Privacy Policy
Last updated: 2026-10-29
1. Controller
The controller responsible for the processing of personal data on this service (the “Service”) within the meaning of the General Data Protection Regulation (GDPR) is the operator of the Service. Contact details are provided in the Legal Notice (Impressum).
2. Overview
NONSTOPVOD archives a streamer's own Twitch VODs, plays them back on this site, and republishes them to a second Twitch channel the same streamer controls. This policy explains what personal data we process when you visit the site or hold an account, the purposes and legal bases of that processing, how long we keep it, and the rights available to you.
Two things are worth stating up front, because they shape everything below. We do not run advertising, and we do not use any analytics, tracking or profiling of any kind: there is no third-party script on this site, no advertising network, no cross-site tracking and no visitor measurement. And the video we store is content our own customers recorded on their own Twitch channels; a channel can only be archived once the person holding the account has proven they control it by signing in to Twitch with it.
3. Data We Process
3.1 Server log and connection data
When you access the Service, our servers process the technical connection data required to deliver it and keep it secure: the IP address of the requesting device, the date and time of the request, the requested resource, the HTTP status code and amount of data transferred, and information about your browser and operating system (user agent).
3.2 Account data
If you register, we process your email address, its verification status, and a securely hashed password. We never store your password itself. If you sign in with Twitch instead, we process the Twitch account id, login and display name that Twitch returns, and the email address Twitch reports for that account together with whether Twitch says it is verified. A Twitch sign-in opens the account of the verified address Twitch reports. For each Twitch account that signs in, we keep one record: its Twitch id, login and display name, the address it signed in with, and which account it last signed in to and when. Settings shows you the Twitch accounts this record names for your account, and the record is deleted with that account.
When you register, nothing is created until you enter the code we send. Until then we keep, beside the code, the hashed password, the version of the Terms you accepted and when, and your answer to how you found us, and we delete them with the code within a day.
When you ask for a sign-in code, or for a code that confirms a change to your account, we keep the code only as a salted hash, together with the address it was sent to, the time it was sent and how many times it was tried, for about a day.
When you verify with Twitch that a channel is yours, we ask Twitch for no permissions, compare the Twitch account it returns with the channel's, and revoke the token Twitch issued at once: we keep no token, only that the channel was verified, how, by which account and when.
We record the time at which you accepted the Terms of Service and the version accepted, so that acceptance can be evidenced.
3.3 Session data
Signing in creates a session. The token your browser holds is never stored by us: what we keep is a SHA-256 hash of it, together with the time it was issued and expires. Sessions last 30 days unless you sign out, which revokes them immediately.
3.4 Workspace and team data
An account belongs to one or more workspaces. If you invite someone to a workspace we process the email address you invite, the role you assign, and the state of that invitation.
3.5 Channel and Twitch integration data
To archive a channel and to broadcast to your replay channel we process the Twitch account identifiers and the OAuth access and refresh tokens you grant us, together with the stream key of the channel you broadcast to. These are credentials, held only to operate the features you enabled, and are never displayed back to you in full or shared with anyone. Because we need the original values to start your stream, they are stored in a form we can read back, not hashed.
If your channel has extra stream destinations, we also store the stream keys you enter for them. Because we need the original values to send to those destinations, they are stored in a form we can read back, not hashed, and only the systems that use them can read them. The keys are write-only and are never shown back to you.
If you buy the chat bot add-on and connect a separate Twitch account as your channel's chat bot, we also store that account's Twitch id, login and display name and the OAuth access and refresh tokens it grants us. The grant covers only sending chat messages and announcements, and we use it only to send your channel's chat messages from that account. Disconnecting the bot deletes this data at once.
3.6 Archived video and its metadata
For each VOD you choose to archive we store a byte-identical copy of the video segments Twitch published, together with metadata: title, duration, recording date, size, the ranges Twitch muted, chapter and category information, and any title you set yourself. Video is stored in a Backblaze B2 bucket in the EU (region eu-central-003) and delivered through Cloudflare; it is not stored permanently by our hosting provider. It is served only to you and to people you share a playback link with, and it is deleted when you delete it or when your account is deleted.
3.7 Broadcast and queue data
If you run a 24/7 replay channel we record which VODs streamed and when, session start and end times, how many VODs a session streamed, and peak viewer numbers reported by Twitch for your own channel. If you enable the chat bot, we store the commands you configure; chat messages from viewers are processed transiently to answer a command and are not stored.
3.8 Billing data
Payments are handled by Stripe. We never see or store your card details. What we store is the Stripe customer and subscription identifiers, your plan, subscription status and current period end, purchased storage capacity, and a ledger of the billing events Stripe has sent us, so that a webhook is never applied twice. We also take daily samples of how many bytes your workspace stores, which is what capacity is measured against.
3.9 Email delivery data
Transactional email (address verification, password reset, team invitations, billing notices) is sent through our email provider. We keep a queue of messages to be sent and their delivery state, and a suppression list of addresses that have bounced or reported a message as spam, which is checked before every send so that we stop mailing an address that does not want it.
3.10 Sign-in history
Each time a sign-in creates a session we record the time, the sign-in method (password, Twitch, sign-up or email link), a shortened IP address and the browser and operating system family, for example “Chrome on Windows”. The address is cut to its network before it is stored (the last part of an IPv4 address is dropped, and an IPv6 address is kept to its first 48 bits); we do not store the full address or the raw browser string for this record. The same shortened address and browser family label each browser your account remembers (section 5).
3.11 Workspace activity history
For each workspace we keep a history of what happened in it: which settings were changed and by whom, which dashboard pages were opened (the name of the page only), the actions taken (for example starting or skipping a stream, queueing or deleting a VOD, inviting a member, cancelling a subscription) and what finished or failed for the workspace (for example a download or a custom domain check). For settings that are switches, numbers or modes the record holds the old and the new value; for free text such as titles, command text and messages it holds only that the setting changed, not what it says; secrets such as stream keys and tokens are never recorded. An action record can name the things the action was about, such as a VOD, group or file title. A change made through an API token is marked as such and names the token.
3.12 API tokens and request log
If the owner of a workspace creates API tokens we store each token’s name, its permissions (scopes), who created it, when it was created, when it expires or was revoked, when it was last used and the shortened IP address of that last use. The token itself is shown once and never stored: we keep only a hash of it and its first 8 characters so you can tell your tokens apart. For every call made with a token we also record a log entry with the time, the method, the route (for example “/api/v1/vods/{id}” as a template, never the actual ids or the query string), the status, the duration and the shortened IP address.
3.13 Webhooks
If the owner of a workspace adds a webhook endpoint we store its URL, the events it subscribes to, who added it, when, whether it is switched on and its signing secret. Because we need the original value to sign each delivery, it is stored in a form we can read back, not hashed, and only the systems that use it can read it. It is shown once when the endpoint is created and never again. For each delivery we keep the event we sent (its type, its time, the workspace id and name, for channel events the channel’s id, login and display name, and the event’s own data) and a delivery log with the time, the result, the HTTP status and the duration. We do not store the response body of your endpoint.
4. Purposes and Legal Bases
| Purpose | Legal basis (Art. 6(1) GDPR) |
|---|---|
| Delivering the Service, archiving VODs and operating a replay channel | (b) performance of a contract |
| Account creation, authentication and session management | (b) performance of a contract |
| Twitch integrations you activate | (b) performance of a contract; (a) consent where required |
| Email verification and service notifications | (b) performance of a contract |
| Subscriptions, invoicing and statutory bookkeeping | (b) performance of a contract; (c) legal obligation |
| Recording acceptance of the Terms | (b) performance of a contract; (f) legitimate interests in being able to evidence acceptance |
| Server logs, security, abuse prevention and rate limiting | (f) legitimate interests in operating and securing the Service |
| Sign-in history, workspace activity history and the API request log, kept for security, abuse prevention and to help customers who ask us for support | (f) legitimate interests in a secure Service and in helping our customers |
| API tokens and webhook endpoints you create, and delivering events to them | (b) performance of a contract |
| Suppressing email to addresses that bounced or complained | (f) legitimate interests; (c) legal obligation |
The sign-in history, the activity history and the API request log can be read by our staff when they look into a security question or help a customer. They are not sold, not shared with advertisers and not used for advertising or profiling. Webhook events are sent only to the URLs the workspace owner added.
5. Cookies and Local Storage
We use strictly necessary storage only. There is no advertising cookie, no analytics cookie and no cross-site tracking, which is why this site does not ask you to accept or reject cookies.
- A single short-lived cookie is set when you sign in. It carries an opaque, single-use handoff key that is valid for about a minute and is consumed by the very next request your browser makes; it does not contain your session token.
- A sign-in also sets a cookie that remembers the browser for your account for up to a year. It holds a random value, of which we keep only a one-way hash, and is sent only to our sign-in pages. A remembered browser can always ask for a sign-in code to your address, even while someone else is asking for codes to it. You can see and remove remembered browsers in your account settings; signing in to another account replaces it, and anything that signs you out everywhere removes it.
- Your session token is held in your browser's own storage, not in a cookie. By default it is kept until you sign out or your session expires. If you untick “Keep me signed in” when you sign in, it is kept only for the current tab and is discarded when you close it.
- Local storage also remembers small interface preferences, such as whether the sidebar shows every tool and whether you have finished setup.
6. Recipients and Hosting
Our hosting, storage, delivery and email providers process personal data for us as processors under Art. 28 GDPR. Stripe and Twitch process data for their own purposes. We do not sell personal data. The recipients we rely on are:
- Hetzner Online GmbH (Germany) for server hosting: every server we run (the control host, the stream hosts, the GPU host, the web server, the upload host, the converter and the worker hosts) is a Hetzner server located in Germany or Finland;
- Backblaze, Inc. (USA) for the storage that holds archived video, in its EU region;
- Cloudflare, Inc. (USA) for delivering archived video;
- Resend, Inc. (USA) for transactional email delivery;
- Stripe for payment processing, for its own purposes as the payment service provider;
- Twitch, to the extent you connect a Twitch account: we read your channel's public video listing and, with your permission, broadcast to and post on the channel you nominate. Twitch processes that data for its own purposes under its own terms;
- the webhook endpoints a workspace owner adds: the events you subscribe to are sent to those URLs, which you choose and control. We have no influence over what the receiving system does with them.
7. International Transfers
Our servers are in the EU. Backblaze, Cloudflare, Resend and Twitch are companies in the USA. Where one of them processes data outside the European Economic Area, the transfer is based on the EU-US Data Privacy Framework or on the European Commission's Standard Contractual Clauses.
8. Retention
- account data: for the lifetime of the account, deleted or anonymised after account deletion, subject to statutory retention;
- archived video: until you delete it, until you delete the channel it belongs to, or until your account is deleted;
- sessions and playback grants: until they expire or are revoked, and then removed by a routine cleanup;
- broadcast history (ended sessions): deleted after 90 days;
- sign-in history: deleted after 90 days;
- remembered browsers: until you remove one, anything signs you out everywhere, or a year after the browser last signed in;
- workspace activity history: deleted after 90 days;
- API request log: deleted after 30 days;
- webhook events: deleted after 7 days; the delivery log keeps the most recent 100 deliveries per endpoint;
- webhook endpoints: until the owner removes them or the workspace is deleted;
- API tokens: until the workspace is deleted; a revoked token keeps its record so the request log can name it;
- daily storage samples: kept for as long as the workspace exists, because they are what your billing history is derived from;
- server logs: kept for a short period for security and diagnostics, then deleted;
- email suppression entries: kept for as long as necessary to avoid mailing an address that bounced or complained;
- order and invoice data: retained for the periods required by applicable tax and commercial law.
9. Your Rights
Subject to the conditions of the GDPR, you have the right to:
- access your personal data (Art. 15);
- rectification of inaccurate data (Art. 16);
- erasure (Art. 17);
- restriction of processing (Art. 18);
- data portability (Art. 20);
- object to processing based on legitimate interests (Art. 21); and
- withdraw any consent at any time with effect for the future (Art. 7(3)).
To exercise these rights, contact us using the details in the Legal Notice. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77), in particular in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement.
10. Obligation to Provide Data
Providing certain data is necessary to use the Service: without connection data we cannot deliver it, and without account data we cannot create or authenticate an account. Connecting a Twitch account is voluntary, but the archiving and replay features cannot work without it.
11. Automated Decision-Making
We do not use automated decision-making that produces legal or similarly significant effects concerning you within the meaning of Art. 22 GDPR. Automated measures such as rate limiting and abuse detection are used solely to keep the Service secure and functioning.
12. Changes to this Policy
We may update this Privacy Policy to reflect changes to the Service or legal requirements. The “last updated” date above indicates the current version.