# Commercial: pricing, entitlement, channels, support

The single source of truth for what LlamaCasty charges, what a licence entitles, how it ships and
what support it does and does not include. Read before any pricing, licensing, distribution,
storefront, support or promo work. Cause of death for every retired path:
[`decisions.md`](decisions.md). Release mechanics (build, zip, mirror, winget):
[`Distribution.md`](../../Distribution.md).

## Model

- **Free tier — every feature, every scene, every overlay**, free forever, no account, no
  watermark, nothing nagged inside the output. It is not a trial.
- **Pro — $10/month or $400 lifetime.** No annual tier.
- **The only delta is output quality.** Features are never gated; a payment buys pixels.
- **No watermark, ever**, in either edition. The branding flash is retired as a paid delta and
  stays off (`ShowBrandFlash`, default `false`).
- **Clean numbers, no `.99`**, no discount codes, no countdowns, no fake scarcity.
- **The site publishes the model, never the numbers** — "free forever, every feature unlocked, a
  paid edition with higher output quality at launch". Price, tier name, cap and frame rate are
  published by the **app**, at the point of sale, not by the page.

## Output profile — the one entitlement rule

The cap is a pixel budget plus a frame rate, not the word "720p":

| | Free | Pro |
|---|---|---|
| Pixels | ≤ **921,600** | any shipped tier |
| Frame rate | ≤ **30 fps** | any shipped tier |
| Landscape | 1280×720 @30 | 1280×720 @60 · 1920×1080 @30 · @60 |
| Vertical 9:16 | 720×1280 @30 | 1080×1920 @60 |

- **Records too.** The cap governs the file the creator keeps as well as the stream; otherwise
  free 1080p recording is a re-upload hole. One `OutputProfile`, resolved once per session and
  consumed by **both** the stream encoder and the recorder — never two checks.
- **Fail closed.** Unresolved, unreadable or unvalidated entitlement = free tier. Never Pro.
- **Never downgrade a running stream.** The gate applies to the next start; pulling quality out
  of a live broadcast is a worse bug than one free 1080p session.
- **The greyed menu entry is the sales surface.** It stays clickable, says what it costs, opens
  checkout, and is labelled ("720p30 · free tier") — never silently missing, because silence
  reads as broken.
- **Activation is live**, not restart-gated: activating enables the high tiers and a lapse
  (cancel, revoke, sign-out, channel switch) greys them again on the next refresh.
- **Bitrate follows the profile** — a capped user is not offered a 1080p bitrate.

## Entitlement

**Polar is the merchant of record and the only source of truth.** It takes the money, remits
VAT/GST, handles refunds and chargebacks, and holds the keys. **There is no server of ours in the
loop** — no claim page, no callback endpoint, no key database.

- **Key** — `LCYT-` prefix; org `c05fb364-…` and the endpoints are in `CREDENTIALS.md`. No
  product is created yet.
- **The client talks to Polar directly.** The customer-portal endpoints authenticate on the **key
  itself** plus the `organization_id` (a public identifier). The **org access token must never
  ship in the app** — it is only needed to create products, not to activate them.
- **Bound to the buyer's YouTube channel ID** (`UC…` from `channels.list?mine=true` — the
  signed-in channel, never the `@handle`) through Polar's **`conditions`**, not through a browser
  flow: `activate` is called with `conditions: { "channel_id": "UC…" }`, and every later `validate`
  passes the same object. Polar compares them server-side, so the binding is enforced without us
  hosting anything.
- **Two activations**, any machine, one channel (`limit_activations: 2` on the benefit). A second
  channel is a second key. Two keys for one channel is never sold — it doubles the support surface
  and invites "give one to a friend".
- **Runtime rule:** Pro requires `licence.channelId == connected.channelId`. Equal → Pro.
  Anything else → free tier, working normally, with *"This licence belongs to another channel"*
  and a link to the Polar customer portal. Never an error wall, never a blocked stream.
- **Lease, not a permanent cache:** validate on launch and daily; **7–14 days offline grace**;
  no network past grace = free tier until Polar answers. Never lock a paying user out on a DNS
  failure.
- **Device management is Polar's** — the customer portal already lists and deactivates
  activations, so we build no UI for it. A subscription key is **auto-revoked when the
  subscription ends**, which is what makes a lapse a real state on the monthly SKU.
- **Four states, and nothing else:** valid → Pro · expired/revoked → free with a banner ·
  activation limit reached → "manage devices" portal link · mismatch or offline → free, explained.
- **CLI activation** — `--activate LCYT-…` so silent and fleet installs never meet a dialog.
  Interactive entry in Settings is the secondary path.
- **Notice cadence** — 7 days out, 1 day out, and on the day, inline in the go-live panel with a
  date and a portal link. Recording gets the banner only. Never modal, never blocking a Start,
  never orange (orange is the dev-only label colour).

⛔ **`conditions` is agreement, not cryptography.** A patched client can send someone else's
channel ID. That is accepted: the free tier is the defence, the licence is a lease, and a
determined crack buys little. Do not propose a signed token, a hardware fingerprint or a server
to "fix" it.

## Channels

**One artifact, several ways to get it.** A self-contained single-file `LlamaCasty.exe` plus the
bundled `ffmpeg\` folder, zipped. No .NET install, no admin, no installer framework. Trimming
stays off (WPF reflection), so expect ~110–150 MB.

1. **Direct download** — `llamacasty.com` links the zip. **Binaries live in a second Gitea repo
   (`llamacasty-releases`), push-mirrored to a public GitHub repo**, so the source repo stays
   private and the handout repo contains nothing but a README, an issue template and the release
   assets. The mirror carries refs, not GitHub Release assets — the zip is uploaded with
   `gh release create`. Mechanics: [`Distribution.md`](../../Distribution.md).
2. **winget — the primary install path.** Manifest in `microsoft/winget-pkgs`, `InstallerType:
   portable`, pinned SHA-256. That hash pin is the anti-tamper wall: the official channel delivers
   exactly the published artifact or fails. One `wingetcreate update` PR per release. Optional:
   Scoop and Chocolatey manifests over the same zip.
3. **Steam — parked at $100.** Lifetime Pro as DLC only (Steam has no subscriptions), page public
   two weeks before release, 30% cut, and price parity with the site. It is the only channel with
   discovery *and* an install that never meets SmartScreen, and it updates itself — which is why it
   stays in the plan despite the cut.
4. **Microsoft Store — parked, and now free.** Microsoft waived the **$19** individual developer
   fee (and removed the **$99** company fee in May 2026). It is the only storefront that bills a
   subscription natively *and* the only zero-cost route to a Microsoft-signed install with no
   SmartScreen warning, because Microsoft signs the MSIX. Bans self-updaters, so a Store build
   ships without one.

**Not channels, ever:** Patreon or any subscription platform of our own, paywalled early access,
a paid beta, a Discord. Content is the funnel; the channel is only the checkout.

**Portable mode:** a `portable.txt` marker beside the exe keeps the layout DB and settings in
`.\data\` instead of `%APPDATA%\ytLlive` — the USB-stick case, hung off `LayoutPathOverride`.
It is the reason the zip survives even if Steam becomes the primary channel.

## Signing — deferred until there is revenue

- **Not bought at launch.** Artifact Signing is listed in the costs as **deferred**: it is paid for
  out of Pro revenue, and the trigger is **two subscribers**.
- **What it actually buys:** a named publisher line, fewer antivirus false positives on a ~150 MB
  self-extracting exe, and tamper evidence for hand-downloaded zips. It does **not** remove the
  SmartScreen warning on day one — Microsoft deleted the EV instant-bypass in March 2024, so a new
  certificate has zero reputation and clears only with download volume.
- **Azure Artifact Signing** (renamed from "Trusted Signing"), **$9.99/month Basic**, up to 5,000
  signatures, **requires a paid Azure subscription**. Individual identity validation exists and
  must be renewed before it expires; it is the slow (days-to-weeks) part, so start it *when the
  purchase is decided*, not before.
- **Reputation accrues to the publisher, not the file.** Unsigned means the warning on **every**
  release, forever, because SmartScreen ties reputation to each file hash. Signing is the only exit
  from that per-release tax.
- **The free alternative is the Store** (see Channels 4): a free developer account gets
  Microsoft-signed installs with no certificate of ours.
- **No EV certificate, ever** — $400+/yr for what OV buys, and the bypass is gone.
- Every signed release: same pass, SHA-256 in the winget manifest, licence ID visible in About.

## Support

**Email. Best effort. No SLA. Refunds granted on request, without argument.**

- **There is no training service.** "I want people to succeed" is not "I will train them". The app
  teaches itself — one-click go-live, five scenes, nothing to configure. A how-to question means
  the app or its docs fell short; the answer is a fix or a video, not a conversation.
- **No helpdesk.** No ticketing system, no live chat, no onboarding calls, no hand-holding.
- **A repeated question is a video, not a ticket** — see `MARCOM.md` → support → content loop. The
  training channel is the support surface.
- **The issue tracker is a filter, deliberately.** Bugs go to the public releases repo on GitHub,
  which requires an account; Steam Discussions stay pinned and unread; Announcements carry known
  issues and release notes. Steam refunds are Valve's own (2 h / 14 days) and cost us nothing.
- **Nobody is locked out over a licence.** A billing hiccup drops the app to the free profile with
  a banner and a portal link — never a blocked stream, never a modal.

## Founding 200 promo

Cash cost **$0**; it is priced in support time and forgone list revenue.

- **90 days free** — a 100%-off Polar coupon, `duration = repeating, months = 3`.
- **Founder price lock** — their $10/month stays $10 permanently.
- **Credits + in-app Founder badge** (opt-in channel name on the site).
- **30-day passes** — unique keys carrying the issuer's channel, issued **one per 30 active days,
  max 3 held**, activation limit 1–2, expiring 30 days **after activation**. Earned, never handed
  out: a pass nobody uses teaches nothing.
- Optional **$250 lifetime** window in the first 90 days — converting a founder beats three
  months of free.
- Reminders at day 75 and 85; the renewal cliff is where founders churn.
- Terms, one paragraph: one per person, passes expire 30 days after activation, no cash value,
  revoked for resale or abuse, price lock void if the subscription lapses.

## Costs

| Item | Cost |
|---|---|
| Domain | ~$15/yr |
| Droplet | $0 — serves the existing site |
| GitHub public repo (releases + issues), Gitea, winget, Scoop, Chocolatey | $0 |
| Polar | 5% + 50¢ per sale → $10 nets $9.00, $400 nets $379.50 |
| Azure Artifact Signing — **deferred** | $9.99/month (~$120/yr), bought at two subscribers |
| Steam Direct (optional) | $100 once, recoupable after $1,000 AGR |
| Microsoft Store (optional) | **$0** — the individual fee was waived |

Fixed year one ≈ **$15** while unsigned, ≈ **$135** once signing starts. **Break-even is two
subscribers** (15 subscriber-months ≈ $135); one $400 lifetime sale covers nearly three years.

## Anti-piracy posture

**Any check that runs on the user's machine can be removed.** The goal is a crack that is
pointless and a leak that is traceable — not an unbreakable binary.

- **The free tier is the real defence.** If the only delta is pixels above 921,600, a cracked
  build buys almost nothing and forfeits updates, support and the publisher's signature.
- **Hash-pinned delivery, signed once revenue exists** — a patched build cannot arrive through
  winget, and a forged one is not signed as us. Until signing starts, the SHA-256 pin is the wall.
- **Short leases** — a revoked or refunded key dies inside the grace window.
- **Licence ID in About** — a leaked build traces back to a purchase.

⛔ **Rejected, do not re-propose:** a native helper DLL for "IP protection", obfuscation, hardware
locking, remote code that downloads and executes, and gating asset downloads as an auth check.
None of them make a licence enforceable; the first three add failure modes without buying
anything, the fourth needs the server this plan exists to avoid, and the fifth is Store policy
10.2.2.