Privacy

Twitch VODs is an independent archive and player for Twitch stream replays. It finds a broadcast from Twitch’s own public metadata and plays it; today the video itself is served by Twitch. This page describes the data that passes through the site and what happens to it.

If you never sign in

No account is created, and nothing identifies you across visits.

• Which VODs are opened. Each play is appended to a vod_requests row holding the VOD’s id, title, channel, thumbnail, category and duration, plus the time. That table is what powers trending, browse, recommendations and the sitemap. It carries no account id and no IP address — it records what was asked for, never who asked.
• Rate limiting. To stop one visitor exhausting the site for everyone, requests are counted against a keyed HMAC of your IP address held in Redis. It is a hash, not an address, it expires within the hour, and it is never written to the database.
• Your watch history stays in your browser. Playback position and recently-watched VODs are kept in this browser’s local storage under vod-watch-history and vod-watch-progress. They are never uploaded while you are signed out. Clearing site data removes them.
• Server logs. The hosting platform records ordinary request logs — address, path, user agent, timestamp — for a short retention period, as any web host does.

If you sign in

Signing in is optional and exists for one reason: so history and favourites follow you between devices. Sign-in is through Google or Twitch; no password is ever created, sent or stored here.

• From Google: your name, email address, profile picture and the account identifier Google issues for this app. Nothing else is requested — the scopes are openid, email and profile.
• From Twitch: your display name, email address, profile picture and your Twitch account identifier. Nothing else is requested — the scopes are openid and user:read:email. Nothing is ever posted to your Twitch account.
• Your activity: the VODs you watch and how far into them you got, and the VODs you save. Both are stored against your account id.
• Sessions: a signed session cookie, valid 30 days, marked HttpOnly and SameSite=Lax so it is not readable by scripts and is not sent from other sites.
• Session records: each sign-in session is recorded in the database with the IP address and browser user agent it was opened from, for security and session management — so a session can be recognised, reviewed and ended. The record lasts as long as the session: 30 days from your last visit. It is deleted when you sign out or your account is erased, and an expired session is deleted the next time it is presented.

Local history from before you signed in is merged into your account once, on first sign-in. After that, local storage is namespaced per account, so two people sharing a browser cannot read each other’s history and neither loses their own.

What is never stored

• A password. There is no password login.
• Payment details. Nothing is sold here today.
• Your IP address, while you are signed out. Only the hashed, expiring form described above exists. Signed in, it is part of each session record, as described above.
• Anything about what you watched, in any panel an operator sees. The operator console shows totals and rankings only; it cannot list an individual’s history or favourites.

Who else sees data

• Twitch / Amazon. Video, thumbnails, avatars, chat replay and emotes load from Twitch’s own servers, so Twitch sees your IP address and user agent exactly as it would if you watched on twitch.tv. This site cannot prevent that — it is where the content lives.
• Google, Twitch. Only if you choose to sign in with one of them, and only for the sign-in itself.
• Infrastructure providers. Hosting, the Postgres database, the Redis rate limiter and the media proxy each process data on our behalf to run the site, and for no other purpose.
• 7TV. Third-party emotes in chat replay are fetched by our server and cached, not by your browser. 7TV never sees you.

Nothing is sold, rented or shared for advertising or profiling. There is no analytics script, no tracking pixel and no third-party cookie on the site today.

Display ad slots exist in the code and are switched off; nothing is requested from any ad network. If they are switched on, this section names the network and says what it sets before it runs, and the cookie section below changes with it. Ads never interrupt a replay — that is a commitment, and it is in the terms too.

Cookies and local storage

• Session cookie. Set only after you sign in. Signing out deletes it.
• sidebar_state — remembers whether the operator console’s sidebar is open. Only ever set for an operator.
• NEXT_LOCALE — remembers the language you picked with the language switcher. Only ever set if you change language.
• vod-watch-history, vod-watch-progress, vod-account-merged — local storage, described above.

There are no advertising or analytics cookies, which is why the site shows no cookie banner: everything it sets is strictly necessary or set by your own choice to sign in or to change language. That is a consequence of the list above, not a promise independent of it — the day anything on this page sets a third cookie, the banner question is reopened here first.

Keeping and deleting

Account data is kept while the account exists. vod_requests rows are kept indefinitely because they are the catalogue — for many VODs this site holds the only surviving record that the stream existed at all, after Twitch has deleted it. Those rows describe a broadcast, not a person.

The same is true of what the archive keeps about a broadcast — its thumbnail and its chat transcript. A transcript contains messages other people wrote in a public Twitch chat; it is shown beside the replay it belongs to and nowhere else, is never linked to an account here, and is never used to build a profile of anyone. Write to contact@twitchvods.app to have your messages removed from one. Archiving is currently switched off, so no transcript has been stored yet; this paragraph is here because it will be true before the page would otherwise be updated.

Write to contact@twitchvods.app to get a copy of everything held against your account, or to have it erased. Erasure removes your account, your sessions, your history and your favourites. Signing out on a shared computer, meanwhile, is enough to hide your history from the next person at that browser.

Children

This site is not directed at children under 13, and no account is knowingly created for one.

Changes

Material changes will move the date at the foot of this page. Continuing to use the site after that date means the current version applies.

Contact

contact@twitchvods.app — privacy questions, data requests and complaints.