Privacy Policy

1. Information We Collect

1A. Account Information

• Registration data: Email address, hashed password, and display name when you create an account.
• OAuth connections: If you link your Twitch or Kick account, we receive and store your platform user ID, username, and OAuth tokens.

1C. Device & Browser Information

• Network: IP address and connection type. From your IP address we derive your approximate location (country, region, city, and approximate coordinates) and the network it belongs to (its operator and autonomous system number), and we classify the network, for example as a data center, hosting provider, VPN, proxy, or Tor exit. If your browser's user agent says it is a crawler or fetcher of Google, Bing, or Apple, we also check whether your IP address belongs to that company, using the address ranges it publishes or the DNS name of your IP address, and record the result in our security log. For the automatic refusal and the slowing of requests described in Section 4, we also check whether your IP address is in the address lists DuckDuckGo, OpenAI, and Perplexity publish for their crawlers and fetchers, among the addresses Google publishes as its own (less those of its cloud customers), or among Google's crawler addresses; that result is not recorded, except that a request the device check in Section 4 could refuse, made while one of those lists could not be loaded, is marked so in our security log. To group signed-in accounts for the reading limits described in Section 4, we use your IP address (for IPv6 its /64) on mobile carrier, VPN, proxy, relay and Tor networks, or when we cannot tell the network's kind, and otherwise its block of 256 IPv4 addresses or its IPv6 /48, together with the data center, VPN or proxy provider it belongs to; for this we also check whether your IP address is among the addresses Apple publishes for iCloud Private Relay.
• Browser/OS: User agent, browser type and version, operating system, and, if your browser sends them with its requests, its client hints: the list of its brands and versions, whether it is a mobile browser, and its platform (the Sec-CH-UA, Sec-CH-UA-Mobile, and Sec-CH-UA-Platform headers). The client hints may be recorded with each request in our security log.
• Hardware: Screen resolution, color depth, language, timezone, CPU core count, device memory, and GPU information via WebGL.

IP geolocation by DB-IP (the DB-IP City Lite database, licensed under CC BY 4.0).

1G. Usage Data

• Pages visited and API endpoints accessed.
• HTTP methods, response status codes, and request duration.
• Session duration and referral source.

Google Analytics also measures how you use our Website: the pages you visit, how you arrived, and interactions such as scrolling, clicks on links to other websites, searches on our Website, the filters and time ranges you choose, and account actions such as signing up or signing in, without your email address or name (see Sections 3 and 6).

2. How We Use Your Information

• Account management: To create, maintain, and authenticate your user account.
• Service delivery: To provide streaming analytics, leaderboards, channel profiles, category statistics, and search functionality.
• Security and anti-bot protection: To detect and prevent automated abuse, bot traffic, and fraudulent activity using the fingerprinting, behavioral analysis, and challenge systems described in this policy.
• Analytics and improvement: To analyze usage patterns and improve our Website's performance and reliability.
• Error monitoring: To detect, diagnose, and fix software errors using session recordings and error reports.
• Advertising: We may display advertisements on the Website and use advertising services, including Google's, to deliver and measure them, to build audiences, and, where permitted, to show you ads relevant to your interests (see Sections 3 and 6).
• Transactional communication: To send email verification, password reset, account deletion confirmation, and account security notifications. We do not send marketing emails.

3. Cookies and Local Storage

We use the following cookies and browser storage:

• Authentication session cookie: Maintains your login session. Essential for account functionality.
• Device identity cookie (__Secure-ss-did): Strictly necessary (security / fraud prevention). Purpose: recognise your browser to protect the service against automated abuse. Duration: 180 days. Not used for advertising, analytics, or personalisation. If you sign in, we also keep a record of which accounts have used this cookie's identifier, and roughly when each first and last did so, so that our security staff can find accounts that share a device; this record is used only for security (see Section 7).
• Sign-in cookie (__Secure-ss-signin): Strictly necessary (security). Set only when you sign in with your password, reset your password, or change or set it. For each account signed in from this browser (up to four), it holds a short code that stands for the account (made from it with a key only our servers hold, so only we can tell which account it stands for), a random identifier for the browser and the time it was set, all sealed with a code only our servers can make; it holds no email address or name. While someone else's wrong passwords have restricted an account (see Section 14), it lets the account still be signed in to from this browser; while many sign-in attempts or password reset requests from networks near yours have limited those networks, it lets this browser still sign in to the account or request a password reset for it. Duration: 30 days, renewed each time it is set. Not used for advertising, analytics, or personalisation.
• Security signing key: Our security script obtains a key from our servers and uses it to sign the page's requests for data (see Section 4). Each key is issued for 5 minutes and is kept only in the page's memory; it is not stored in a cookie or in your browser's storage.
• Sentry cookies: Used for error tracking and session replay functionality.
• Google Analytics cookies (_ga, _ga_MZTDZBGLRG): Set by Google Analytics to distinguish visitors and sessions so we can measure how the Website is used, and to support its advertising features (see Section 6). Duration: up to 2 years.
• Sign-in mark (ss_ga_auth, session storage): Written by the login and sign-up pages when you start a sign-in through Twitch or Kick, so that Google Analytics (Section 6) can count the sign-in on the page you return to and does not count your return as a visit from the provider. It holds only the provider's name and the time it was written; it names no person. It is cleared the first time a page of the Website reads it, normally the page you return to, and is ignored if older than five minutes.
• Advertising cookies and pixels: Advertising services we use (see Section 6) may set cookies and use similar technologies, such as pixels, to deliver advertisements, measure their performance, and, where permitted, show you ads relevant to your interests on this and other websites.

Apart from the Google Analytics cookies above, we do not use third-party analytics cookies. You can instruct your browser to refuse cookies, but some features may not function correctly without them. See Section 10 for advertising and analytics opt-outs.

4. Security System (Anti-Bot Protection)

5. Session Recording

6. Third-Party Services

We share data with the following third-party service providers:

• Sentry — Error tracking, performance monitoring, and session replay. Receives: IP addresses, user agents, page URLs, JavaScript errors, performance data, session recordings, and user identifiers. For requests to our API, its error and performance reports also carry the request's risk score, security decision, proof-of-work difficulty and remaining rate-limit budget, the time your browser took to solve the proof-of-work puzzle, the identifier our security system uses for your browser and the country derived from your IP address. Apart from requests for a proof-of-work puzzle or a signing key, it also receives a log entry for each request to our API that our security system challenges, delays or refuses (of the requests refused as automated browsers, see Section 4, a random 1% of those that are not signed in; slowing a request that comes from a data center network, see Section 4, is not counted as delaying it, nor is slowing by the reading limits), and for a random 1% of the requests it lets through, with the security decision and either the reason for refusing the request (for a request refused as an automated browser, also which of the conditions in Section 4 it met and whether it was signed in) or the request's risk score, proof-of-work difficulty and remaining rate-limit budget. It also receives a log entry for each request the device check in Section 4 could refuse while you are signed in or while we could not check whether you are, and for a random 1% of the others it could refuse and that are not refused, with the signs it found, the kind of network, and what became of the request. It may also receive the summary of activity of a browser identifier that our review of suspected automation places in its highest tier, without the identifier, as described in Section 4.
• Google Analytics (Google LLC) — Website usage analytics. Receives: the pages you visit (URLs and titles), the referring page, browser, device, and screen information, an identifier stored in the Google Analytics cookies, interactions such as scrolling, clicks, site searches, filter and time-range choices, and account actions (signing up or signing in, without your email address or name), and your IP address, from which Google derives your approximate location (Google states that Google Analytics does not log or store IP addresses). We use Google Analytics Advertising Features, including Google signals: for visitors who are signed in to a Google account and have Ads Personalization turned on, Google may associate this data with their account to give us demographics and interests reports and cross-device insights, and the data may be used to build advertising audiences and measure advertising. You can turn off personalized advertising in your Google Ads Settings (see also Section 10). See how Google uses information from sites that use its services.
• Advertising partners — We may work with advertising networks and services, such as Google AdSense and Google Ads, to display advertisements on the Website and measure their performance. They may receive your IP address, browser, device, and screen information, the pages you view, and identifiers stored in their cookies, and may use this information to show you ads on this and other websites.
• Cloudflare — DNS, CDN, DDoS protection, and network tunneling. Receives: all network traffic, IP addresses, and request metadata.
• Resend — Transactional email delivery. Receives: email addresses and email content for verification, password reset, and account deletion confirmation emails.
• Twitch / Kick — OAuth authentication and public API data sourcing. Receives: OAuth authorization codes. Provides: user profile data for linked accounts and publicly available streaming data.

Each third-party provider operates under its own privacy policy. We encourage you to review their policies.

7. Data Storage and Retention

• Account data: Retained until you delete your account. To delete it, choose Delete Account under Settings > Danger Zone: we email you a link that expires after 1 hour, and your account is deleted only when you open that link in a browser signed in to the account and confirm there. We then delete at once your account (your email address, display name, and profile picture), its sign-in sessions, its linked Twitch and Kick accounts with their OAuth tokens and the channels verified through them, your password if you set one, your browser extension settings, our records of your account's sign-ins and other account events, our records of the emails we sent you, and any password reset or account deletion links we emailed you that are still unused. We keep a record that the account was deleted, holding its account ID and a short code computed from its email address (the start of a SHA-256 hash), not the address itself; this record has no set expiry. Your privacy opt-outs (see Section 10) are kept, so the data you chose to hide stays hidden: they are recorded for the channel, not for your account. What happens to security data is described in the next item. Error reports, performance data, logs, and session recordings already sent to Sentry, which can include your account's ID, display name, and email address, remain subject to Sentry's retention policies, and the emails we sent you through Resend (see Section 6) are subject to Resend's retention policies. Deleting an account does not delete public streaming and chat data (see Section 11). Our records of your account's sign-ins, password resets and password changes from the last 30 days also tell our sign-in system which networks may keep signing in to it while someone else's wrong passwords, or many sign-in attempts from networks near yours, have restricted it (see Section 14).
• Security data (fingerprints, sessions, request logs): Retained for security analysis and threat detection. Our security log's entries expire after 90 days, and the record of requests flagged as unusual after 180 days. The identifiers our security system uses for browsers, the summaries of their activity, security sessions, the records of requests it failed to handle, and the record of which accounts have used each device identity cookie have no set expiry. When an account is deleted, we delete its security session and its entries in the record of which accounts have used each device identity cookie, and remove its account ID from the records of requests our security system failed to handle, which are otherwise kept; entries of our security log and of the record of requests flagged as unusual that name the account are not changed, and expire as stated above.
• Streaming analytics and chat data: Retained indefinitely as part of our core analytics dataset.
• Redis cache: What our sign-in and security systems keep in our Redis cache expires on its own, at the latest 25 hours after it was last written: for example, the counters that limit sign-in attempts and wrong passwords for an account last up to 1 hour, those that limit password reset and account deletion requests up to 1 hour, the list of the networks an account recently signed in from, kept as keyed hashes rather than addresses, 5 minutes (a network it has just been signed in to from, or had its password reset or changed from, is kept the same way for 1 hour), and the marker recording that a device identity cookie was used with an account lasts 24 hours; the counts behind the reading limits for signed-in accounts last up to 25 hours after the last request counted in them was answered, their pacing markers from seconds to hours, and a raised limit's marker up to 24 hours at a time while it lasts. Blocks placed by our security system are the exception: they stay there as long as the block lasts.
• Session recordings: Subject to Sentry's retention policies.
• Google Analytics data: Subject to the data retention setting of our Google Analytics property and Google's retention policies.

8. Data Sharing and Disclosure

We do not sell your personal information for money. We may disclose your information in the following circumstances:

• Advertising services: With Google Analytics Advertising Features and the advertising partners described in Section 6, to deliver, personalize, and measure advertising. Under some laws, including the CCPA, this may count as "sharing" personal information for cross-context behavioral advertising; see Sections 10 and 12 for your choices.
• Service providers: With the third-party services listed in Section 6, solely for the purposes described.
• Legal obligations: If required by law or in response to valid requests by public authorities.
• Protection of rights: To protect and defend our rights, property, and safety.
• Business transfers: In connection with any merger, sale of company assets, financing, or acquisition.
• Public data: Streaming analytics and public chat messages are displayed on our Website as part of our service. Channel owners can opt out via Privacy Controls.

9. International Data Transfers

StreamerStats is operated from the United States. Your information may be transferred to and processed in the United States and other countries where our service providers operate. These countries may have data protection laws that differ from your jurisdiction. By using our Website, you consent to the transfer of your information to these countries.

10. Your Rights and Controls

• Privacy Controls (in-app): Verified channel owners can hide their chat activity from search and hide their profile from search results via Settings > Privacy Controls.
• Chat activity suppression: You may ask us to hide your own chat activity from chatter search, message search, address search, and user profile pages by emailing [email protected]. Requests are reviewed individually and granted at our discretion. Suppression hides the data from these surfaces; it does not delete the underlying public record (see Section 11).
• Account deletion: You can delete your account under Settings > Danger Zone. We email you a link to confirm; nothing is deleted until you open it, within 1 hour, in a browser signed in to the account, and confirm there. Section 7 lists what is deleted at once and what is kept, and for how long.
• Access and correction: You can access and update your account information at any time through your account settings. For data access requests beyond your account settings, contact us at [email protected].
• Data portability: You may request an export of your personal data by contacting us at the email above.
• OAuth revocation: You can disconnect linked Twitch or Kick accounts via Settings > Connected Accounts.
• Analytics opt-out: You can block the Google Analytics cookies in your browser or install the Google Analytics Opt-out Browser Add-on. Opting out does not affect how the Website works.
• Advertising opt-out: You can turn off personalized advertising from Google in your Google Ads Settings, and opt out of interest-based advertising from participating companies at optout.aboutads.info. Blocking third-party cookies in your browser also prevents most advertising cookies. You will still see ads, but they will be less relevant to you.

11. European Users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

Legal Bases for Processing

• Consent: Where you have given explicit consent (e.g., creating an account, linking OAuth accounts).
• Legitimate interests: Maintaining our streaming analytics dataset of publicly available broadcast and chat activity, security and anti-bot protection, error monitoring, usage analytics (Google Analytics), advertising and its measurement, and service improvement. We have assessed that these interests do not override your fundamental rights. You have the right to object to this processing (see below), and you can turn off personalized advertising and analytics as described in Section 10.
• Contractual necessity: Processing required to provide the services you have requested.

Device Identity Cookie (__Secure-ss-did)

We set the __Secure-ss-did device identity cookie on the legal basis of legitimate interest under Article 6(1)(f) GDPR, for the sole purpose of security and fraud prevention. It is never used for any purpose outside security. You have the right to object to this processing under Article 21 GDPR by contacting us at [email protected]; objections are reviewed by a human, not decided by an automated system. Retention: the cookie expires after 180 days, the security-log entries that record it expire after 90 days, and the record of which accounts have used it is kept as described in Section 7.

Your GDPR Rights

For the personal data we collect about you as a visitor or account holder — account, device, security, and session data — you have:

• Right of access to your personal data.
• Right to rectification of inaccurate data.
• Right to erasure. You can delete your account at any time under Settings > Danger Zone, confirmed through a link we email you. Section 7 lists what is deleted at once and what is kept, and for how long. For other personal data we hold about you, contact us at the address below.
• Right to restriction of processing.
• Right to data portability.
• Right to object to processing based on legitimate interests.
• Right to withdraw consent at any time.
• Right to lodge a complaint with your local data protection authority.

Publicly Sourced Streaming and Chat Data

Streaming analytics and chat messages are collected from public broadcasts and public chat channels on Twitch and Kick, and are processed under legitimate interest (Article 6(1)(f) GDPR) as a record of public streaming activity. We do not treat this public material as subject to deletion on demand, and it is retained as described in Section 7. If you object to your chat activity appearing on StreamerStats, contact us at [email protected]. Where we act on such a request, our remedy is to exclude your chat activity from search, autocomplete, and user profile pages (see Section 10) rather than to delete the underlying public record. Suppression requests are reviewed individually and granted at our discretion.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

12. California Users (CCPA)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA):

Categories of Personal Information Collected

• Identifiers (email, IP address, user IDs).
• Internet or electronic network activity (browsing history, device fingerprints, API usage).
• Geolocation data (derived from IP address and timezone).

Your CCPA Rights

• Right to know: You can request details about the personal information we have collected about you.
• Right to delete: You can request deletion of the personal information we hold about you as a visitor or account holder, subject to certain exceptions. Publicly available information — including chat messages posted in public channels — is excluded from the CCPA's definition of personal information.
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.
• Sale and sharing of personal information: We do not sell personal information for money. Our use of advertising services (see Sections 6 and 8) may count as "sharing" personal information for cross-context behavioral advertising under the CCPA. You can opt out of this sharing by emailing [email protected] and by using the advertising and analytics opt-outs in Section 10.

13. Children's Privacy

Our services are not directed to individuals under the age of 13 (or 16 in jurisdictions where applicable). We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete it promptly. If you believe a child has provided us with personal information, please contact us at [email protected].

14. Security of Your Information

We implement the following security measures to protect your data:

• Password security: All passwords are hashed using industry-standard algorithms. We never store plaintext passwords.
• Request integrity: API requests are verified using HMAC-SHA256 cryptographic signatures.
• Encryption: Sensitive security data is encrypted using AES-256-GCM.
• Account lockout: After 10 wrong passwords for an account from one network (an IPv4 address, or an IPv6 /64) within 15 minutes, that network cannot sign in to the account until the 15 minutes end or the password is reset or changed from that network; other networks are not affected. If an account gets 100 wrong passwords within an hour from all networks together, then for the rest of that hour it can be signed in to only from a network it was signed in to, or had its password reset or changed from, in the last 30 days, which we recognise from our records of the account's sign-ins (see Section 7), or from a browser holding its sign-in cookie (see Section 3), each held to 10 wrong passwords every 15 minutes. Resetting or changing your password ends that restriction at once, and changing your password while signed in is never blocked by either limit.
• Rate limiting: From one network, sign-in attempts are limited to 30 every 10 minutes and to 5 a minute for any one account, and account sign-ups, password reset requests and verification email requests to 3, 10 and 10 an hour; the /48 an IPv6 network belongs to is also limited, counting only what each network's own limits let through, to 120 sign-in attempts every 10 minutes and 10 sign-ups, 30 password reset requests and 30 verification email requests an hour, though past its sign-in limit an account can still be signed in to from a network it was signed in to, or had its password reset or changed from, in the last 30 days, or from a browser holding its sign-in cookie (see Section 3), and past its password reset limit such a browser can still request a reset. Password reset requests for one email address are limited to 3 an hour from all networks together, whichever browser sends them, and we send at most 3 verification emails an hour to one address. While signed in, changing your password is limited to 5 attempts a minute and 10 wrong current passwords every 15 minutes in each sign-in session. Our sign-in system also limits, from one network, requests to sign in with Twitch or Kick to 3 every 10 seconds and verification email requests to 3 a minute.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

15. Changes to This Privacy Policy

We may change this Privacy Policy at any time. Changes take effect when the updated policy is posted on this page with a revised "Last Updated" date; we may, at our discretion, also announce changes on the Website. Please review this page periodically. Your continued use of the Website after an updated policy is posted indicates your acceptance of it.

16. Contact Us and Governing Law

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at [email protected].

This Privacy Policy is governed by the laws of the State of North Carolina, United States, without regard to its conflict of laws principles. This policy covers all services provided through streamerstats.com and its subdomains.