StreamerWorkbench - Privacy Policy

Last Updated: September 5, 2026

1. Introduction

This policy explains what data StreamerWorkbench collects, why, how it's stored, who it's shared with, and the choices you have — including deleting everything. If anything here is unclear, contact us (section 12) before connecting an account.

2. Data We Collect

StreamerWorkbench is a server-backed service — unlike a purely local/offline tool, the data below is stored on our servers so your dashboard works across sessions and devices, and so background syncing can keep your stats current.

• Account information: the email address and username you sign up with, and a securely hashed copy of your password (we never store or can see your actual password). If you use "Sign in with Google," we receive your Google account's email, name, and profile picture from Google's verified sign-in response — we do not receive your Google password.
• Connected-platform tokens: when you connect Twitch or TikTok, we store an OAuth access token (and refresh token, if the platform issues one) so we can fetch your stats on your behalf. These are encrypted at rest and are never displayed back to you or included in any API response. For YouTube we do not retain a Google token at all — the one-time Google sign-in is used only to confirm which channel is yours, after which the token is discarded and ongoing stats come from the public YouTube Data API.
• Platform statistics: public, creator-facing stats your connected platforms make available through their official APIs — for example follower/subscriber counts, viewer counts, bits/likes/engagement metrics, video/stream counts, and similar. We periodically re-fetch these (and you can trigger a manual refresh) and keep a history of snapshots over time so your dashboard can show growth trends and charts.
• Two-factor authentication data (only if you turn 2FA on): your TOTP secret, encrypted at rest, and one-time recovery codes, stored as irreversible hashes.
• Technical/security data: your IP address and request timestamps, used only for rate-limiting and abuse prevention (for example, to stop bots from spamming account creation or password-reset requests). This is kept only as long as needed for that purpose, on a short rolling basis, not as a permanent activity log.

3. What We DON'T Access

• Your Twitch/TikTok/Google password or login credentials — sign-in happens entirely on that platform's own site via OAuth; we only ever receive the token(s) it issues back to us.
• Private messages or direct communications on any connected platform
• Payment or billing information — StreamerWorkbench does not process payments
• Private or unlisted content on a connected platform
• Two-factor authentication codes from your connected platforms (only StreamerWorkbench's own optional 2FA, described above, involves us at all)

4. How We Use Your Data

• Provide the service: authenticate you, display your connected platforms' stats, and compute the trends/charts/deltas shown on your dashboard.
• Keep your stats current: a background process periodically re-fetches your connected platforms' public stats using the stored access token.
• Account and security emails: welcome emails, email verification, password-reset codes, and similar transactional messages (see section 6 for how these are sent).
• Security and abuse prevention: rate limiting, fraud/bot detection, and diagnosing service issues.
• We do not sell your data, and we do not use it for advertising or share it with data brokers.

5. Data Storage & Retention

Your account data, connected-platform tokens, and stats history are stored on our servers for as long as your account exists. When you delete your account (section 8), your profile, connected-platform tokens, and stored stats snapshots are permanently deleted. Backups, if any exist at the time of deletion, age out on our normal backup rotation rather than being retained indefinitely.

6. Third-Party Service Providers

We use a small number of third-party services to operate StreamerWorkbench. Each only receives the minimum data needed to do its job:

• Twitch and TikTok APIs: we call these on your behalf, using your connected account's OAuth token, to read the public creator stats described in section 2. We don't send your StreamerWorkbench password or any other account's data to these platforms.
• Google / YouTube: Google is used for "Sign in with Google" (Google shares your email, name, and profile picture with us as part of the standard OAuth sign-in flow) and, if you connect YouTube, to confirm you own your channel. StreamerWorkbench uses YouTube API Services. When you connect YouTube you sign in with Google and grant read-only access (youtube.readonly); we use that one-time grant only to look up your own channel's identity, then discard the Google access token. Ongoing statistics (subscriber count, total views, and video count) are read from the public YouTube Data API using our own API key and your channel's public ID. We do not access your private videos, comments, messages, or watch history, and we never post, edit, or delete anything on your channel.
• Brevo (email delivery provider): transactional emails — account verification, password resets, and similar — are sent through Brevo's API. Brevo receives the recipient email address and the email content necessary to deliver that specific message; it is not used for marketing and your stats/platform data are never included in an email.

Instagram integration is planned but not yet available; this policy will be updated with the relevant disclosures before it goes live.

We do not sell, rent, or otherwise share your data with any other third party.

6a. YouTube & Google API Compliance

StreamerWorkbench's YouTube features use YouTube API Services. By connecting YouTube you also agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy. You can review or revoke StreamerWorkbench's access to your Google and YouTube account at any time from your Google account permissions page.

StreamerWorkbench's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In line with those requirements, we use Google and YouTube data only to provide and improve the analytics features you see in the app; we do not use it for advertising or any unrelated purpose; we do not sell it; and we do not transfer it to third parties except as needed to operate the service for you or where required by law.

7. Security & Authentication

StreamerWorkbench uses OAuth 2.0 for connecting Twitch, TikTok, and Google — your credentials for those services are never seen, stored, or transmitted by us. Your StreamerWorkbench password is hashed with a modern, salted algorithm (Argon2id) and cannot be reversed even by us. Connected-platform tokens and any 2FA secret are encrypted at rest. All traffic to the site is served over HTTPS.

8. Your Privacy Rights

• Delete your account: you can permanently delete your StreamerWorkbench account and all associated data at any time from your account settings. This is a real, immediate deletion — not a deactivation — and cannot be undone.
• Revoke platform access: you can disconnect a platform from within StreamerWorkbench, or revoke its access directly from that platform's own app-permissions settings, at any time.
• Access or correct your data: contact us (section 12) and we'll help you review or correct the account information we hold.
• If you are in the EU/UK or California, you may have additional rights (such as data portability or the right to lodge a complaint with a supervisory authority) under GDPR or the CCPA. Contact us and we'll do our best to accommodate your request; for complex requests we may recommend consulting the relevant regulator's guidance.

9. Cookies & Tracking

StreamerWorkbench does not use cookies for authentication or tracking, and we do not run third-party analytics or advertising trackers. Sign-in is handled with a bearer session token stored in your browser's local storage, not a cookie.

10. Children's Privacy

StreamerWorkbench is not directed at children under 13, and we do not knowingly collect data from anyone under 13. If you believe a child has created an account, contact us and we will delete it.

11. Changes to This Policy

We may update this policy as the service changes. Material changes will be reflected by an updated "Last Updated" date above; for significant changes affecting how your data is used, we'll make reasonable efforts to notify you by email.

12. Contact & Questions

Questions about this policy, your data, or a deletion/access request? Email support@streamerworkbench.com.

13. Governing Law

[Placeholder — the operator of StreamerWorkbench should specify the jurisdiction whose laws govern this policy, e.g. "the laws of the State of ___, United States, without regard to conflict-of-law principles." This is a business decision best made with an attorney familiar with where the business is formed/operates.]