Privacy Policy

Overview

Static is an automated service that archives your Twitch VODs to YouTube. We take your privacy seriously and only collect the minimum data necessary to provide this service.

What Data We Collect

When you connect your accounts, we collect:

• Twitch: User ID, username, and OAuth access tokens
• YouTube: OAuth access tokens and refresh tokens
• Settings: Your privacy preferences (private/unlisted/public) and whether automatic uploads are enabled
• Processing history: Records of which VODs have been uploaded (Twitch VOD ID and YouTube URL)

We do NOT collect:

• Passwords (we use OAuth, so we never see your passwords)
• Email addresses
• Payment information
• Personal information beyond your Twitch username
• Analytics, cookies, or tracking data

How We Use Your Data

Your data is used exclusively for the following purposes:

• Authentication: OAuth tokens authenticate you with Twitch and YouTube
• VOD Detection: We check your Twitch account for new VODs every 5 minutes
• Video Upload: We download VODs from Twitch and upload them to your YouTube channel
• Idempotency: We track processed VODs to avoid duplicate uploads

We never: Access your content beyond what's necessary for uploads, share your data with third parties, or use your data for marketing.

Data Security

We implement industry-standard security measures:

• Encryption at rest: All OAuth tokens are encrypted using Fernet (AES-128) before storage
• Encryption in transit: All connections use HTTPS/TLS
• Minimal permissions: We request only the minimum OAuth scopes needed:
  • Twitch: user:read:email (identity only, no channel access)
  • YouTube: youtube.upload (upload only, no read/delete/modify)
• No token logging: OAuth tokens are never written to logs
• Secure sessions: Session cookies are HTTP-only and use secure flags

Data Retention

We retain your data only as long as your account exists.

Important: Logout vs. Disconnect

• "Logout" - Only ends your browser session. Your account remains active and the worker continues processing VODs in the background. All your data is retained.
• "Disconnect & Delete All Data" - Permanently deletes your account:
  • All OAuth tokens are immediately deleted
  • All processing history is permanently removed
  • Worker stops processing your VODs
  • Your account record is deleted from our database
  • This action is irreversible

To stop VOD processing without deleting your account: You can disable automatic uploads from your dashboard, or revoke OAuth access through Twitch and Google settings.

Third-Party Services

Static integrates with the following third-party services. Each has its own privacy policy:

• Twitch: We use Twitch OAuth and API to access your VODs. See Twitch Privacy Policy
• YouTube (Google): We use YouTube Data API to upload videos. See Google Privacy Policy

When you connect these services, you grant Static permission to act on your behalf according to the OAuth scopes you approve. You can revoke these permissions at any time through Twitch and Google settings.

Your Rights

You have complete control over your data:

• Access: View your connected accounts and processing history on your dashboard
• Control: Enable/disable automatic uploads at any time
• Modify: Change your YouTube privacy settings anytime
• Revoke: Disconnect OAuth access through Twitch/YouTube settings
• Delete: Permanently delete all your data using the disconnect button

Data Processing Location

Static is hosted on Railway infrastructure in the United States. Your data is processed and stored on servers in the US.

Changes to This Policy

We may update this privacy policy from time to time. The "Last updated" date at the top indicates when changes were made. Continued use of Static after changes constitutes acceptance of the updated policy.

Contact

If you have questions about this privacy policy or how your data is handled, please contact us through GitHub.