This explains what Combined Chat collects, why, how long it is kept and who else sees it. It is written to be read rather than to cover every eventuality, and it describes what the service actually does today.
Combined Chat is operated by an individual, not a company. For privacy questions, data requests or anything else in this policy, contact privacy@combinedchat.com.
No account is needed and nothing identifying is stored about you. Channel names you enter, your display settings and recent messages are kept in your own browser, not on a server.
Signing in with Twitch or Kick stores your platform user ID, username, display name, profile image and the access and refresh tokens that platform issues. The tokens are what allow sending messages and moderating on your behalf. Your password is never seen by this service, because the sign-in happens on the platform's own site.
Each successful sign-in also records the platform, username, time and the IP address the request came from. This exists to detect abuse such as one person creating many accounts to spam chat.
The email address you submit is stored so occasional product updates can be sent. Nothing else is attached to it, and it is not linked to your chat use or your platform accounts.
Ordinary operational logs record requests, errors and connection events. These are needed to keep the service running and to investigate faults. They are kept free of chat messages and of the names of people chatting: a request is logged by its address without the values in it, and where a fault needs a look at what a platform sent, only its layout is logged (the names of its fields, how long each piece of text is, and the platform's own labels and numbers, such as the kind of event or the length of a timeout), not the words or names in it.
Aggregate counts are kept: how many connections were made, how many messages passed through, which channels were watched and how long sessions lasted. These are totals, not records about individuals, and cannot be traced back to a person.
Visits are counted the same way: once a day per browser, the site records whether that browser has been here before, a broad idea of where the visit came from (a search engine, an AI assistant, a social or streaming site, a streamer's share link, another website, or typed in directly), whether a chat was connected that day, and which of the site's pages that browser first arrived on. No ID, cookie or IP address is kept with these counts, so two visits cannot be linked to each other or to you. Browsers that send a Do Not Track or Global Privacy Control signal are not counted.
You can also turn visit counting off for this browser with the switch below. The choice is remembered in this browser's own storage, so it covers this browser on this device only, and clearing your browser data turns counting back on. Turning it off also deletes the dates kept for counting (described under Cookies and browser storage below). The switch needs JavaScript; with JavaScript off nothing is counted at all, because the counting is done by a script in the page.
Access tokens are used for actions you start, such as sending a message you typed or a moderation action you clicked, and to show you information about chats you run or moderate: who is in chat when you open “Who's here”, when someone followed when you open their profile card, and new followers, bans and timeouts since your last visit when you open a channel you run or moderate. That information is fetched with your sign-in, shown only to you, and not stored. This service does not post on your behalf or use your token for anything else. There is currently no advertising on the service, no ad tracking and no profiling. Nothing is sold or shared with data brokers, and there is no plan to change that. If advertising or sponsorship is introduced, this policy will be updated to say what that involves before it happens.
Where UK or EEA data protection law applies, the bases relied on are:
A single session cookie is set when you sign in. It is essential; signing in does not work without it. There are currently no advertising or tracking cookies and no third-party analytics scripts; if that changes, this policy will be updated before it does.
Your browser's local storage holds channel names, display settings and recent messages so the app behaves sensibly when you reload. That data stays on your device and can be cleared through your browser at any time.
It also holds a few dates used for the visit counts above (your first visit, the last day your visit was counted, the last day you connected a chat and the day your first chat was counted) and the name of the first page you opened here. The dates never leave your browser; the server only receives the yes or no, the broad source and the page name described above. If you turn visit counting off above, those are deleted and a note that counting is off is kept instead.
Chat messages pass through the service to reach your browser. They are not stored on the server and are not used to build any record of what was said or by whom. Message history you see after a reload is held in your own browser. The one exception is a channel whose activity is kept, turned on by its streamer or by the site owner for that channel, described under Chat recordings below.
The list of who is in a Twitch chat, and a channel's new followers and bans, are fetched from Twitch for the streamer or moderator who asks, with their own Twitch sign-in, and are not stored.
To work at all, this service communicates with:
Badge and emote images load directly from those providers, so their servers see the request. Each has its own privacy policy.
Combined Chat uses YouTube API Services. By using those features you are also agreeing to the YouTube Terms of Service, and Google's handling of your information is described in the Google Privacy Policy. This service's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Data from Google APIs is used only to provide the chat features you asked for, and is never used for advertising, sold to anyone, or used to train AI models. You can revoke access at any time through your Google account permissions.
Google user data obtained through YouTube API Services — your YouTube channel ID, channel name, channel image, and the OAuth tokens Google issues — is not sold, rented, traded or disclosed to any third party for any purpose. It is not shared with advertisers, data brokers, analytics providers or AI model trainers.
It is shared or transferred in only these situations:
No other person, company or service receives this data. When you disconnect your YouTube account, or ask us to delete your data, the stored tokens and channel details are deleted from our database.
The chat recorder is off unless you turn it on. By default a recording is written to storage in your own browser: it stays on your device, it is not uploaded, and clearing your browser data removes it.
A server-side archive, if it is enabled for a channel you own, keeps the messages of that channel's chat so you can review or export them later. Three things apply to it:
A streamer can also turn on Keep my channel's activity while I'm away in their settings. While it is on, the service keeps that streamer's own Twitch and Kick chat and channel events (subs, gifted subs, cheers, Kicks, raids, bans and timeouts) so that the streamer and their moderators can see what happened while they were away. The same rules as the archive apply:
Chat messages are written by people other than you, and those people have not used this service. They are held only to provide the recording feature to the channel owner, never used for advertising or profiling, and never sold or shared with data brokers. If you appear in a recording or in a channel's kept activity and want it removed, email privacy@combinedchat.com.
You can ask for a copy of what is held about you, ask for it to be corrected or deleted, object to processing, or withdraw consent. Email privacy@combinedchat.com and say which account you mean. Depending on where you live you may also have the right to complain to a data protection authority.
Logging out ends your session. To revoke access entirely, disconnect the application in your Twitch settings under Connections, or the equivalent Kick setting; that invalidates the token immediately. To have stored account records or an email address deleted, get in touch at the address above.
The application and its database run on a server hosted by netcup in Germany, within the European Union. The platforms and emote providers listed above operate their own infrastructure internationally, so requests to them may be processed outside the EU.
Connections use HTTPS. Access tokens are stored in a private database that is not publicly reachable, session cookies are marked secure, and administrative pages require a separate secret. No system is completely secure, and this is a service run by one person rather than a company with a security team, which is worth knowing when deciding what to connect. If a breach occurs that puts your information at meaningful risk, affected users will be told.
This service is not intended for children under 13 and information is not knowingly collected from them. Anyone under the age of majority where they live should have a parent or guardian's permission. Twitch, Kick, YouTube and Rumble have their own minimum age requirements which apply as well.
This service is in beta and this policy will change as it does. Material changes will be noted here with a new date at the bottom of the page.