LlamaCasty/docs/ai/commercial.md

Commercial: pricing, entitlement, channels

The single source of truth for what LlamaCasty charges, what a licence entitles, and how it ships. Read before any pricing, licensing, distribution, storefront or promo work. Cause of death for every retired path: decisions.md.

Model

• Free tier — every feature, every scene, every overlay, free forever, no account, no watermark, nothing nagged inside the output. It is not a trial.
• Pro — $10/month or $400 lifetime. No annual tier.
• The only delta is output quality. Features are never gated; a payment buys pixels.
• No watermark, ever, in either edition. The branding flash is retired as a paid delta and stays off (ShowBrandFlash, default false).
• Clean numbers, no .99, no discount codes, no countdowns, no fake scarcity.
• The site publishes the model, never the numbers — "free forever, every feature unlocked, a paid edition with higher output quality at launch". Price, tier name, cap and frame rate are published by the app, at the point of sale, not by the page.

Output profile — the one entitlement rule

The cap is a pixel budget plus a frame rate, not the word "720p":

	Free	Pro
Pixels	≤ 921,600	any shipped tier
Frame rate	≤ 30 fps	any shipped tier
Landscape	1280×720 @30	1280×720 @60 · 1920×1080 @30 · @60
Vertical 9:16	720×1280 @30	1080×1920 @60

• Records too. The cap governs the file the creator keeps as well as the stream; otherwise free 1080p recording is a re-upload hole. One OutputProfile, resolved once per session and consumed by both the stream encoder and the recorder — never two checks.
• Fail closed. Unresolved, unreadable or unvalidated entitlement = free tier. Never Pro.
• Never downgrade a running stream. The gate applies to the next start; pulling quality out of a live broadcast is a worse bug than one free 1080p session.
• The greyed menu entry is the sales surface. It stays clickable, says what it costs, opens checkout, and is labelled ("720p30 · free tier") — never silently missing, because silence reads as broken.
• Activation is live, not restart-gated: activating enables the high tiers and a lapse (cancel, revoke, sign-out, channel switch) greys them again on the next refresh.
• Bitrate follows the profile — a capped user is not offered a 1080p bitrate.

Entitlement

Polar is the merchant of record and the only source of truth. It takes the money, remits VAT/GST, handles refunds and chargebacks, and holds the keys. Nothing of ours sits in the middle.

• Key — LCYT- prefix; org c05fb364-… and the endpoint are in CREDENTIALS.md. No product is created yet.
• Bound to the creator's YouTube channel ID (UC… from channels.list?mine=true) — the active brand account's channel, never the @handle. Written once through a claim page after purchase (OAuth), not prefilled at checkout: the buyer's browser may be signed into a different Google account, and that is manual reconciliation forever.
• Two activations, any machine, one channel. A second channel is a second key. Two keys for one channel is never sold — it doubles the support surface and invites "give one to a friend".
• Runtime rule: Pro requires licence.channelId == connected.channelId. Equal → Pro. Anything else → free tier, working normally, with "This licence belongs to another channel" and a link to the Polar customer portal. Never an error wall, never a blocked stream.
• Lease, not a permanent cache: validate on launch and daily; 7–14 days offline grace; no network past grace = free tier until Polar answers. Never lock a paying user out on a DNS failure.
• Four states, and nothing else: valid → Pro · expired → free with a banner · activation limit reached → "manage devices" portal link · mismatch or offline → free, explained.
• CLI activation — --activate LCYT-… so silent and fleet installs never meet a dialog. Interactive entry in Settings is the secondary path.
• Notice cadence — 7 days out, 1 day out, and on the day, inline in the go-live panel with a date and a portal link. Recording gets the banner only. Never modal, never blocking a Start, never orange (orange is the dev-only label colour).

Channels

One artifact, three ways to get it. A self-contained single-file LlamaCasty.exe plus the bundled ffmpeg\ folder, zipped. No .NET install, no admin, no installer framework. Trimming stays off (WPF reflection), so expect ~110–150 MB.

1. Direct download — llamacasty.com links the zip; the binaries live on GitHub Releases, not the droplet (free CDN, durable URLs, release notes).
2. winget — the primary channel. Manifest in microsoft/winget-pkgs, InstallerType: portable, pinned SHA-256. That hash pin is the anti-tamper wall: the official channel delivers exactly the published artifact or fails. One wingetcreate update PR per release. Optional: Scoop and Chocolatey manifests over the same zip.
3. Steam — parked at $100. Lifetime Pro as DLC only (Steam has no subscriptions), page public two weeks before release, 30% cut, and price parity with the site.
4. Microsoft Store — parked. $19 Individual account; the only storefront that bills a subscription natively and installs without a warning. Bans self-updaters, so a Store build ships without one.

Not channels, ever: Patreon or any subscription platform of our own, paywalled early access, a paid beta, a Discord. Support is a public GitHub issue tracker. Content is the funnel; the channel is only the checkout.

Portable mode: a portable.txt marker beside the exe keeps the layout DB and settings in .\data\ instead of %APPDATA%\ytLlive — the USB-stick case, hung off LayoutPathOverride.

Signing

• Azure Trusted Signing, ~$9.99/month, is the intended certificate: Microsoft-issued, accrues SmartScreen reputation, enrols individuals after identity verification.
• No EV certificate — Microsoft removed the SmartScreen instant-bypass in March 2024.
• Until it is in place, builds ship unsigned and the "unknown publisher" line is accepted. winget spares the browser prompt, not the publisher warning.
• Every release: same signing pass, SHA-256 in the manifest, licence ID visible in About.

Founding 200 promo

Cash cost $0; it is priced in support time and forgone list revenue.

• 90 days free — a 100%-off Polar coupon, duration = repeating, months = 3.
• Founder price lock — their $10/month stays $10 permanently.
• Credits + in-app Founder badge (opt-in channel name on the site).
• 30-day passes — unique keys carrying the issuer's channel, issued one per 30 active days, max 3 held, activation limit 1–2, expiring 30 days after activation. Earned, never handed out: a pass nobody uses teaches nothing.
• Optional $250 lifetime window in the first 90 days — converting a founder beats three months of free.
• Reminders at day 75 and 85; the renewal cliff is where founders churn.
• Terms, one paragraph: one per person, passes expire 30 days after activation, no cash value, revoked for resale or abuse, price lock void if the subscription lapses.

Costs

Item	Cost
Azure Trusted Signing	$9.99/month (~$120/yr)
Domain	~$15/yr
Droplet	$0 — serves the existing site
GitHub Releases, winget, Scoop, Chocolatey	$0
Polar	5% + 50¢ per sale → $10 nets $9.00, $400 nets $379.50
Steam Direct (optional)	$100 once, recoupable after $1,000 AGR
Microsoft Store (optional)	$19 once

Fixed year one ≈ $135, and the same every year after. Break-even is two subscribers (15 subscriber-months ≈ $135); one $400 lifetime sale covers nearly three years.

Anti-piracy posture

Any check that runs on the user's machine can be removed. The goal is a crack that is pointless and a leak that is traceable — not an unbreakable binary.

• The free tier is the real defence. If the only delta is pixels above 921,600, a cracked build buys almost nothing and forfeits updates, support and the publisher's signature.
• Hash-pinned delivery + signed builds — a patched build cannot arrive through winget, and a forged one is not signed as us.
• Short leases — a revoked or refunded key dies inside the grace window.
• Licence ID in About — a leaked build traces back to a purchase.

⛔ Rejected, do not re-propose: a native helper DLL for "IP protection", obfuscation, hardware locking, remote code that downloads and executes, and gating asset downloads as an auth check. None of them make a licence enforceable; the first three add failure modes without buying anything, the fourth needs the server this plan exists to avoid, and the fifth is Store policy 10.2.2.