Skip to content
← Back to home

Privacy Policy

Last updated:

1. Introduction

Kli ("we", "us", "our") operates the Kli chat buddy service (the "Service"). This Privacy Policy explains how we collect, use, and safeguard your information when you use our Service.

By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide

  • OAuth Profile Data: When you authenticate via Twitch or Google/YouTube, we receive your platform user ID, display name, and email address (if provided by the platform).
  • OAuth Tokens: We store access and refresh tokens to maintain your connection to Twitch/YouTube. These are stored securely in our database.
  • Channel Configuration: Custom commands, timers, moderation rules, and song queues you create.

2.2 Automatically Collected Information

  • Chat Messages: Messages sent in connected channels are logged for moderation and command processing. This includes usernames, message content, and timestamps.
  • Server Logs: HTTP request logs including IP addresses, request paths, timestamps, and authenticated user IDs. Used for security and debugging.
  • Session Data: HMAC-signed session cookies (kli_session) for authentication. Default lifetime is 7 days.

3. How We Use Information

We use collected information to:

  • Provide and maintain the Service
  • Process chat messages through moderation filters and command execution
  • Authenticate your sessions and enforce security
  • Send automated messages to your connected channels (timers, command responses)
  • Improve and debug the Service

4. Cookies

We use the following cookies:

  • kli_session — Authentication session (HMAC-signed, 7-day default)
  • kli_oauth_state_twitch / kli_oauth_state_youtube — OAuth flow state (cleared after use)

We do not use tracking cookies or third-party analytics cookies.

5. Data Storage

All data is stored in an embedded SQLite database on the server hosting the Service. Data is not distributed across multiple services or third-party databases.

OAuth tokens are stored in the oauth_tokens table. Session tokens are client-side (cookies) and verified server-side using HMAC-SHA256.

6. Data Sharing

We do not sell, trade, or rent your personal information. Data is shared only with:

  • Twitch / YouTube: When you connect a channel, we communicate with their APIs to send messages and receive chat events.
  • Legal Requirements: If required by law, court order, or governmental authority.

7. Data Retention

We retain your data for as long as your account and connected channels exist. You can delete your channels at any time via the API (DELETE /api/channels/{id}), which removes associated commands, timers, rules, and song requests.

Chat logs persist until the associated channel is deleted. OAuth tokens persist until you revoke access or delete your account.

8. Security

We implement security best practices:

  • Session tokens are HMAC-SHA256 signed
  • Auth cookies use the Secure flag in production
  • All resource handlers verify ownership before access
  • Request bodies are size-limited with strict JSON parsing
  • EventSub webhooks verify Twitch HMAC signatures
  • WebSocket upgrades are origin-checked

No method of transmission over the Internet is 100% secure. We strive to use commercially acceptable means to protect your data but cannot guarantee absolute security.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access your personal data
  • Request deletion of your data
  • Export your data
  • Withdraw consent for data processing

To exercise these rights, contact us at the address below. You can also delete your channels and log out at any time through the Service.

10. Children's Privacy

The Service is not intended for children under 13. We do not knowingly collect information from children. If you believe a child has provided us with personal data, please contact us.

11. International Transfers

Your information may be transferred to and maintained on servers outside your state, province, or country. If you are located outside the server's jurisdiction, please be aware that data protection laws may differ.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of changes by updating the "Last updated" date. Continued use after changes constitutes acceptance.

13. Contact

For questions about this Privacy Policy or to exercise your data rights, open an issue on GitLab:

GitLab Issues: gitlab.com/htbd2219/kli/-/issues (preferred — fastest response)

Self-hosting? You are the data controller for your own deployment — review your hosting provider's data-processing terms. For the public hosted instance (if offered), the operator listed on the GitLab project is the controller.

Source & Transparency: gitlab.com/htbd2219/kli — MIT licensed.