StreamLoftSign in

Privacy Policy

Last updated June 26, 2026

What we collect

  • Account data: your email address, a bcrypt password hash, and optionally a TOTP secret for two-factor authentication.
  • OAuth tokens: when you connect a Twitch or YouTube channel, we store the OAuth access token and refresh token, encrypted at rest using AES-256-GCM. We never store your platform passwords.
  • Channel and stream data: channel identifiers, display names, historical stream metadata (titles, dates, view counts, durations), and live-viewer snapshots pulled from platform APIs.
  • Content you create: boards, cards, goals, finance entries, thumbnail projects, and any other data you enter into StreamLoft.
  • Usage and audit logs: timestamped records of significant actions (sign-in, channel connect, data delete). We use these to detect abuse and support account recovery. We do not sell log data.

How we use it

We use collected data only to run StreamLoft: authenticate you, show your stream analytics, back up and restore your workspace, and send transactional email (magic-link sign-in, password reset). We do not use your data for advertising and we do not sell it to third parties.

YouTube API Services

StreamLoft uses YouTube API Services to import your past livestream history and display channel metrics. By connecting your YouTube account you also agree to the YouTube Terms of Service.

Google's collection and use of data from StreamLoft's use of the YouTube API is described in the Google Privacy Policy.

You can review and revoke StreamLoft's access to your Google account at any time on the Google security settings page. Revoking access there will stop us from fetching new data, though data already imported will remain in your StreamLoft workspace until you delete your account or disconnect the channel.

Storage and security

Data is stored in a PostgreSQL database hosted on AWS (us-east-1). OAuth tokens and TOTP secrets are encrypted at rest before being written to the database. Connections between your browser and StreamLoft are encrypted with TLS. We run a non-root container and enforce strict Content Security Policy headers.

Third parties and sub-processors

  • Twitch: we call the Twitch Helix API on your behalf when you connect a Twitch channel.
  • Google / YouTube: we call the YouTube Data API v3 when you connect a YouTube channel.
  • Resend: we send transactional email (sign-in links, password resets) through Resend's SMTP service.
  • Amazon Web Services: our server runs on AWS Lightsail (us-east-1).

We do not use analytics services, advertising networks, or tracking pixels.

Data retention and deletion

Your data is retained for as long as your account is active. Deleting your account removes all personal data from our database. Disconnecting a platform channel revokes our stored tokens and stops future data collection for that channel; historical stream data you imported stays in your workspace unless you delete it or delete your account.

Contact

Questions about this policy or your data: support@streamloft.io.