Privacy Policy

Information we handle

Twitch Flags handles only the information needed to operate and protect the service:

• The public Twitch numeric user ID and the flag selected for that identity are stored in the registry.
• After Twitch sign-in, your Twitch user ID, Twitch login, and authentication time are stored in an encrypted browser session cookie.
• A short-lived OAuth state value is used to protect the Twitch sign-in flow from forged requests.
• IP addresses and request or security signals may be processed by the service and its providers for rate limiting, abuse prevention, hosting, and operational troubleshooting.

We do not retain Twitch OAuth access tokens, refresh tokens, Twitch passwords, or email addresses.

How we use information

Information is used to:

• confirm that you control the Twitch identity whose flag you manage;
• save, display, update, or remove the flag you select;
• serve flag lookups through the public API;
• protect the service against abuse and enforce rate limits; and
• maintain, troubleshoot, and improve service reliability.

Twitch Flags does not sell personal information.

What is public

The registry is public by design. Anyone can request a Twitch user ID through the unauthenticated API and, when a flag has been set, receive that user ID and flag in the response. Do not select a flag if you do not want that association to be public.

Browsers may cache these responses for one week. Shared caches may do the same and reuse stale copies while revalidating for another week. After you change or remove a flag, Twitch Flags invalidates its matching Vercel cache entry, but copies already held by browsers or independent intermediaries may remain until their caches expire.

Browser extensions

On supported Twitch live chat, VOD chat, and Creator Dashboard chat pages, an official Twitch Flags extension observes Twitch usernames and numeric user IDs so it can display the correct public flag.

The extension automatically sends a Twitch numeric user ID to the Twitch Flags public API solely to retrieve that ID's public flag mapping. The API returns the same numeric user ID and a two-letter country or territory code, or a not-set response.

The extension does not transmit chat-message text, passwords, Twitch OAuth tokens, cookies, browsing history outside supported Twitch pages, or the before-or-after username placement setting.

The placement setting remains in local extension storage. Twitch numeric user ID and flag lookup results are cached locally for up to seven days to reduce requests. Reloading the top-level Twitch page clears the local flag-result cache.

ID-to-flag mappings remain public by design and are subject to the API caching and removal rules described above. Flag management and Twitch OAuth remain functions of the separate website; the extension does not authenticate the user.

Service providers

Twitch Flags relies on providers that process information for their own limited roles:

• Twitch provides authentication and confirms your Twitch identity.
• Upstash provides the Redis storage used for public ID-to-flag mappings.
• Arcjet processes request and security signals to detect abuse and enforce limits.
• The hosting provider delivers the application and may process request information needed to operate and secure its infrastructure.

These providers handle information under their own terms and privacy policies. Twitch Flags may also disclose information when reasonably necessary to comply with law, protect rights or safety, or investigate misuse.

Retention and your choices

The encrypted session cookie lasts for up to 14 days. Signing out ends the active Twitch Flags session. You can also clear the cookie through your browser.

A public Twitch user ID-to-flag mapping remains until you replace or remove it. Use the flag manager while signed in to remove your mapping. Cached API responses may remain available for the periods described above.

Security and international processing

Twitch Flags uses measures such as encrypted session cookies, request validation, and rate limiting. No online service can guarantee absolute security. Providers may process information in countries other than your own, subject to the safeguards and rules that apply to them.

Children

Twitch Flags is not directed to children. If you are not old enough to consent to use online services where you live, use Twitch Flags only with permission from a parent or legal guardian.

Changes to this policy

This policy may change as Twitch Flags evolves. Material updates will be posted here with a revised effective date. Continued use after an update means the revised policy applies to your later use of the service.

Contact

For privacy questions or requests, contact the operator through desertice.link (opens in new tab).