Privacy Policy

Data we collect

When you sign in with Twitch, Google (YouTube), or Kick — as a streamer or as a viewer — the platform shares your account ID, display name, avatar, and email address with us. We use your email address only to identify your account and to contact you about it. If you connect a platform as a streamer to power your shop, alerts, games, or chatbot, we additionally request the specific permissions shown on that platform's consent screen:

• Twitch — channel point redemptions, live chat (to read chat commands and post chatbot messages), and follow / subscription / cheer events used to fire alerts.
• YouTube (Google) — live chat read and post access for your own channel. See "YouTube and Google data" below for the full detail Google requires us to disclose.
• Kick — chat, follow / subscription events, and channel point reward redemptions, used to fire alerts and run chat features.
• Spotify — see "Spotify data" below.

How we use your data

We use the data described in this policy only to provide and improve the StreamFirefly features you use: signing you in, running a streamer's shop, keeping viewer points balances, firing alerts and effects on stream, running chat games and song requests, and posting chatbot messages. We do not sell your data, we do not use it for advertising, and we do not use it to train artificial intelligence or machine learning models.

YouTube and Google data

StreamFirefly uses YouTube API Services. By using the YouTube features of StreamFirefly you agree to be bound by the YouTube Terms of Service. Google's handling of your data is governed by the Google Privacy Policy.

What we access. When you sign in with Google we receive your Google account ID, name, profile picture, and email address (the openid, email, and profile scopes). Streamers who connect YouTube also grant the youtube.force-ssl scope, which we use only for the streamer's own channel, to:

• Resolve your channel ID when you connect your account.
• Find the live chat ID of your currently active broadcast.
• Read your live chat to detect Super Chat, new member, and gifted membership events that drive your alerts, and chat commands that viewers type to take part in your stream — checking their points, playing chat games such as trivia and heists, and requesting songs.
• Post chatbot messages into your live chat when an alert, shop redemption, chat game, or chat command calls for one. These messages are posted by the StreamFirefly bot account, or by a bot account you connect yourself, and only after you turn the chatbot on.

What we store. We store your encrypted OAuth tokens and a poll cursor (your live chat ID, a page token, and a timestamp marking the last event we already processed, so a restart never replays old chat history). We do not store chat message text or Super Chat amounts. When a viewer takes part through YouTube chat — for example by answering trivia, joining a heist, or requesting a song — we store that viewer's YouTube channel ID and display name so their points balance and requests can be attributed to them, along with the details of any song they requested.

Retention and deletion. Your OAuth tokens and poll cursor are deleted immediately when you disconnect YouTube. If you revoke our access from your Google account instead, every piece of YouTube authorized data we hold for you is deleted within 7 days — in practice immediately, when we next attempt to use the revoked credential. A viewer's channel ID and display name are kept so their points balance stays attached to them, and are deleted on request (see "Your rights" below).

Revoking access. You can disconnect YouTube at any time from your StreamFirefly dashboard, which deletes our stored tokens and your poll cursor right away. You can also revoke StreamFirefly's access to your Google account directly at the Google security settings page, https://myaccount.google.com/permissions.

Limited Use. StreamFirefly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We never sell Google user data, never use it for advertising, never transfer it to data brokers or information resellers, and never use it to develop, improve, or train artificial intelligence or machine learning models. No person at StreamFirefly reads your Google user data except with your permission, for security purposes, or to comply with the law.

Spotify data

If you connect Spotify to use song requests, we store your Spotify user ID, display name, and product tier (premium or free), plus the track metadata — title, artist, artwork, and duration — for songs requested in your channel, so requests can be attributed and revoked. We never receive or store your Spotify password or payment information, and viewers never authenticate with Spotify: no viewer data is sent to Spotify at any point. Disconnecting Spotify from your dashboard deletes our stored tokens immediately.

Text-to-speech

If a streamer configures a text-to-speech effect, the text to be spoken — which may include a short message written by the redeeming viewer — is sent to Amazon Web Services for speech synthesis and returned as audio. We do not retain the synthesized audio or the submitted text after the effect plays.

Browser extension

Our optional browser extension runs only on Twitch, YouTube, and Kick stream pages. It reads the channel identity from the page URL so it can find that streamer's shop, and — while the tab is focused and you are signed in — reports watch-time ticks so you earn loyalty points. It does not read page content, browsing history, or activity on any other site, and it sends data only to StreamFirefly.

Viewer data

Viewers earn and spend loyalty points in a streamer's shop. We keep a points balance and a redemption history per viewer so streamers can review their own shop activity. Redemption history is retained indefinitely for the streamer's records, the same way a payment ledger would be.

Who we share data with

We do not sell, rent, or trade your data, and we do not share it with third parties for any purpose other than running StreamFirefly. The streamer whose shop you use can see your display name, points balance, and redemptions in that shop. Beyond that, data is processed only by the service providers that run StreamFirefly on our behalf:

• Supabase — our database, sign-in, and file storage.
• Vercel — hosting for the website and its servers.
• Amazon Web Services — text-to-speech (see above).
• Upstash — rate limiting, which keys on account identifiers and IP addresses.
• Sentry — error reports, with IP addresses, cookies, request headers, and request bodies removed before they are sent.

We may also disclose data where the law requires it, or to protect the security of StreamFirefly and its users.

How we protect your data

All data is encrypted in transit over HTTPS. OAuth access and refresh tokens for every connected platform are additionally encrypted at rest with AES-256-GCM before they touch our database, using a server-only encryption key that never reaches your browser or any client application. Database access is restricted per account by row-level security, so each streamer can reach only their own shop's data.

Where your data is handled

StreamFirefly is operated from British Columbia, Canada. The data described in this policy is stored and processed by our infrastructure providers, which may be located outside Canada — including in the United States — and may therefore be subject to the laws of those countries. By using StreamFirefly you consent to that transfer.

Your rights

You can request deletion of your data at any time by emailing us (see Contact below). When you do:

• Your display name on past redemptions is replaced with "[deleted]".
• Your points balance is deleted.
• Your viewer account record is deleted.
• Past redemption records are kept for the streamer's records, but with your identity anonymized.

Streamers can delete their entire account from the dashboard settings page, which removes their shop, items, uploaded media, connected platform tokens, and viewer balances.

Disconnecting a platform from your streamer dashboard removes that platform's stored tokens immediately and, where the platform supports it, revokes our authorization on the platform itself; disconnecting YouTube specifically also deletes its live chat poll cursor right away.

Third-party platforms

Twitch, YouTube (Google), Kick, and Spotify are independent data controllers for the data they collect through their own apps. Please review their respective privacy policies to understand how each platform handles your data outside of StreamFirefly.

Changes to this policy

If we make material changes to this policy, we'll update the effective date above and, where required, notify connected streamers directly. If we ever change how we use Google user data, we will ask for your consent before doing so.

Contact

Questions or deletion requests: privacy@streamfirefly.com