Privacy policy

• There is nothing to sign up for, so we hold no names, emails or passwords.
• We do not store IP addresses, user agents, device identifiers, session identifiers or advertising identifiers in our database.
• We keep two aggregated daily counters: how many times a channel profile was viewed, and how often a search term was entered. Neither is linked to a person.
• Our own browser storage holds your light/dark theme preference. Configured Google services may also use cookies or similar technologies, as described below.
• Cloudflare Web Analytics measures aggregate visits and page performance without analytics cookies or persistent visitor identifiers.
• Google Analytics and Google AdSense load only if an operator has explicitly configured them. Their current state on this deployment is stated below.
• We do not sell, rent or share personal information. There is none to sell.

StreamerVitals has no user accounts, no registration, no login, no profile, no newsletter and no comment system. Nothing on the site asks who you are, and no feature requires it. If you email us, we hold that correspondence in order to answer it — that is the only route by which we would come to hold your name or email address, and it exists because you chose to write to us.

Stated explicitly, because absences are the part policies usually skip:

• No IP addresses in our database.
• No user-agent strings, screen sizes, fonts or other fingerprinting signals.
• No session identifiers, visitor identifiers or cross-site identifiers.
• No referrer chains attributed to an individual.
• No location data beyond what any web server necessarily sees in transit.
• No social media pixels, no ad-network trackers, no data-broker integrations.
• No payment data — the site takes no payments.

Our hosting provider and content delivery network necessarily process the IP address of every request in order to deliver a response and to protect the service, and their infrastructure logs are retained on their own schedules. That is true of every website on the internet; what is in our control is whether any of it reaches our database, and it does not.

Two public endpoints — site search and the on-demand channel lookup — are rate limited, because an unmetered lookup endpoint is a way to exhaust our Twitch API quota and to enumerate the account namespace. Counting requests per client requires some notion of “client”, and here is exactly what that is:

• The connecting IP address is combined with a fixed salt and hashed with SHA-256, and only the first 24 characters of that hash are used.
• The hash becomes a key in a short-lived in-memory cache that holds a request count for the current minute. It expires automatically after about ninety seconds.
• The raw IP address is never written anywhere by us, and the hash is never written to the database, never joined to any other record, and never used for analytics or personalisation.

The purpose is to count requests, not to keep a record of who visited. If our cache is unavailable, requests are allowed through unmetered rather than blocked — a degraded cache must not become a broken site.

What we set ourselves

One item, in localStorage, under the key sv-theme. It holds the string light or dark so the site does not flash the wrong colour scheme on your next visit. It is not a cookie, it is never transmitted to our servers, it contains no identifier, and clearing your browser storage removes it with no consequence beyond losing that preference.

StreamerVitals sets no cookies of its own. No session cookie, no preference cookie, no analytics cookie.

Cloudflare Web Analytics

Cloudflare Web Analytics is enabled on our public website through our CDN. Its browser beacon measures page views, visits and page-load performance. Cloudflare states that this service does not use analytics cookies, localStorage or fingerprinting to follow individual visitors over time. See Cloudflare’s explanation of how Web Analytics handles privacy. This is separate from Google Analytics and from the request and security measurements Cloudflare collects while delivering the site.

Google Analytics

Google Analytics is loaded only when a measurement ID has been configured for the deployment. When it is loaded, IP anonymisation is enabled and the script is deferred until after the page is usable. Google may set cookies in that case, and Google’s own privacy terms then apply in addition to this policy.

On this deployment, Google Analytics is currently not enabled; its script is not loaded.

Google AdSense

The AdSense loader is included when a client ID is configured, including for site verification before our ad placements are enabled. The loader and the placement setting are separate. Google and its advertising partners may use cookies or similar technologies for advertising and traffic-quality measurement, subject to Google’s own policies.

On this deployment, the AdSense loader is configured and our ad placements are not enabled.

Disabling Google Analytics or AdSense does not disable Cloudflare Web Analytics. Images hosted by Twitch also cause requests to Twitch’s image servers.

Display advertising is the intended way to fund the service, and it is not yet switched on. When it is, the ad slots already present in the layout will begin rendering advertisements, this policy will be updated before that happens, and the about page will state it plainly.

Advertising will never determine who appears on a ranking, in what order, or with what figures. The ranking formulas are published so that this is verifiable rather than merely asserted.

The complete list of outside parties involved in running this site:

Twitch Interactive, Inc.

The source of the data we publish. The relationship runs one way — we request public information from Twitch’s API. We do not send Twitch anything about you, and Twitch has no visibility into who visits this site. Note that avatars and category artwork are displayed by linking directly to Twitch’s content delivery network, so loading a page that shows them causes your browser to request an image from Twitch.

Hosting and content delivery

Our servers and the CDN in front of them process requests, including IP addresses, in order to deliver pages and to absorb abuse. They act as processors for us and do not receive any additional information about you from us.

Google (Analytics and AdSense)

Only when explicitly configured, as described above. Currently in use on this deployment.

Cloudflare Web Analytics

Enabled for aggregate visit and browser-performance measurement, as described in the cookies and browser storage section above.

There are no others. No customer-data platform, no session-recording tool, no heatmap script, no chat widget, no A/B testing service.

Most of what this site publishes is about Twitch channels rather than about visitors: display names, avatars, channel descriptions, broadcast titles, and the viewer measurements we recorded. All of it originates from the official Twitch API and describes public broadcasts made to a public audience.

Where that information relates to an identifiable person, we process it on the basis of our legitimate interest in publishing aggregated, factual statistics about public broadcasting activity — a purpose that is served by the numbers, not by anyone’s private life. We publish nothing that requires authentication to see, nothing about a streamer’s viewers, and nothing about chat participants.

Cached Twitch material is refreshed on a schedule and purged when Twitch reports a channel as deleted. Streamers who want their information corrected or removed should read data removal, which sets out what we can remove, what we may retain as our own measurements, and how we verify a request. The methodology page lists every stored field, its retention class and its maximum cache age.

Depending on where you live, you may have rights to access, correct, delete, port or object to the processing of personal data about you, and to complain to a supervisory authority. We honour those rights, with one honest practical caveat:

For site visitors, we almost never hold any personal data to act on. With no accounts, no cookies of our own and no stored identifiers, there is usually no record that could be linked back to you, so an access or deletion request will generally be answered with a truthful “we hold nothing about you”. That is the intended outcome of the design, not an evasion.

For streamers, whose channels are the subject of the published statistics, the rights are substantive and the process is documented at data removal. We verify that a request comes from the channel owner before acting, because acting on an unverified request would itself be a failure to protect that person’s data.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in United States state privacy laws.

The service is operated from a single region and served worldwide through a content delivery network, so a request may be handled by infrastructure outside your country. Because the site stores no visitor identifiers, the personal data crossing a border in that process is limited to what is inherent in making an HTTP request — principally your IP address, processed transiently by our hosting and CDN providers to deliver a response.

This site is a statistics reference, not a service directed at children. We do not knowingly collect personal data from anyone, of any age, because we do not collect personal data from visitors at all. If you believe a page contains personal information about a minor that should not be published, write to [email protected] and we will review it promptly.

The site is served over HTTPS with a strict content security policy that blocks scripts from hosts we have not explicitly configured. Twitch API credentials are held server-side only and are never exposed to the browser. Because we hold no visitor accounts and no visitor identifiers, the most damaging category of breach — loss of a user database — does not apply to us, which is a reason to keep it that way.

When this policy changes materially — in particular, before advertising or third-party analytics is enabled — we will update the date at the top of this page and describe what changed. Continued use of the site after a change means the revised policy applies, but the substantive protections above are design decisions rather than promises, and weakening them would require changing the code as well as this page.

Privacy questions, data-subject requests and complaints: [email protected]. We aim to respond within 30 days and usually much sooner. For anything else, see contact; for channel data specifically, see data removal.