This explains what Combined Chat collects, why, how long it is kept and who else sees it. It is written to be read rather than to cover every eventuality, and it describes what the service actually does today.
Combined Chat is operated by an individual, not a company. For privacy questions, data requests or anything else in this policy, contact privacy@combinedchat.com.
No account is needed and nothing identifying is stored about you. Channel names you enter, your display settings and recent messages are kept in your own browser, not on a server.
Signing in with Twitch or Kick stores your platform user ID, username, display name, profile image and the access and refresh tokens that platform issues. The tokens are what allow sending messages and moderating on your behalf. Your password is never seen by this service, because the sign-in happens on the platform's own site.
Each successful sign-in also records the platform, username, time and the IP address the request came from. This exists to detect abuse such as one person creating many accounts to spam chat.
The email address you submit is stored so occasional product updates can be sent. Nothing else is attached to it, and it is not linked to your chat use or your platform accounts.
Ordinary operational logs record requests, errors and connection events. These are needed to keep the service running and to investigate faults.
Aggregate counts are kept: how many connections were made, how many messages passed through, which channels were watched and how long sessions lasted. These are totals, not records about individuals, and cannot be traced back to a person.
Access tokens are used only for actions you start: sending a message you typed, or a moderation action you clicked. This service does not read your account, post on your behalf, or use your token for anything you did not ask for. There is no advertising, no ad tracking, no profiling, and nothing is sold or shared with data brokers.
Where UK or EEA data protection law applies, the bases relied on are:
A single session cookie is set when you sign in. It is essential; signing in does not work without it. There are no advertising or tracking cookies and no third-party analytics scripts.
Your browser's local storage holds channel names, display settings and recent messages so the app behaves sensibly when you reload. That data stays on your device and can be cleared through your browser at any time.
Chat messages pass through the service to reach your browser. They are not stored on the server and are not used to build any record of what was said or by whom. Message history you see after a reload is held in your own browser.
To work at all, this service communicates with:
Badge and emote images load directly from those providers, so their servers see the request. Each has its own privacy policy.
Combined Chat uses YouTube API Services. By using those features you are also agreeing to the YouTube Terms of Service, and Google's handling of your information is described in the Google Privacy Policy. This service's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Data from Google APIs is used only to provide the chat features you asked for, and is never used for advertising, sold to anyone, or used to train AI models. You can revoke access at any time through your Google account permissions.
You can ask for a copy of what is held about you, ask for it to be corrected or deleted, object to processing, or withdraw consent. Email privacy@combinedchat.com and say which account you mean. Depending on where you live you may also have the right to complain to a data protection authority.
Logging out ends your session. To revoke access entirely, disconnect the application in your Twitch settings under Connections, or the equivalent Kick setting; that invalidates the token immediately. To have stored account records or an email address deleted, get in touch at the address above.
The service runs on Railway infrastructure and may be processed in the European Union, the United States or elsewhere depending on region. The platforms and emote providers listed above operate their own infrastructure internationally.
Connections use HTTPS. Access tokens are stored in a private database that is not publicly reachable, session cookies are marked secure, and administrative pages require a separate secret. No system is completely secure, and this is a service run by one person rather than a company with a security team, which is worth knowing when deciding what to connect. If a breach occurs that puts your information at meaningful risk, affected users will be told.
This service is not intended for children under 13 and information is not knowingly collected from them. Anyone under the age of majority where they live should have a parent or guardian's permission. Twitch, Kick, YouTube and Rumble have their own minimum age requirements which apply as well.
This service is in beta and this policy will change as it does. Material changes will be noted here with a new date at the bottom of the page.