Overview
This policy explains how the Livefeed open-source project (“Livefeed”, “we”, or “us”) handles information when you use the Livefeed command-line application, website, and authentication service.
Livefeed connects to Google’s YouTube APIs and Twitch APIs only after you authorize it. Its purpose is limited to finding your active stream and displaying its live chat in your terminal.
Livefeed’s YouTube features use YouTube API Services. Google explains how it processes information in the Google Privacy Policy.
Information we handle
Account and authorization information
- For YouTube: an OAuth access token, refresh token, and your YouTube channel title.
- For Twitch: an OAuth access token, refresh token, Twitch client identifier, user identifier, login, and display name.
- Livefeed requests the read-only YouTube scope and Twitch’s
user:read:chatscope.
Stream and chat information
The CLI receives active broadcast details and live chat messages from the provider you connect. Chat may include display names, user identifiers, message text, timestamps, and provider-supplied role information.
Network information
Cloudflare processes standard request information, including IP address, request route, timing, and security signals, to deliver and protect the authentication service. Livefeed uses the connecting IP only as a rate-limit key. It does not use this information for advertising or product analytics.
Website data
The Livefeed website does not set analytics or advertising cookies and does not include application-level tracking.
How information is used
Livefeed handles information only to:
- complete Google or Twitch authorization;
- refresh provider access tokens without distributing provider client secrets;
- identify your account and current live stream;
- load and display live chat in the CLI;
- protect the public authentication service from abuse; and
- diagnose failures when you report them.
Where applicable, processing is based on your consent when you authorize a provider, the need to provide the service you requested, and our legitimate interest in securing the authentication service.
Storage and retention
On your device
Refresh tokens and basic account identifiers are stored through Bun’s secrets API in your operating system’s credential manager. They remain there until you runlivefeed yt logout or livefeed twitch logout, revoke access with the provider, or remove them through your operating system.
During browser authorization
The Cloudflare authentication service holds authorization state and provider tokens in an isolated session for no more than five minutes. The session is deleted as soon as the requesting CLI retrieves the tokens, or automatically when it expires.
During token refresh
Your refresh token passes through the authentication service so it can be exchanged with Google or Twitch. Livefeed does not persist the token or the returned access token during this operation.
Chat messages
Chat messages stay in the CLI process memory and are discarded when Livefeed exits. The Livefeed authentication service does not receive or store chat messages.
Your choices and rights
You control the provider access granted to Livefeed. You may:
- decline authorization or cancel the browser flow;
- log out through the CLI and remove the saved local credential;
- revoke Livefeed through your Google or Twitch account settings; and
- request access, correction, or deletion of information we may hold.
You can review or revoke Livefeed’s Google access from theGoogle third-party connections page. Twitch connections can be managed from your Twitch account’s Connections settings.
Privacy rights vary by location. Where laws such as the GDPR, UK GDPR, CCPA, or CPRA apply, you may also have rights to restrict or object to processing, receive portable data, or complain to a supervisory authority. We will not discriminate against you for exercising a legal right.
Security
Livefeed uses HTTPS, OAuth state validation, PKCE verification, short-lived isolated authorization sessions, scoped provider access, system credential storage, security headers, and rate limiting. Provider client secrets stay on the Cloudflare Worker and are not distributed in the npm package.
No method of storage or transmission is completely secure. Keep your device and provider accounts protected, and revoke Livefeed access if you believe a credential has been compromised.
Children’s privacy
Livefeed is a developer tool and is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided information through the service, contact the project so the issue can be investigated.
Changes and contact
We may update this policy when Livefeed’s features or data practices change. The effective date at the top will be revised, and material changes will be documented in the public repository.
For privacy questions or requests, open an issue in theLivefeed issue tracker. Do not include access tokens, refresh tokens, or other credentials in a public issue.