Overview
This policy explains how the Livefeed open-source project (“Livefeed”, “we”, or “us”) handles information when you use the Livefeed command-line application, website, and authentication service.
Livefeed connects to Google’s YouTube APIs, Twitch APIs, and Kick APIs only after you authorize it. Its purpose is limited to finding your active stream and displaying its live chat in your terminal.
Livefeed’s YouTube features use YouTube API Services. Google explains how it processes information in the Google Privacy Policy.
Information we handle
Account and authorization information
- For YouTube: an OAuth access token, refresh token, and your YouTube channel title.
- For Twitch: an OAuth access token, refresh token, Twitch client identifier, user identifier, login, and display name.
- For Kick: an OAuth access token, refresh token, user identifier, display name, relay token, and webhook subscription identifiers.
- Livefeed requests the read-only YouTube scope, Twitch’s
user:read:chat, and Kick’suser:read,channel:read, andevents:subscribe.
Stream and chat information
The CLI receives active broadcast details and live chat messages from the provider you connect. Chat may include display names, user identifiers, message text, timestamps, and provider-supplied role information.
Network information
Cloudflare processes standard request information, including IP address, request route, timing, and security signals, to deliver and protect the authentication service. Livefeed uses the connecting IP only as a rate-limit key. It does not use this information for advertising or product analytics.
Website data
The Livefeed website does not set analytics or advertising cookies and does not include application-level tracking.
How information is used
Livefeed handles information only to:
- complete Google, Twitch, or Kick authorization;
- refresh provider access tokens without distributing provider client secrets;
- identify your account and current live stream;
- load and display live chat in the CLI;
- protect the public authentication service from abuse; and
- diagnose failures when you report them.
Where applicable, processing is based on your consent when you authorize a provider, the need to provide the service you requested, and our legitimate interest in securing the authentication service.
Storage and retention
On your device
Refresh tokens and basic account identifiers are stored through Bun’s secrets API in your operating system’s credential manager. They remain there until you runlivefeed logout, choose the relevant provider, revoke access with the provider, or remove them through your operating system.
During browser authorization
The Cloudflare authentication service holds authorization state and provider tokens in an isolated session for no more than five minutes. The session is deleted as soon as the requesting CLI retrieves the tokens, or automatically when it expires.
During token refresh
Your refresh token passes through the authentication service so it can be exchanged with Google, Twitch, or Kick. Livefeed does not persist the token or the returned access token during this operation.
Chat messages
YouTube chat stays in CLI process memory and is discarded when Livefeed exits. Livefeed stores up to 2,000 Twitch messages on the local device for the current stream. Kick sends signed chat webhooks to the Cloudflare service because Kick does not offer a direct chat connection for CLI clients. The service retains at most 2,000 Kick messages for the current stream and clears them when the stream ends, you log out, or 24 hours pass.
Your choices and rights
You control the provider access granted to Livefeed. You may:
- decline authorization or cancel the browser flow;
- log out through the CLI and remove the saved local credential;
- revoke Livefeed through your Google, Twitch, or Kick account settings; and
- request access, correction, or deletion of information we may hold.
You can review or revoke Livefeed’s Google access from theGoogle third-party connections page. Twitch and Kick connections can be managed from their respective account settings.
Privacy rights vary by location. Where laws such as the GDPR, UK GDPR, CCPA, or CPRA apply, you may also have rights to restrict or object to processing, receive portable data, or complain to a supervisory authority. We will not discriminate against you for exercising a legal right.
Security
Livefeed uses HTTPS, OAuth state validation, PKCE verification, short-lived isolated authorization sessions, scoped provider access, system credential storage, security headers, webhook signature verification, and rate limiting. Provider client secrets stay on the Cloudflare Worker and are not distributed in the npm package.
No method of storage or transmission is completely secure. Keep your device and provider accounts protected, and revoke Livefeed access if you believe a credential has been compromised.
Children’s privacy
Livefeed is a developer tool and is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided information through the service, contact the project so the issue can be investigated.
Changes and contact
We may update this policy when Livefeed’s features or data practices change. The effective date at the top will be revised, and material changes will be documented in the public repository.
For privacy questions or requests, open an issue in theLivefeed issue tracker. Do not include access tokens, refresh tokens, or other credentials in a public issue.