Privacy Policy

We built the Livestreamer Hub and Twitch Timer overlay to help creators run charity drives, subathons, sound alerts, text-to-speech redemptions, and other interactive features. This Privacy Policy explains what personal information we collect, how we use it, and what choices you have.

1. Information we collect

Account and profile data

When you sign in via Twitch OAuth, we collect and store:

• Twitch user ID, login handle, and display name
• OAuth access tokens (stored temporarily in server memory and automatically expired)

Configuration and preferences

We persistently store settings you configure, including:

• Timer rules (bits, subs, gifted subs, charity, hype train, follows, tips)
• Overlay styles and visual customizations
• Timer state (expiry, pause status, additions)
• Goal configurations (charity drives, subathons, segment tracking)
• Sound alert settings (volume, cooldowns, queue size, overlay duration)
• Text-to-speech settings (voice selection, volume, moderation filters, banned words)
• Default timer duration preferences

Uploaded content

Creators may upload sound files (MP3, OGG, WAV, WebM, MP4, M4A) and video clips. These are stored on our servers and associated with your Twitch user ID.

Subscription and payment data

If you subscribe to a Pro plan, Stripe processes your payment. We store your Stripe customer ID, subscription ID, subscription status, and billing period — but we never store credit card numbers or full payment details. Those are handled entirely by Stripe.

Analytics data

We use Google Analytics (via Firebase) to understand how the extension is used. Analytics events include page loads, feature usage (sound uploads, TTS redemptions, clip creation, settings updates), and channel ID. Analytics data is collected anonymously and is not linked to personal profiles.

Session data

We use a server-side session cookie (overlay.sid) to maintain your authenticated state. This cookie is httpOnly and does not contain personal data directly.

Moderation and safety

We maintain a list of banned user IDs with timestamps and reasons to prevent abuse of the platform.

2. How we use your information

• Provide the service: Authenticate you via Twitch, apply your timer rules, render overlays, process sound alerts, and synthesize text-to-speech audio.
• Process payments: Manage Pro subscriptions through Stripe.
• Improve the product: Analyze anonymous usage patterns via Google Analytics to understand which features are used and how to improve them.
• Prevent abuse: Enforce bans, moderate TTS content (offensive language filtering, caps filtering, URL blocking), and maintain platform security.

3. Twitch data we access

Through Twitch OAuth, we request the following scopes:

• channel:read:subscriptions — to read subscriber events for timer rules
• bits:read — to read bits/cheer transactions for timer rules
• channel:read:charity — to read charity campaign data
• channel:read:hype_train — to read hype train events
• moderator:read:followers — to read follower events for timer rules
• moderation:read — to check channel banned users and blocked terms for content moderation

We access this data only to power the timer, goal tracking, and overlay features you configure. We do not read chat messages, stream metadata, or VOD content.

4. Third-party services

• Twitch (Privacy Policy): Authentication and channel event data via OAuth and EventSub.
• Google / Firebase Analytics (Privacy Policy): Anonymous usage analytics to understand feature adoption and improve the product.
• Stripe (Privacy Policy): Payment processing for Pro subscriptions. Stripe receives your payment details directly — we never see or store full card numbers.
• Inworld AI (Privacy Policy): Text-to-speech synthesis. We send only the text content and selected voice — no user identification is transmitted.
• Cookiebot (Privacy Policy): Cookie consent management for GDPR compliance.

5. Cookies

• Session cookie (overlay.sid): Essential for maintaining your login session. httpOnly, SameSite=Lax.
• Firebase Analytics cookies: Used for anonymous analytics tracking. SameSite=None, Secure, 2-hour expiration.
• Cookiebot cookies: Track your cookie consent preferences.

You can manage cookie preferences through the Cookiebot consent banner or your browser settings.

6. Data retention

• Account and settings data: Retained as long as you use the service. Contact us to request deletion.
• OAuth tokens: Stored in server memory with automatic expiration (approximately 1 hour).
• Session data: Expires when your browser session ends or you log out.
• TTS audio files: Automatically deleted after 10 minutes.
• Uploaded sounds and clips: Retained until you delete them or request account data removal.
• Analytics data: Retained per Google Analytics default retention policies.
• Stripe data: Retained per Stripe's data retention policies for payment compliance.

7. Data storage and security

Your data is hosted on servers in the United States. We protect your data with:

• HTTPS encryption for all data in transit
• httpOnly, Secure session cookies to prevent cross-site scripting attacks
• HMAC-signed OAuth state parameters to prevent CSRF attacks
• Server-side token storage (tokens are never exposed to the browser)
• Webhook signature verification for Stripe events

8. International users

European Economic Area (EEA), UK, and Swiss users can review our GDPR / UK GDPR disclosure for more detail on the lawful bases we rely on and the rights available to you.

9. Your choices and rights

• Access: Contact us to request a copy of the data we hold about you.
• Deletion: Contact us to request deletion of your account data, uploaded content, and stored preferences.
• Cookie control: Use the Cookiebot consent banner or your browser settings to manage cookies.
• Analytics opt-out: You can opt out of Google Analytics using Google's browser add-on or by declining analytics cookies via the consent banner.
• Disconnect Twitch: You can revoke our access at any time from your Twitch Connections settings.

10. Children's privacy

Livestreamer Hub is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. Material changes will be communicated through in-product notices or updates to this page. The "Last updated" date at the top reflects when the most recent revision was published.

12. Contact us

Email help@darkfoxdev.com with any privacy questions, data requests, or concerns. You can also reach us on Discord.