custom zone of the leader’s private CloudKit database) and shares it through an invite link. Anyone who has that link can open it to read and update the shared session data — song content, setlist playback state, and basic presence (device name and online status) — so you should only share the link with people you trust. The data is not placed in any public, shared-with-everyone, or developer-controlled database, and we never have access to it. When the leader ends the session, the shared session record (and the share itself) is deleted from their iCloud.
When you project a Bible verse as a scripture slide during a local Band Sync session, the verse currently on screen (its reference and text) is shared with the connected devices so they can display the same slide; this rides the local (device-to-device) transport only and, like all Band Sync data, stays between the connected devices.
No data from Band Sync sessions — local or cloud — is transmitted to us or any third party. Band Sync is optional and requires you to explicitly start a session.
Web Remote Control (LiveBand Studio – LiveStream)
Studio includes an optional Web Remote feature that runs a local web server on your device to provide a browser-based control dashboard. The server is HTTPS by default: the App generates a self-signed TLS certificate once on your Mac and keeps it in your Keychain, so the dashboard and its authentication token are encrypted on your local network (your browser shows a one-time warning for the self-signed certificate; the App displays the certificate’s fingerprint so you can verify it). The authentication token, kept in your Mac’s Keychain on this device only, is required for all API requests and travels in the URL fragment rather than a query string, so it is not written to server request logs. An optional plain-HTTP compatibility mode exists for devices that cannot accept self-signed certificates; it is off by default and clearly warns that traffic would then be unencrypted on your network. The server is accessible only on your local network, does not expose any personal data, and no data from the Web Remote is transmitted outside your local network. The Web Remote is disabled by default and must be explicitly enabled.
Virtual Camera (LiveBand Studio – LiveStream)
Studio includes an optional Virtual Camera that makes the studio’s composited program video available to other apps on the same Mac as a system camera named “LiveBand Program” (for example, so a video-conferencing app can use your studio output). This works through a macOS camera system extension that requires your explicit one-time approval in System Settings before it can run, and it serves video only while you start it and only to apps on that Mac — it involves no network transmission, no storage, and no data collection. When the studio is not sending frames, other apps see only a static splash image. Any app you point at the virtual camera receives the same program video you are producing; choosing which apps may use a camera is governed by macOS’s own camera permission system.
Web Content Import
When you use the web import feature to fetch song lyrics or chord charts from a URL you provide, the App makes a standard HTTP GET request to that URL. The App does not track which URLs you visit, and no browsing data is sent to us. In Studio, the web source can render a URL as a video source — this content is processed locally and never transmitted back to us.
Face-Gesture Scrolling (iOS)
On iOS, the App can use the TrueDepth camera (via ARKit) to detect head tilt for hands-free lyrics scrolling during performances. Facial geometry data is processed entirely on your device in real-time. It is never stored, recorded, or transmitted. This feature is optional and requires your explicit permission.
Backup and Export
When you export a backup (.appbackup), setlist (.lbsetlist), or library (.lblibrary), the App creates a temporary ZIP archive on your device. This file is only shared when you explicitly choose a destination (e.g., Files, AirDrop, email). Temporary backup files older than 24 hours are automatically cleaned up. We never receive backup files.
Lyrics Translation
The App offers optional lyrics translation using Apple’s Translation framework. When you translate lyrics, Apple may process the text on your device (using downloaded language models) or through Apple’s translation servers, depending on the language pair and device capabilities. This processing is handled entirely by Apple under Apple’s Privacy Policy. We do not send lyrics to any non-Apple service. Translation is user-initiated and optional.
On-Device AI
On supported devices (iOS 26 / macOS 26 with compatible hardware), the App uses Apple’s FoundationModels framework (Apple Intelligence) for AI-assisted features such as chord parsing, lyric formatting, the LiveBand AI assistant, and learning practice plans. This on-device processing is the default: prompts and data are not sent to any AI service, cloud API, or external server. When these features are unavailable, the App uses deterministic processing instead — for example, chord and theory lookups and practice plans work offline without Apple Intelligence.
The LiveBand AI assistant’s multiple saved conversations and its Scripture-aware answers in the Bible section are handled the same way by default. The assistant grounds Bible answers in the App’s bundled offline Bible text — quoting the real verses — and, by default, generates and stores everything (the chat history and the responses) entirely on your device with no network activity. The one exception is the optional Cloud AI feature described next.
Optional Cloud AI (off by default). The App includes one strictly opt-in exception, found in Settings → Cloud AI. It is disabled by default and does nothing unless you both turn it on and enter your own API key for at least one supported provider: Claude (Anthropic), OpenAI, or Gemini (Google). You choose a preferred provider; if a request to it cannot be completed, the App automatically falls back to another provider for which you have entered a key. When Cloud AI is on and a key is saved, your chosen provider is used first and the on-device model is the fallback (when the cloud is unreachable or fails). The App’s Settings disclosure states exactly what is sent, over an encrypted connection: your LiveBand AI questions (chat, Bible, and library questions); the current screen’s context (the song title and key, a short lyric excerpt, and setlist names); matching facts from your library that the assistant requests (song details, setlist contents, hymnal entries); recent turns of the conversation; automatic insight cards (Bible chapter summaries and cross-references, setlist suggestions, tips); worship plans (the planner’s candidate songs and your theme); and chart text that needs parsing during import. For a worship plan, the candidate songs are sent as short rows (title, artist, key, tempo, tags and the first few words of the lyrics) with the theme you typed and, if the theme names a Bible passage, up to 500 characters of that passage. Bible questions are sent together with the bundled Bible verses the answer quotes. Depending on which provider handles the request, the text is sent to that provider’s endpoint — Anthropic Claude (api.anthropic.com), OpenAI (api.openai.com), or Google Gemini (generativelanguage.googleapis.com). Nothing is sent when this setting is off or when no API key is stored. Your API keys are stored only in your device’s Keychain and are never transmitted to us. Text sent to a provider is handled under that provider’s own privacy policy and usage terms (Anthropic, OpenAI, Google). We do not receive, store, or have access to the text you send or the results.
Web research (a second switch, off by default). Under Settings → Cloud AI there is a separate Allow web research switch. It can only be turned on while Cloud AI is on and a key is saved, and it turns itself off when Cloud AI is turned off. When it is on, the App may send your question to your chosen provider’s own web-search tool (Anthropic web search, OpenAI web search, or Google Search grounding for Gemini) and the assistant may read pages that search finds; the answer then lists its sources. No web search happens when this switch is off, and it is never used by the on-device model.
Because worship charts frequently contain lyrics licensed through CCLI or other rights holders, you are responsible for confirming that your license permits sending that text to a third-party service (Anthropic, OpenAI, or Google) before enabling this optional feature. If in doubt, leave it off — the on-device and offline paths never transmit your charts or your questions anywhere.
Bible & Scripture
The App includes a Bible feature. The King James Version, Berean Standard Bible, World English Bible, and Nepali Unlocked Literal Bible texts are bundled in the App and read entirely offline — using them involves no network activity and no data collection. Your bookmarks, highlights, reading position, and reading settings are stored locally on your device (bookmarks and highlights in your Documents folder; settings in local preferences) and are never transmitted to us.
The App optionally supports the English Standard Version (ESV), which is copyrighted and therefore not bundled. If you choose to use it, you provide your own free API key from Crossway (api.esv.org). When an ESV chapter is displayed, the App requests only that passage reference (for example, “John 3”) from Crossway’s ESV API over an encrypted connection using your key, and Crossway returns the text. Your key is stored only in your device’s Keychain (this-device-only) and is never transmitted to us. This request goes directly from your device to Crossway; we do not receive, store, route, or have access to it. Text returned by the ESV API is handled under Crossway’s API terms. If you never add an ESV key, no Bible network requests are made at all.
The App also offers additional online Bible translations provided by the Free Use Bible API (bible.helloao.org), a non-profit, open-source service by AO Lab. These are not bundled; a translation’s text is fetched only when you choose to browse or read it. When that happens, the App requests only the specific passage or catalog listing you selected (for example, “Genesis 1”) over an encrypted connection. No API key, account, login, or personal information is involved or sent — the request contains only the translation and passage you chose. It goes directly from your device to the service; we do not receive, store, route, or have access to it. If you only use the bundled offline translations, no such requests are made. Each online translation remains under its own public-domain or Creative Commons license, shown in the App’s Bible → Credits & Licenses screen; the App presents a curated, license-checked set by default, and only shows the full catalog if you explicitly choose to browse it.
The Nepali Unlocked Literal Bible is © 2019 Door43 World Missions Community and used under the Creative Commons Attribution-ShareAlike 4.0 license; the required attribution is shown in the App’s Bible → Credits & Licenses screen.
Voice Input & Speech Recognition
The App offers optional hands-free voice input for the LiveBand AI assistant — for example, spoken chord lookups and music-theory questions. When you tap the microphone control and speak, the App uses Apple’s Speech framework to transcribe your speech to text. Apple’s Speech framework performs this transcription on your device where on-device recognition is available; otherwise the captured audio may be sent to Apple’s servers to be transcribed and returned. This processing is handled entirely by Apple under Apple’s Privacy Policy. We do not receive, store, or have access to your voice audio or transcripts, and we do not send them to any non-Apple service. Voice input is user-initiated, requires your explicit permission, and is optional — the AI assistant works fully with typed input.
MIDI, Timecode & Mixer Control (Controller)
On iOS, the Controller communicates only with audio gear you connect — over USB, Bluetooth, or your local network. Bluetooth is used only on your device, to find and pair the Bluetooth MIDI keyboards and controllers you choose — the permission is asked only when you tap Controller → Instruments → Search for Instruments (a short scan) or Pair a Bluetooth Instrument; pairing happens in Apple’s system Bluetooth MIDI window, and the App does not store or transmit information about the Bluetooth devices it lists. MIDI and MIDI Time Code (MTC) input, MIDI-Learn mapping, and console metering are processed locally to control your mixer and trigger cues. No new analytics or external data collection is involved, and no data from these connections is transmitted to us or any third party.
Siri, Shortcuts & Spotlight (App Intents)
The App exposes several actions — such as Generate Worship Setlist, Bulk Import Songs, and Library Health Check — through Apple’s App Intents framework, so you can run them from Siri, the Shortcuts app, and Spotlight. These actions run on your device against your local library (the one exception: if you have turned on the optional Cloud AI feature, Generate Worship Setlist plans the set with your chosen provider, sending what is described under Optional Cloud AI below). The action phrases and donations that make them appear in Siri, Shortcuts, and Spotlight are handled entirely by the iOS/macOS system frameworks. No data is collected or sent to us as a result, and nothing new leaves your device.
Spotlight Indexing (CoreSpotlight)
To let you search your own library from the Home Screen, the App indexes your songs — their titles, artists, and keys — into your device’s on-device Spotlight index using Apple’s CoreSpotlight framework. It also indexes the Verse-of-the-Day verses and the verses you’ve bookmarked so you can find scripture from Spotlight. This index is stored and managed by the iOS/macOS system on your device; it is never sent to us. When you tap a Spotlight result, the App opens to the matching song or Bible chapter. Indexing covers only your local content and involves no new data collection or transmission.
Live Activities & Dynamic Island
When you start a Band Sync session, the App can show a Live Activity on the Lock Screen and in the Dynamic Island reflecting the session’s status — for example, your role (leader or follower), the connected peer count, the setlist name, and the current song. During a session the leader’s Live Activity and Dynamic Island can also present Next / Previous / End controls that advance the shared setlist. This information is displayed through Apple’s system frameworks and mirrors data already on your device; the controls operate on the on-device session state. Nothing new is collected or transmitted, and no session content is sent to us.
While the instrument tuner is listening, the App can also show a Tuner Live Activity on the Lock Screen and in the Dynamic Island with the note you’re playing, how sharp or flat it is, and buttons to switch instrument or stop. It lets you tune without unlocking: the tuner keeps listening in the background only while this Live Activity is showing, and it ends when you tap its stop button, after three minutes without a note, or when you dismiss it while the App is in the background. You can turn it off in Settings (“Show Tuner on the Lock Screen”); with it off, the tuner stops when you leave the App. The pitch is worked out on your device from live audio that is never recorded, stored or transmitted.
Widget Extension & App Group
The App’s Home Screen, Lock Screen, and Control Center widgets run in a separate widget extension that shares a private, on-device App Group container with the main app. This container is a local storage area used only to pass data between the App and its own widget extension on the same device. Because the widget process cannot read the App’s sandboxed data directly, the App mirrors a compact summary of your setlists — their names, song counts, and first song titles — into this local container so the Latest Setlist widget can display it. For the Bible widgets, it likewise mirrors the upcoming Verse-of-the-Day verses and the verses you’ve bookmarked (their text and references) so the Verse of the Day and Pinned Verse widgets can render them. The widgets are configurable: you can pin a specific setlist or a specific bookmarked verse, and that choice is stored locally by the system. This remains entirely on your device: the App Group is not a network service, is not shared with any other app, and no data in it is transmitted to us or any third party.
Apple Watch Companion
The App includes an optional Apple Watch companion app that shows your current setlist, the live Band Sync status (your role, connected peer count, and current song), a “Now Showing” card for any scripture verse you’re currently projecting, a standalone metronome, and a Performance Mode page that mirrors the current song’s lyrics (in your chosen translation or romanization) with wrist controls for auto-scroll, speed, and previous/next. When you lead, the Watch can also act as a stage remote to advance the song on your iPhone. The iPhone and Watch exchange a compact snapshot of this information using Apple’s WatchConnectivity framework, and the Watch mirrors your chosen in-app language (English, Nepali, or Hindi). The App also offers watchOS complications (Verse of the Day and Now-Playing). This communication is on-device, between your own paired iPhone and Apple Watch — it stays within your personal devices and is handled by Apple’s system frameworks. No data from the Watch companion, its remote controls, or its complications is collected by us or transmitted to any third party.
Deep Links & Focus Filter
Tapping a Live Activity, a widget, or a Spotlight result opens the App directly to the relevant place — for example, the Setlists or Library tab. These deep links are handled on your device and carry no data to us. The App also provides a “Distraction-Free Worship” Focus filter that, when attached to a Focus (in Settings → Focus), hides the floating assistant during a service. The Focus filter operates entirely through Apple’s system frameworks on your device; nothing new is collected or transmitted.
Haptics
The App uses Apple’s Core Haptics framework to provide local hardware feedback (vibration) on supported devices. Haptics are generated by the device itself and involve no data collection, storage, or transmission.
Third-Party Code
SundayStream includes no third-party code libraries. Studio includes three open-source libraries for streaming: HaishinKit (RTMP/SRT streaming; BSD 3-Clause License), Logboard (its logging library; BSD 3-Clause License) and libsrt (the Secure Reliable Transport protocol library, bundled via HaishinKit; Mozilla Public License 2.0). None of them collects, transmits, or stores any user data. Neither app includes analytics services, advertising frameworks, or tracking tools. Acknowledgments and license texts are in SundayStream under Settings → Help & About → Acknowledgments & Licenses, and in Studio under Help ▸ Acknowledgments.
Permissions
The App may request the following device permissions. All are optional — the App works fully for Library, Setlists, Learn, and practice features without any permissions granted.
- Camera — SundayStream on iPhone and iPad: scanning a paper chord chart into your library (Live Scan and Manual Scan read the page on your device and the image is never uploaded; the text read from it is treated like any other import, including optional Cloud AI only if you turned it on), face-gesture lyrics scrolling, PTZ camera control previews, and use as a companion camera sending video to Studio on your own Mac (SundayStream for Mac does not use the camera). Studio: live video production and multi-camera switching. Face-gesture scrolling uses ARKit face tracking, which is authorized by this camera permission — the App does not use Face ID, requests no biometric permission, and never stores or transmits face data
- Microphone — SundayStream: the instrument tuner and chord recognition, the mixer’s real-time audio analyzer and feedback detection, voice input for the LiveBand AI assistant, and (iPhone and iPad) sound for the Companion Camera video you send to Studio on your own Mac. Studio: live audio mixing, monitoring, broadcast encoding and recording. Requested only when you first use one of these. Tuner, chord-recognition and analyzer audio is analyzed live on your device and is never recorded, stored or transmitted. In the background only the tuner keeps listening, and only while its Live Activity is on the Lock Screen (iOS shows its microphone indicator the whole time); leaving the app with that Live Activity turned off, or dismissing it, stops the tuner
- Speech Recognition — SundayStream: transcribing your spoken questions to the LiveBand AI assistant, via Apple’s Speech framework (on-device where available; otherwise processed by Apple — see “Voice Input & Speech Recognition” above). Studio: live captions of your program mix, always recognized on your Mac (see “Live Captions” above)
- Photos (add only) (SundayStream on iPhone and iPad) — Saving the verse images you design when you choose Save to Photos. The App asks only to add photos and never reads your photo library
- Screen Recording (LiveBand Studio – LiveStream) — Capturing windows and displays as video sources for live production
- Local Network — Controlling audio mixers (OSC), PTZ cameras (VISCA) and MIDI devices; connecting SundayStream with Studio, with a Presenter Remote or Stage Display, and with a backup Mac or iPad; the Present tab’s web browser remote; companion cameras, remote guests on the same network and tally lights (Studio); Band Sync
- Bluetooth / Peer-to-Peer Wi-Fi — Band Sync uses Bluetooth and peer-to-peer Wi-Fi to synchronize setlist playback and song content with other band members’ devices (optional; all communication is encrypted and stays between connected devices). Cloud mode is an optional alternative transport that uses Apple’s CloudKit sharing (CKShare) from the leader’s own iCloud account, joined by invite link (anyone who has the link can join) — see “Band Sync” above
- Bluetooth (MIDI instruments) — Pairing a Bluetooth MIDI keyboard or controller you choose in the Controller (asked only when you tap Search for Instruments or Pair a Bluetooth Instrument) or in the iPad Present tab (Pair a Bluetooth MIDI Controller). Used only on your device to connect that instrument; no data is collected or transmitted
- Notifications — Optional local notifications scheduled on your device: a Daily Verse of the Day and a Practice Reminder (both offered during onboarding and changeable in Settings; the Daily Verse can also be toggled in the Bible reading settings), plus iCloud sync updates. In Studio, a scheduled go-live can show a reminder and report that the stream started or why it didn’t. Permission is requested only when you turn one on (or when you enable iCloud sync or schedule a go-live); skipping the onboarding notifications step never prompts. No reminder or notification content is sent to us or any third party
- Accessibility (LiveBand Studio – LiveStream) — Optional global keyboard shortcuts for studio controls (e.g., scene switching, fade to black)
Children’s Privacy
The App does not collect personal data from any user, including children under 13.
Changes to This Policy
We may update this policy. Changes will be posted here with a revised effective date.
Contact
If you have questions about this privacy policy, visit granitevectorsystems.com/contact and select “LiveBand Sunday Stream – app support” from the dropdown.
App Privacy Answer Matrix
This document provides verified answers for the App Store Connect privacy questionnaire, based on a full codebase audit.
App-family release (Oct 2026) — read before reusing these answers. Livestreaming moved out of SundayStream into LiveBand Studio – LiveStream (
LiveBandStudio/, bundleThatalHome.LiveBandStudio), a separate Mac app with its own privacy manifest and its own App Store privacy answers. Rows below that name studio features (RTMP/SRT streaming,StudioWebRemote, virtual camera, multi-track and program recording,StudioTelemetry, WebSource, tally, screen capture, HaishinKit/libsrt) now describe Studio, not SundayStream. SundayStream links no third-party library; its Mac build declares no camera or screen-recording usage. New SundayStream network paths since the last audit, all local-network only, PIN-paired, encrypted, and never sent to the developer: LiveBand Link to Studio (_liveband-link._tcp: songs, setlists and the current slide) and the Presenter Remote (_liveband-remote._tcp: commands and the current slide between an iPhone/iPad and the Mac). TheNDI*code is compiled out (no build configuration sets its flag), so the NDI row below does not apply to any shipping build. The answers (no tracking, no data collected) are unchanged for both apps.
4.0.0 / Studio 1.0.0 audit (2026-10-20) — what changed, and why no answer changes. Every path below was re-traced in code (ledger
docs/release/4.0.0/READINESS.md§ Inventory). None sends data to the developer, so both apps stay Data Not Collected, no tracking.
- Live Scan / Manual Scan (iPhone, iPad): the camera reads a printed chart with Vision on the device; the image never leaves it. The text read is an import like any other (optional Cloud AI only if the user turned it on).
- Remote guest (Studio ↔ SundayStream on iPhone/iPad): Studio asks a public STUN server (
stun.stunprotocol.org:3478) for its own public address — the request carries no user data — and the guest’s camera and microphone go directly to the church’s Mac over TLS keyed by the invite. No relay, nothing to us.- Platform sign-in (Studio): built, but hidden in 1.0 (no YouTube/Facebook client IDs ship), so Studio makes no request to those APIs.
- Web remotes: the pairing token moved from UserDefaults to the Keychain (this device only); the Mac’s HTTPS identity is now minted in code into the data-protection Keychain (no
/usr/bin/openssl).- Privacy manifests: UserDefaults reason 1C8F.1 (App Group) added beside CA92.1 for the app, the watch app and the watch widgets.
- Studio export answer:
ITSAppUsesNonExemptEncryption = NOnow set in Studio’s Info.plist (standard TLS + AES in SRT via OpenSSL inside libsrt, mass-market).
Overall Privacy Posture
| Question | Answer | Evidence |
|---|---|---|
| Does this app track users? | No | No IDFA, no ATTrackingManager, no AppTrackingTransparency imports found. |
| Does this app use third-party analytics? | No | No Firebase, Crashlytics, Amplitude, Mixpanel, Sentry, or any analytics SDK present. |
| Does this app collect data linked to user identity? | No | No user accounts, no login, no email collection, no remote user profiles. |
| Does this app use advertising SDKs? | No | No ad frameworks or advertising identifiers. |
| Does this app transmit data to developer servers? | No | No URLSession calls to any developer-controlled backend. All network activity is user-initiated (RTMP/SRT streaming to user-configured destinations, OSC to user’s mixer, local LAN web remote, and — only if the user opts in with their own key — LiveBand AI questions, the current screen’s context, requested library facts, recent turns, insight-card prompts and chart text to the user’s chosen cloud AI provider’s API (Anthropic Claude, OpenAI, or Google Gemini) for the optional Cloud AI feature; see below). |
| Does this app transmit data to third-party servers? | Only when user-initiated | User-initiated, no-developer-collection exceptions, none routed through a developer server: (1) the Cloud AI feature (Settings › Cloud AI, off by default; used first when on, on-device is the fallback) sends — per the in-app disclosure — the user’s LiveBand AI questions (chat, Bible, library), the current screen’s context (song title and key, a short lyric excerpt, setlist names), matching library facts the assistant requests (song details, setlist contents, hymnal entries), recent conversation turns, automatic insight-card prompts (Bible chapter summaries/cross-references, setlist suggestions, tips), worship plans (the planner’s candidate songs and the user’s theme) and chart text that needs parsing during import, to the user’s chosen cloud provider — Anthropic Claude (api.anthropic.com), OpenAI (api.openai.com), or Google Gemini (generativelanguage.googleapis.com) — only after the user enables it and supplies their own key for that provider; with the separate Allow web research switch also on (default off), the question may additionally go to that provider’s own web-search tool and pages it finds may be read; (2) the ESV Bible (Bible › translation menu) fetches the requested passage reference from api.esv.org only after the user enters their own free Crossway ESV key; (3) additional online Bible translations (Bible › translation menu, Free Use Bible API) fetch the selected passage or catalog listing from bible.helloao.org (AO Lab) — no API key, account, or personal data; the request carries only the translation/passage the user chose, sent when the user browses or reads that edition. The four bundled Bibles (KJV/BSB/WEB/Nepali) are read fully offline. All three exceptions are analogous to user-configured streaming destinations / web-content fetches; the developer receives, proxies, and stores nothing. |
| Does this app use iCloud? | Yes (optional) | CloudKit sync is user-controlled. Data stored in the user’s personal iCloud account, managed by Apple. |
Privacy Nutrition Label — Category-by-Category Answers
| Category | Collect? | Verification |
|---|---|---|
| Contact Info | No | No fields for name, email, phone, or address. No user account system. No sign-in flows. |
| Health & Fitness | No | No HealthKit, no health-related data types. |
| Financial Info | No | No payment processing, no financial data fields. No in-app purchases in SundayStream 4.0.0 or LiveBand Studio – LiveStream 1.0.0 (Studio is free; SundayStream’s price is set in App Store Connect, not in the app). |
| Location | No | No CoreLocation imports, no CLLocationManager, no GPS/geofence usage. |
| Sensitive Info | No | No biometric data collection, and no biometric permission is requested — the App ships no NSFaceIDUsageDescription key and never invokes Face ID. Face-gesture lyrics scrolling uses ARKit face tracking, which is authorised by the ordinary camera permission (NSCameraUsageDescription); head tilt angles are processed in real-time and never stored, transmitted, or persisted. No political/religious/sexual orientation data fields. |
| Contacts | No | No Contacts framework usage, no address book access. |
| User Content | No (developer collects nothing) | Songs, setlists, lyrics, chord charts, and recordings are created and stored locally on-device. Optional iCloud sync stores data in the user’s personal iCloud account (Apple-managed, not developer-collected). Streaming transmits user content to user-configured destinations only — the app does not collect or store user content on any developer server. Third-party transmission (opt-in only): If the user enables the optional Cloud AI feature (off by default) and supplies their own API key for a chosen provider — Anthropic Claude ( api.anthropic.com), OpenAI (api.openai.com), or Google Gemini (generativelanguage.googleapis.com) — the following may be sent directly to that provider, user-initiated, using the user’s own third-party account, and — because the cloud is tried first once Cloud AI is on — for every assistant turn rather than only on a fallback: (a) the user’s LiveBand AI questions (chat, Bible and library questions) and recent turns of the conversation; (b) the current screen’s context — song title and key, a short lyric excerpt, setlist names; (c) matching library facts the assistant requests through its tools (song details, setlist contents, hymnal entries) and the bundled Bible verses a Scripture answer quotes; (d) the prompts for automatic insight cards (Bible chapter summaries and cross-references, setlist titles/suggestions/flow, practice and transition tips, library insights, ear-training plans) and worship plans (the planner’s candidate songs as short rows, the energy arc and the user’s theme, plus ≤500 chars of a named passage); and (e) the text of a chart being imported (OCR clean-up, metadata, section labels, final parse). With Allow web research on as well, the question goes to the provider’s own web-search tool. Disclosed in-app before enabling (including a copyright/CCLI-license caveat for charts). The developer does not receive, proxy, or store this content. If completing App Store Connect’s “Other User Content” question conservatively, this can be declared as user content transmitted to a third party at the user’s initiation and not used for tracking; it is never collected by the developer. |
| Browsing History | No | No web browsing functionality. WebSource (macOS studio) renders user-configured URLs as video sources but does not track or transmit browsing activity. |
| Search History | No | Learn search and library search are on-device only. Recent searches stored locally via UserDefaults, never transmitted off-device. |
| Identifiers | No | No device ID, no advertising identifier (IDFA), no vendor identifier collection. No analytics SDK that generates user IDs. |
| Purchases | No | No in-app purchases or subscriptions in SundayStream 4.0.0 or LiveBand Studio – LiveStream 1.0.0. |
| Usage Data | No | StreamTelemetryManager tracks stream health metrics (bitrate, RTT, packet loss, frame drops) locally for real-time UI display only — never transmitted to any server or third party. No app usage analytics, no session tracking, and no data of any kind sent to the developer.Note (added 2026-09-20), macOS studio only: StudioTelemetry is an opt-in, local-only troubleshooting recorder (Live ▸ Settings ▸ Developer Diagnostics, off by default). When switched on it logs studio interactions — control presses, scene/take/transition operations, source add/remove, stream and record start/stop, and drag-smoothness statistics — to a ring buffer and a JSONL file inside the app container. It is feature-usage logging in the literal sense, so it is documented here rather than left implied by the old “no feature usage logging” wording; the App Store answer remains No because nothing is transmitted to the developer or any third party, there is no identifier of any kind in the records, and the user must both enable it and deliberately export and send the file for anyone else to see it. Stream URLs are redacted to their host before writing, so stream keys, pairing PINs and secrets are never recorded. Clear Trail deletes the file. |
| Diagnostics | No | CrashReporter.swift uses Apple MetricKit (MXMetricManager) to receive system-delivered crash/hang/CPU/disk diagnostics. These payloads are saved to local disk (Documents/CrashReports/) and never transmitted off-device. No Crashlytics, Sentry, or any remote crash reporting SDK. Note: if you opt into Apple’s “Share with App Developers” in iOS Settings, Apple may forward aggregated diagnostics to you via App Store Connect — this is Apple-managed and does not change the app’s privacy posture.The user-initiated Diagnostics export bundles these local reports (and, if enabled, the studio telemetry section above) into a file the user chooses to share. It is never uploaded automatically. |
| Camera & Microphone Content (iPhone Companion Camera; LiveBand Studio – LiveStream cameras and microphones) | No | LiveBand Studio – LiveStream (macOS): camera, microphone, screen and window sources are composited on the Mac and go only where the operator sends them — a recording on local disk and/or the RTMP/RTMPS/SRT destinations the operator entered. Nothing is sent to the developer. Note on the virtual camera (added 2026-09-23, macOS only): the studio can expose its program video to other apps on the same Mac as a system camera (“LiveBand Program”) via a CMIO camera system extension. This requires an explicit one-time user approval in System Settings, runs only while the user starts it, and never touches the network or disk — it is an on-device frame hand-off, not collection or transmission. The App Store privacy answers are unaffected. Verification (added 2026-09-20): when an iPhone is used as a wireless camera for the macOS studio, captured video/audio is encoded (H.264 via VideoToolbox) and sent directly to the user’s own Mac over the local network via Bonjour _livebandcam._tcp / Network.framework. There is no developer server in the path, nothing is stored off-device by us, and the content leaves the Mac only as part of a stream the user has configured. Pairing uses a per-session PIN held only as a salted hash in the Keychain plus a per-device enrolment key; a nonce challenge-response is used on the wire, so neither the PIN nor the secret is transmitted in the clear. |
| Other Data | No | No other data categories collected. All app data remains on-device or in user’s personal iCloud. |
Network Activity Audit
The following network-capable components were audited:
| Component | Purpose | Data Destination | Developer Collection? |
|---|---|---|---|
| RTMPBroadcaster | Livestream output | User-configured RTMP/RTMPS server | No |
| SRTBroadcaster | Livestream output | User-configured SRT endpoint | No |
| StudioWebRemote | LAN remote control | Local network only (HTTPS server on device; self-signed TLS identity minted in code into the data-protection Keychain, Keychain-held token in the URL fragment, plain-HTTP fallback off by default) | No |
| PresenterWebRemote (SundayStream Mac/iPad) | LAN remote for the Present tab | Local network only (same HTTPS + Keychain token design) | No |
| RemoteGuestHost (Studio) | Remote guest camera | Public STUN server for the Mac’s own public address (no user data); guest media direct to the Mac over TLS keyed by the invite | No |
| LiveChartScanner (SundayStream iOS) | Live Scan | None — Vision on the device | No |
| PlatformAccountsController (Studio) | YouTube/Facebook sign-in | Hidden in 1.0 (no client IDs) — no requests | No |
| VirtualCameraManager / LiveBandCameraExtension | System-wide virtual camera (macOS) | Same-Mac only — program frames served to other local apps via a CMIO camera system extension after one-time user approval in System Settings; no network, no storage | No |
| MultitrackAudioRecorder | Multi-track audio recording (macOS, opt-in) | Local disk only — one CAF per mixer channel + master mix + session manifest in the user-chosen recordings folder | No |
| HostConnectionManager | Mixer control (OSC) | User’s X32/M32 mixer on local network | No |
| DeviceScanner | Network discovery | Local network broadcast (Bonjour/mDNS) | No |
| MIDINetworkController | MIDI over network | Local network MIDI devices (RTP-MIDI; Bonjour _apple-midi._udp) | No |
| MIDIDeviceManager / InstrumentsModeView | USB + Bluetooth MIDI instruments (3.0.0 build 2) | On-device only — CoreMIDI to the instrument the user picks; Bluetooth LE MIDI pairing through Apple’s system pairing UI (CABTMIDICentralViewController on iOS, CABTLEMIDIWindowController on macOS). Nothing about nearby Bluetooth devices is stored or transmitted | No |
| DeviceConnectionTester / AddDeviceSheet | Test a mixer/camera before saving it (3.0.0 build 2) | The address the user chose on the local network (X32 /info, Yamaha devinfo, A&H TCP connect, VISCA inquiry) | No |
| CloudKit (iCloud sync) | Optional data sync | User’s personal iCloud account (Apple-managed) | No |
| AIImportEngine | AI chord/lyric parsing (default) | On-device only (FoundationModels) | No |
| AIGateway / CloudAIChatClient / CloudAIRouter | Optional Cloud AI for the whole assistant — chat, Bible scholar + insight cards, setlist title/suggestions/flow, theory, practice/transition tips, library insight + search intent, transposition check, ear-training plan, worship plans (AI Worship Planner), import OCR/metadata/sections/final parse (off by default; cloud first when on, on-device fallback) | The user’s chosen cloud provider — Anthropic Claude (api.anthropic.com), OpenAI (api.openai.com, plus /v1/responses for web research), or Google Gemini (generativelanguage.googleapis.com) — only if user opts in and supplies their own key for that provider; sends the question, screen context, requested library facts / quoted verses, recent turns, insight prompts or chart text; user’s own third-party account, direct TLS, no developer proxy. AIGateway attempts no request while consent is off (AIGatewayTests) | No |
AIToolRegistry fetchWebPage + vendor web search | Optional web research (Settings › Cloud AI › Allow web research; default off; requires Cloud AI on + key) | The same provider endpoint — the vendor’s own search tool (Anthropic web_search, OpenAI Responses web search, Gemini Google Search grounding) fetches the web; readable page text is capped at 6,000 chars; sources listed under the answer. Never on the on-device path | No |
| AIInsightCache | 7-day local cache of automatic insight cards / helper answers | Local Caches/AIInsightCache only; no network; cleared by erase-all | No |
| AITurnDiagnostics | Last-40-calls AI ring buffer for the Diagnostics export (feature, route, engine, latency, tokens, tools, web-search flag, failure kind — no prompt text unless the developer AI debugger is on) | Local Application Support JSON; included only in a user-created Diagnostics export; cleared by erase-all | No |
| BibleLibrary (KJV/BSB/WEB/Nepali) | Read bundled Bible text | On-device only (bundled .bibz; no network) | No |
| BibleESVProvider | Optional ESV Bible (off unless user adds a key) | Crossway ESV API (api.esv.org) — only if the user enters their own free key; passage reference sent over TLS with the user’s key, no developer proxy | No |
| HelloAOProvider | Optional online Bible translations (Free Use Bible API) | AO Lab CDN (bible.helloao.org) — passage/books/catalog request only, no key, no account, no PII; user-initiated when browsing/reading an online edition, direct TLS, no developer proxy | No |
| LiveBandAIConversation | LiveBand AI assistant + practice-plan generation | On-device by default (FoundationModels / Apple Intelligence; deterministic fallback). Every turn goes to the user’s chosen cloud provider (Anthropic Claude, OpenAI, or Google Gemini) first, only if the user opts into Cloud AI and supplies their own key — see AIGateway | No |
| ChartDialectClassifier / StructureInferenceEngine | Import dialect detection + structure inference | On-device only (deterministic, no network) | No |
| EarTrainingEngine / LearningProgressStore | Ear training, adaptive difficulty, gamification | On-device only (progress in local JSON + optional personal iCloud KVS) | No |
| HostConnectionManager (Yamaha metering) | RCP mtrstart/mtr channel metering | User’s Yamaha console on local network | No |
| MTCDecoder / MIDI input | MIDI Time Code + MIDI-Learn | Local MIDI devices (USB / Bluetooth / local-network MIDI) | No |
| CloudPresetManager | Mixer preset storage | Local only (on-device; no network / no CloudKit) | No |
| VideoMixingEngine | Video compositing | Local only (no network) | No |
| CompanionCameraSender/Receiver | iOS companion camera | Local network peer-to-peer (NWConnection) | No |
| TallyLightService | Tally light broadcast | Local network UDP broadcast | No |
| PTZCameraManager | PTZ camera control | User’s PTZ camera on local network (VISCA-over-IP) | No |
| APNs (push notifications) | CloudKit sync triggers | Apple Push Notification service (Apple-managed) | No |
| MetricKit (CrashReporter) | On-device crash diagnostics | Local disk only — Apple delivers payloads to the app, no developer server | No |
| WirelessMicMonitor | Wireless mic status | Local network monitoring | No |
| NDISenderManager | NDI video output (LAN) | Local network only (raw BGRA frames via NDI protocol) | No |
| BandSyncManager | Band Sync (setlist + content sync between devices) | Local peer-to-peer (MultipeerConnectivity, Bluetooth/Wi-Fi) or CloudKit sharing (CKShare) from the leader’s own iCloud | No |
| CKShareBandSyncTransport | Band Sync cloud transport | CloudKit sharing (CKShare): records live in a custom zone of the leader’s private CloudKit database, accessible to anyone who has the share link — not the public database, never a developer-controlled server | No |
| AIWorshipPlanner / WorshipPlannerEngine | AI Worship Planner, Generate Worship Setlist intent, Control Center Generate Setlist (3.0.0 build 2) | Cloud Off (default): on-device only — the Apple Intelligence model (@Generable plan) when available, else the WorshipPlannerEngine rules; no request (AIWorshipPlannerTests). Cloud AI on + key: the candidate songs as short rows (title, artist, key, tempo, energy, tags, first ~60 lyric characters; no UUIDs), the energy arc, duration, the user’s optional theme and ≤500 chars of a named Bible passage go to the user’s chosen provider (see AIGateway); any failure/timeout → rules | No |
| WebImportService | Fetch song/chord HTML for import | User-provided URL (GET request with browser User-Agent) | No |
| WebSource (macOS studio) | Render user-configured URL as video source | Local rendering only (WKWebView, no data sent back) | No |
| FaceScrollManager (iOS) | ARKit head-tilt for hands-free lyrics scroll | On-device only (real-time ARKit face geometry, never stored or transmitted) | No |
| SecurityBookmarkManager | Persist sandbox file access across launches | Local disk only (Application Support plist) | No |
| BackupManager | Export/import .appbackup, .lbsetlist, .lblibrary | Local disk (temp directory ZIP, user-initiated file transfer only) | No |
No component transmits data to any developer-controlled server.
On-Device Data Storage Audit
All data is stored locally on the user’s device (or the user’s personal iCloud account if sync is enabled). No data reaches developer-controlled servers.
| Storage Location | Data Stored | Sensitive? | Component |
|---|---|---|---|
Keychain (com.livebandsundaystream.streamkey) | RTMP stream key, SRT passphrase, iOS stream key | YES — encrypted by OS Keychain | KeychainStreamKeyStore |
| Keychain (Show Mode PIN) | Salted SHA-256 hash of the iOS Controller Show-Mode PIN (never the PIN itself) | YES — encrypted by OS Keychain; hash-only, on-device | ShowModePINStore |
| Keychain (cloud AI API key) | User’s own cloud provider API key(s) — Anthropic (Claude), OpenAI, and/or Google (Gemini) — for the opt-in Cloud AI feature (the whole assistant + import, cloud-first when on); only present if the user chooses to enable it and saves a key | YES — encrypted by OS Keychain (kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly); on-device, sent only as the auth header to the corresponding provider | AIProviderKeyStore (ClaudeAPIKeyStore shim) |
| UserDefaults / @AppStorage (~95+ keys) | UI preferences, layout, studio settings | NO — no PII or auth tokens | Various (all studio*, learn* prefixed) |
| ~/Documents/ | Songs (JSON), Setlists (JSON), learning progress, Bible bookmarks + highlights (JSON) | NO (user content) | LibraryViewModel, LearningProgressStore, BibleBookmarksStore, BibleHighlightsStore |
| Keychain (ESV API key) | User’s own Crossway ESV API key — only present if the user chooses to add it for the optional online ESV | Low — a personal third-party API key; on-device (Keychain, this-device-only), sent only as the auth header to api.esv.org | ESVKeyStore (Keychain) |
Keychain (com.livebandsundaystream.pairing) | App-Link / companion-camera pairing PIN (salted hash), this device’s random per-device pairing secret, and the trusted-device map (name → secret) | YES — encrypted by OS Keychain (this-device-only); the secret is the trust anchor so a spoofed device name can’t reconnect. Trusted devices moved here from UserDefaults (values are bearer secrets) | PairingPINStore, PairingIdentity, TrustedDeviceStore |
UserDefaults (bibleOnlineTranslations) | Metadata (id, name, language, license link) for online Bible translations the user has added, so they re-register offline at launch | NO — public translation metadata, no PII, no keys | BibleLibrary |
~/Documents/ (helloao_catalog_cache.json) | Cached copy of the public Free Use Bible API catalog listing, so the browser opens instantly | NO — public catalog metadata, no PII | HelloAOCatalogStore |
| ~/Documents/CrashReports/ | MetricKit diagnostic payloads (JSON) | NO — system diagnostics only | CrashReporter |
| ~/Library/Caches/AIInsightCache/ | Automatic AI insight cards / helper answers (Bible chapter summaries + cross-refs, setlist suggestions/flow/titles, tips, library insights), keyed by SHA-256 of feature + prompt, 7-day TTL | NO (derived from the user’s own content; no keys) — expires on its own, erase-all clears it | AIInsightCache |
| Application Support (AI turn diagnostics JSON) | Last 40 LiveBand AI calls: feature, route, engine, latency, tokens, stop reason, tool names, web-search flag, failure kind. Prompt text only while the developer AI debugger is on (160-char preview) | NO — shape of calls, no content by default; erase-all clears it | AITurnDiagnostics |
| ~/Movies/ (macOS) | Broadcast recordings (.mov, HEVC+AAC) and, when multi-track audio recording is enabled, per-channel + master CAF audio files with a session.json manifest | NO (user content) | ProgramRecorder, ISORecordManager, MultitrackAudioRecorder |
Keychain (com.livebandsundaystream.webremote) | Web-remote pairing tokens (presenter, studio), this device only; moved from UserDefaults in 4.0.0 | Medium — controls the room’s screens / the stream on the LAN; never transmitted to us | WebRemoteTokenStore |
Keychain (WebRemoteTLSIdentity, data-protection keychain) | The web remote’s self-signed TLS identity (certificate + private key), minted once in code on first HTTPS start | Low — a local, self-signed server credential; never transmitted to us | WebRemoteTLSIdentity (StudioWebRemote) |
| ~/Application Support/LiveBandSundayStream/ | Security-scoped bookmarks, scene manager data | NO | SecurityBookmarkManager, SceneManager |
| Temp directory | ZIP archives during export (.appbackup) | NO — cleared after user downloads | BackupManager |
| NSUbiquitousKeyValueStore (iCloud) | Songs, setlists, learning progress (JSON) | NO — user’s personal iCloud | SDSong, LearningProgressStore |
PrivacyInfo.xcprivacy Verification
Every target that ships code carries a PrivacyInfo.xcprivacy — five of ours plus the one inside the vendored HaishinKit SDK (six manifests, six rows below). All six declare NSPrivacyTracking = false and an empty NSPrivacyCollectedDataTypes. Required-reason APIs, as declared (verified 2026-10-21 against the files in the repo):
| Manifest | UserDefaults | Disk Space | System Boot Time | File Timestamp |
|---|---|---|---|---|
LiveBandSundayStream/PrivacyInfo.xcprivacy (iOS, iPadOS, macOS app) | CA92.1, 1C8F.1 (App Group shared with the widgets) | 85F4.1, 7D9E.1 | 35F9.1, 3D61.1 | C617.1, 3B52.1 |
LiveBandWidgets/PrivacyInfo.xcprivacy (iOS widgets) | CA92.1 | — | — | — |
LiveBandWatch/PrivacyInfo.xcprivacy (watch app) | CA92.1, 1C8F.1 | — | — | — |
LiveBandWatchWidgets/PrivacyInfo.xcprivacy (watch widgets) | CA92.1, 1C8F.1 | — | — | — |
LiveBandStudio/PrivacyInfo.xcprivacy (LiveBand Studio – LiveStream) | CA92.1 | E174.1, 85F4.1 | 35F9.1 | 3B52.1, C617.1 |
Vendor/HaishinKit.swift/HaishinKit/Sources/PrivacyInfo.xcprivacy (linked by Studio only) | — | — | — | — |
The camera extension (LiveBandCameraExtension) uses none of the required-reason APIs and is covered by Studio’s manifest. PrivacyManifestAudit (TestSupport) checks each manifest against the APIs the code actually calls.
Info.plist Permission Strings
Usage-description strings are defined per-SDK in the target’s INFOPLIST_KEY_* build settings (single source of truth, platform-aware) and merged into the built Info.plist via GENERATE_INFOPLIST_FILE.
| Key | Description | Required For |
|---|---|---|
| NSCameraUsageDescription | Camera access | SundayStream iOS only (Info-iOS.plist): face-gesture lyrics scrolling (ARKit face tracking), PTZ preview, and companion-camera capture. SundayStream for Mac declares no camera key; LiveBand Studio – LiveStream declares its own (live video production) |
| NSMicrophoneUsageDescription | Microphone access | LiveBand Studio – LiveStream: microphone sources for the live mix, recording and the streams the operator configures (audio goes only there). SundayStream (iOS + macOS): tuner and chord recognition, mixer audio analyzer, AI voice input, and Companion Camera sound sent to the user’s own Mac (iOS). Background listening: tuner only, only while its Lock Screen Live Activity shows. Audio Data: not collected |
| NSSpeechRecognitionUsageDescription | Speech recognition | SundayStream (iOS + macOS): spoken questions to the LiveBand AI assistant (Apple Speech framework). LiveBand Studio – LiveStream: Live Captions of the program audio with requiresOnDeviceRecognition — no audio leaves the Mac; purpose string localized en/ne/hi |
| (Screen Recording — no Info.plist key) | Screen recording | LiveBand Studio – LiveStream only: window/display sources use ScreenCaptureKit; macOS asks for Screen Recording in a TCC prompt that has no usage-description key (none is declared — verified in the 1.0.0 archive). SundayStream never captures the screen |
| NSPhotoLibraryAddUsageDescription | Photos (add only) | SundayStream iOS/iPadOS only (new in 4.0.0): Save to Photos for a verse image the user designed (Bible ▸ Share ▸ Image). Add-only; the app never reads the photo library. Not declared on macOS (save panel) or by Studio |
| NSLocalNetworkUsageDescription | Local network | Mixer control (OSC), PTZ (VISCA), network MIDI, LiveBand Link to LiveBand Studio – LiveStream, Presenter Remote, Companion Camera (iOS), Band Sync (iOS + macOS) |
| NSBluetoothAlwaysUsageDescription | Bluetooth | Pairing Bluetooth MIDI keyboards/controllers the user chooses (Controller ▸ Instruments ▸ Pair a Bluetooth Instrument — the prompt appears only there). On-device only; no data collected or transmitted. Declared in the target’s Info.plist (added in 3.0.0 build 2); macOS also gains the sandbox entitlement com.apple.security.device.bluetooth |
| NSBonjourServices | Bonjour | Network device discovery (includes _apple-midi._udp for network MIDI since 3.0.0 build 2) |
All permission strings are present and accurately describe their usage. This table lists only keys the builds actually declare — verified 2026-10-21 against the built Info.plist in each Release archive (HEAD cc72ebc1): SundayStream iOS = Bluetooth, Camera, Local Network, Microphone, Photo Library Add, Speech Recognition (6); SundayStream macOS = Bluetooth, Local Network, Microphone, Speech Recognition (4 — no Camera, no Photos); LiveBand Studio – LiveStream = Camera, Local Network, Microphone, Speech Recognition (4 — no Screen Recording key; see above).
Encryption (ECCN/ITSAppUsesNonExemptEncryption)
| Key | Value | Rationale |
|---|---|---|
| ITSAppUsesNonExemptEncryption (SundayStream, all platforms) | NO | Only OS-provided, standard encryption: HTTPS/TLS through Apple’s networking, the Keychain (Security framework) for stored secrets, on-device SHA-256 for Show Mode and pairing PINs. No third-party cryptography is linked. |
| ITSAppUsesNonExemptEncryption (LiveBand Studio – LiveStream) | NO | Standard, mass-market algorithms only: RTMPS over Apple’s TLS; SRT stream encryption is AES in OpenSSL libcrypto, linked statically inside libsrt (the one third-party crypto library Studio ships — credited under Apache 2.0); HaishinKit’s MD5 is only the RTMP authentication handshake; the Keychain holds stream keys and passphrases. Nothing proprietary or non-standard, so the App Store Connect export question is answered “standard encryption only” (set in LiveBandStudio/Info.plist, 4.0.0 A-08). |
Third-Party SDK / Submodule Audit
SundayStream (iOS, iPadOS, watchOS, macOS) links no third-party code. Everything below is linked by LiveBand Studio – LiveStream only (the Oct 20 audit unlinked the unused RTC and MoQT HaishinKit modules).
| Dependency (Studio only) | Purpose | Privacy Impact |
|---|---|---|
HaishinKit.swift (Vendor/, submodule with local patches) | RTMP/RTMPS/SRT streaming (BSD 3-Clause) | No analytics, no tracking. MD5 used for RTMP auth handshake only. |
| Logboard (via HaishinKit) | HaishinKit’s logging (BSD 3-Clause) | Logs stay in the process; nothing is sent anywhere. |
| libsrt (bundled via HaishinKit) | Secure Reliable Transport protocol (MPL 2.0) | No analytics, no tracking, no data collection. |
| OpenSSL libcrypto (statically inside libsrt) | AES for SRT encryption (Apache 2.0) | Cryptography only; no network calls of its own. |
No analytics frameworks or ad networks are included in either app. License texts surface in-app: SundayStream ▸ Settings ▸ Help & About ▸ About ▸ Acknowledgments & Licenses; Studio ▸ Help ▸ Acknowledgments.
Note: A PrivacyInfo.xcprivacy has been added to the HaishinKit target (Vendor/HaishinKit.swift/HaishinKit/Sources/PrivacyInfo.xcprivacy) declaring no tracking, no collected data types, and no required-reasons APIs (audit confirmed none are used). The HaishinKit Package.swift has been updated to bundle this manifest as a resource.