Privacy Policy

1. Introduction

Twitch YouTube Kick Chat Merger ("we", "our", or "the extension") is a Chrome browser extension that merges YouTube, Twitch, and Kick chat messages into your Twitch Dashboard for personal monitoring. This Privacy Policy explains what data we handle, how we handle it, and your rights regarding your data.

Developer: Amoner
Extension: Twitch YouTube Kick Chat Merger
Website: https://amoner.github.io/twitube-docs
Contact: Artem.S.Beer@gmail.com

2. Data We Handle

2.1 Authentication Tokens

What we collect:

• YouTube OAuth 2.0 access tokens and refresh tokens
• Twitch OAuth 2.0 access tokens
• Twitch user ID and username

How we collect it: Through official YouTube and Twitch OAuth authorization flows when you click "Sign in with YouTube" or "Sign in with Twitch". Kick does not require authentication.

Why we need it: To access YouTube Live Chat API and Twitch EventSub API on your behalf to retrieve chat messages.

How we store it: Encrypted using AES-256-GCM encryption in Chrome's local storage (chrome.storage.local), which is isolated from websites and other extensions. The encryption key is derived from your unique extension installation ID using PBKDF2 with 100,000 iterations.

How long we keep it: Until you click "Sign Out" or uninstall the extension. Tokens are automatically refreshed (YouTube only) to maintain your session.

2.2 Chat Messages

What we collect:

• YouTube live chat messages (username, message text, timestamp, user badges)
• Twitch chat messages (username, message text, timestamp, user badges)
• Kick chat messages (username, message text, timestamp, emotes)

How we collect it: Retrieved from YouTube Data API v3, Twitch EventSub WebSocket, and Kick Pusher WebSocket when you start monitoring a channel.

Why we need it: To display merged chat messages in your Twitch Dashboard.

How we store it: Temporarily cached in memory (service worker) and Chrome's local storage with a rolling limit of 500 messages maximum.

How long we keep it: Messages older than the 500-message limit are automatically deleted. All messages are cleared when you stop monitoring or uninstall the extension.

2.3 Extension Settings & Preferences

What we collect:

• User preferences (polling interval, message display settings, masking options)
• Active session data (which channels you're monitoring)

How we store it: Unencrypted in Chrome's local storage (chrome.storage.local).

How long we keep it: Until you clear the extension's data or uninstall.

3. How We Use Your Data

3.1 Local Processing Only

All data processing happens locally on your device. We do not have servers. We do not transmit your data to any third-party servers except:

• YouTube: To authenticate you and retrieve live chat messages via the official YouTube Data API v3
• Twitch: To authenticate you and retrieve chat messages via the official Twitch EventSub WebSocket API
• Kick: To retrieve channel info and chat messages via Kick API and Pusher WebSocket (no authentication required)
• Paddle: To process Pro subscription payments (Paddle is our payment processor)

3.2 Specific Uses

• Authentication: OAuth tokens are used to authenticate API requests to YouTube and Twitch
• Chat Retrieval: Tokens authorize the extension to read live chat messages from channels you choose to monitor
• Message Display: Chat messages are injected into your Twitch Dashboard's DOM for viewing
• Moderation: Tokens allow you to delete messages or ban users on YouTube (if you have moderator permissions)

4. Data We Do NOT Collect

• We do NOT collect your browsing history
• We do NOT collect your email address or personal information (beyond what OAuth provides)
• We do NOT track your usage patterns or analytics
• We do NOT sell, rent, or share your data with third parties
• We do NOT display advertisements
• We do NOT use cookies for tracking
• We do NOT transmit data to our own servers (we don't have any)

5. Third-Party Services

5.1 YouTube Data API v3

When you authenticate with YouTube and monitor a YouTube channel, the extension communicates with Google's YouTube Data API v3 to:

• Authenticate you via OAuth 2.0
• Retrieve live chat messages
• Perform moderation actions (delete messages, ban users) if you're a moderator

Data shared with YouTube: Your OAuth token (securely transmitted via HTTPS)

YouTube's Privacy Policy: https://policies.google.com/privacy

5.2 Twitch EventSub API

When you authenticate with Twitch and monitor a Twitch channel, the extension communicates with Twitch's EventSub WebSocket API to:

• Authenticate you via OAuth 2.0
• Receive real-time chat messages

Data shared with Twitch: Your OAuth token (securely transmitted via WSS - encrypted WebSocket)

Twitch's Privacy Policy: https://www.twitch.tv/p/legal/privacy-notice/

5.3 Kick API & Pusher WebSocket

When you monitor a Kick channel, the extension communicates with Kick's API and Pusher WebSocket to:

• Retrieve channel information (channel ID, chatroom ID)
• Receive real-time chat messages

Data shared with Kick: Only the channel name you choose to monitor (no authentication required)

Kick's Privacy Policy: https://kick.com/privacy-policy

5.4 Paddle (Payment Processor)

If you upgrade to Pro, payments are processed by Paddle.com. When you make a purchase:

• Paddle collects payment information (credit card, billing address)
• Paddle handles VAT/tax compliance as merchant of record
• We only receive: subscription status, expiry date, and email (for support)

Paddle's Privacy Policy: https://www.paddle.com/legal/privacy

6. Data Security

6.1 Encryption

All OAuth tokens are encrypted at rest using:

• Algorithm: AES-256-GCM (Advanced Encryption Standard with Galois/Counter Mode)
• Key Derivation: PBKDF2 with 100,000 iterations, SHA-256 hash function
• Unique Initialization Vector: Each encryption operation uses a random 96-bit IV
• Key Source: Derived from your unique Chrome extension installation ID

6.2 Secure Transmission

• All API requests use HTTPS (encrypted in transit)
• Twitch WebSocket uses WSS (encrypted WebSocket)
• OAuth flows use industry-standard PKCE (Proof Key for Code Exchange) to prevent authorization code interception

7. Data Retention & Deletion

7.1 Automatic Deletion

• Chat Messages: Automatically deleted when cache exceeds 500 messages
• Temporary Data: Cleared when you stop monitoring a channel
• Session Data: Cleared when you close your browser

7.2 Manual Deletion

You can delete your data at any time by:

• Sign Out: Click "Sign Out" in the extension popup to clear all OAuth tokens
• Clear Cache: Click "Stop All Sessions" to clear cached messages
• Uninstall: Uninstalling the extension permanently deletes all stored data
• Chrome Settings: Go to chrome://extensions/ → Twitch YouTube Chat Merger → "Clear storage"

8. Your Privacy Rights

8.1 GDPR Rights (EU Users)

Under GDPR, you have the right to:

• Access your data (via Chrome DevTools)
• Rectification (modify settings in options page)
• Erasure (sign out or uninstall)
• Restrict processing (stop monitoring channels)
• Data portability (export data feature)
• Object to processing (revoke OAuth permissions)
• Withdraw consent (sign out at any time)

8.2 CCPA Rights (California Users)

If you are a California resident, you have the right to:

• Know what personal information we collect (see Section 2)
• Delete your personal information (see Section 7)
• Opt-out of the sale of personal information (we do NOT sell your data)
• Non-discrimination for exercising your rights

9. Children's Privacy

This extension is not intended for use by children under the age of 13. We do not knowingly collect personal information from children. By using this extension, you confirm that you are at least 13 years old.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Updating the "Last Updated" date at the top of this policy
• Displaying a notification in the extension popup
• Posting an announcement on our GitHub repository