Privacy Policy

1.1 The Operator of the Service, and the party that determines the purposes and means of the processing described in this policy, is the administrator of this SRTLA Hub deployment. That party is the controller of the personal data described here. Contact details are set out in Clause 11.

2.1 Identity data from Twitch. When you sign in through Twitch OAuth we receive your Twitch user ID, login name, display name, and profile image URL. We do not receive your Twitch password.

2.1a Follower count. While your account is awaiting approval, and only then, we ask Twitch for the total number of followers of your channel in order to run the automatic approval check described in Clause 3.3. We read that total, compare it to the configured threshold, and discard it: it is never written to your account record, our audit records, or any operator notification, and we do not receive the identities of your followers. Once your account is approved or you are approved by hand, we stop asking.

2.2 Session data. We issue an unguessable, randomly generated session cookie to keep you signed in; it is transmitted only over HTTPS and is inaccessible to scripts. We store session records to operate your session: the session identifier is stored server-side in hashed form, and the associated access token issued by Twitch is encrypted at rest.

2.3 Network data. We record IP addresses in connection with sign-in, programme interface requests, rate limiting, abuse prevention, and security logging. We also retain the IP address used for first registration and full sign-in, publisher, and active SRTLA uplink IP addresses linked to your account and, for streaming activity, the stream session, with first and last observation times, for private administrator abuse review.

2.4 Streaming data. We generate and store your stream key; records of your streaming sessions (start and end times, receiving node, bitrate, viewer counts, and quality metrics); daily bandwidth usage (bytes received and transmitted, durations); and stream incident events (such as disconnects and bitrate drops). During a live broadcast we also attempt an initial screenshot and then sample individual video frames at random intervals of five to fifteen minutes. Administrators can review these screenshots to investigate misuse of the Service. This sampling captures only video you broadcast through the Service, without audio or continuous recording.

2.5 Notification data. If you enable push notifications we store your browser's push subscription endpoint and the associated delivery keys, together with your chosen notification categories.

2.6 Administrative records. Actions taken in the dashboard are recorded in an audit log containing the actor's identity, the action, its target, the originating IP address, and a timestamp. Infrastructure telemetry (receiver node CPU, memory, disk, and throughput) is collected from receiver nodes and is not personal data about Users, though it may appear alongside the records above.

2.7 Usage-cost records. We maintain a ledger of usage-cost records derived from your bandwidth and streaming activity (the period concerned, the quantities used, the applicable rates, and the resulting amounts), associated with your account, for the quota-administration and billing purposes described in Clause 3.

2.8 Legal acceptance records. When you affirmatively accept the Terms and acknowledge this policy before Twitch sign-in, we store your Twitch user ID, the exact Terms and Privacy Policy versions, a server timestamp, and a non-secret OAuth transaction digest as immutable evidence of that acceptance.

2.9 Client diagnostic data. When the dashboard encounters a technical failure, it sends a controlled diagnostic record containing the failure category and code, a broad route class (such as “admin” or “stream”), the software release, the time, and a locally generated correlation identifier. It does not send the error message, full URL, stack trace, user ID, stream key, response body, or arbitrary error properties. The correlation identifier is pseudonymous and is shown to you as a support reference. It may be linked to you if you provide that reference when requesting support or through correlation with the network and security logs described in Clauses 2.3 and 2.6; the request itself also carries the network data described in Clause 2.3.

3.1 We collect and use the data described above for the following purposes: (a) operating the Service, including authentication, stream ingest and relay, monitoring, and notifications you have requested; (b) protecting the Service and its Users, including rate limiting, abuse detection, and security investigation; (c) administering quotas and, where agreed, usage-based billing; (d) maintaining accountability of administrative actions through audit records; (e) diagnosing dashboard failures and providing support using the limited client diagnostic data described in Clause 2.9; and (f) complying with obligations applicable to the Operator.

3.2 We do not use your personal data for advertising or profiling, and we do not use it for any purpose not set out in this policy without first informing you.

3.3 Automatic approval. New accounts start as pending and require approval before they can stream. We operate one automated check on this: if the follower total described in Clause 2.1a exceeds a threshold we configure, your account is approved automatically at sign-in. This check can only ever grant approval. It never refuses, downgrades, suspends, or restricts an account, and it is not used for any other decision. If it does not approve you — including whenever the check is switched off, unavailable, or unable to reach Twitch — nothing about your account changes and it simply remains pending for a human to review, which is the outcome for every account before this check existed. An administrator can approve an account by hand at any time, and an administrator's decision always overrides this check. You may ask us to review an automatic approval, or to disregard it and decide by hand, using the contact details in Clause 11.

4.1 We do not sell personal data. We disclose personal data only: (a) to Twitch, as inherent in the OAuth sign-in flow; (b) to Cloudflare, whose Pages, Workers, Durable Objects, R2 storage, tunnelling, and content delivery infrastructure process dashboard traffic and control-plane data; (c) to Discord, where operator alerts and a sign-up event containing your Twitch login name may be delivered to an administrative channel — either that your account is awaiting approval or that it was approved automatically under Clause 3.3. Alerts may reference node names and metric values. Sign-up notices do not include your Twitch user ID, display name, stream key, or follower total; (d) to your browser vendor's push notification service, where you have enabled push notifications; (e) to the hosting providers on whose infrastructure the Service's receiver nodes and servers run, as inherent in operating that infrastructure; and (f) where disclosure is required by a lawful demand that the Operator is obliged to honour; and (g), only if the Operator explicitly enables the disabled-by-default external network-geolocation feature, to ipwho.is, which receives the raw publisher or viewer IP address solely to return approximate country, city, and network organisation information. The feature remains off unless the Operator has separately approved that processor and disclosure.

4.2 The Service is operated on receiver nodes and hosting infrastructure located in multiple regions. The personal data described in Section 2 may accordingly be processed on, and transferred between, infrastructure in regions other than your own; the safeguards described in this policy apply wherever the data is processed.

5.1 Personal data is retained only as long as necessary for the purposes above, under retention policies enforced by automated deletion: infrastructure metrics are retained for no more than seven days by default; bandwidth and audit records for no more than three hundred and sixty-five days; and streaming session and incident records for no more than three hundred and sixty-five days. Each automated deletion pass is itself recorded so that retention is verifiable. If the operative retention periods change, this clause will be updated accordingly. Private abuse-review IP records and screenshots expire after thirty days. Storage limits may remove older records sooner: we keep up to two hundred IP records and one hundred screenshots per account, subject to service-wide limits of ten thousand IP records and one thousand screenshots. These review records are also erased when the associated account is deleted.

5.2 Session records expire and are deleted automatically. Upon deletion of your account, the operational personal data associated with it — including push subscriptions, streaming session records, and incident delivery records, and detailed uplink-drop records — is deleted, with two exceptions: audit records are retained for the remainder of the retention period stated in Clause 5.1; and bandwidth and usage-cost records are retained for the remainder of their retention period to preserve billing integrity, after which they are deleted. The distinct legal evidence record is governed by Clause 5.3.

5.3 The versioned legal acceptance record described in Clause 2.8 is retained separately as immutable evidence for as long as reasonably necessary to establish, exercise, or defend rights arising from the agreement, and for any longer period required by applicable record-keeping law. It is not used to operate your deleted account.

5.4 Cloudflare retains encrypted Durable Object database history for point-in-time recovery for up to thirty days. Named recovery points label that history and are not downloadable database copies. A temporary, offline-key-encrypted migration archive may also be kept in private R2 storage for no more than thirty days after migration. Account deletion is applied to the live Service immediately; a minimal deletion marker is preserved and reapplied during database recovery so that restoring an earlier backup does not reactivate an erased account. Residual copies of other deleted data may remain in access-restricted recovery history only until that history reaches this thirty-day expiry.

5.5 Client diagnostic records written to the Operator's access-restricted application logs are retained for no more than thirty days and are then automatically rotated and deleted. They are not indexed by account or user ID, although the network and security logs described above may permit correlation with an account. Because the diagnostic records have no direct account index, account deletion does not trigger a separate diagnostic-log lookup or early deletion; these records remain subject to the same thirty-day maximum.

6.1 We apply technical and organisational measures appropriate to the data we hold, including: encryption of traffic in transit (HTTPS); encryption of stored session access tokens; storage of session identifiers in hashed form; strict origin checks on realtime connections; server-side request safeguards; per-route rate limiting; and role-based access controls separating administrative functions from ordinary accounts.

6.2 No security measure is absolute. Clause 10 describes how incidents are handled.

7.1 We take reasonable steps to keep personal data accurate; identity data is refreshed from Twitch upon each sign-in. We use personal data only for the purposes stated in Clause 3, and access within the Operator's administration is limited to what each role requires.

8.1 You may request: (a) confirmation of whether we hold personal data about you and a copy of it; (b) correction of inaccurate personal data; (c) deletion of your account and associated personal data, subject to Clause 5; and (d) cessation of any particular use of your personal data, on reasonable grounds. Requests may be made through the contact route in Clause 11 and will be acted upon within a reasonable period, ordinarily not exceeding one month; if we need longer, we will tell you and explain why.

9.1 The Service uses only strictly necessary first-party cookies: the session cookie described in Clause 2.2 — an unguessable, randomly generated value, transmitted only over HTTPS, inaccessible to scripts, scoped to the Service, and expiring automatically — and two short-lived (five-minute) cookies used solely to secure the sign-in handshake. No advertising or cross-site tracking cookies are used.

10.1 If the Operator becomes aware of an incident affecting the confidentiality or integrity of personal data, it will assess the incident, take reasonable remedial steps, and notify affected Users without undue delay where the incident is likely to result in significant harm.

10.2 Complaints about the handling of personal data may be raised through the contact route in Clause 11 and will be investigated in good faith. This does not limit any other remedy available to you.

11.1 Requests and enquiries concerning this policy may be directed through the administration channel supplied with access to this Service.

12.1 The Operator may amend this policy from time to time. The current version, together with its effective date, will be published on this page, and material changes will, where practicable, be notified through the dashboard before they take effect. A change that introduces a new purpose of use or a new category of disclosure will in every case be notified through the dashboard before it takes effect.