Live, canonical version: https://heatsync.org/legal/privacy

What we collect

• Authentication: your heatsync account token (encrypted in browser storage)
• User profile: display name, user ID, multichat configuration
• Emotes: your personal emote inventory and list of emotes you've blocked
• Channels: names of Twitch, Kick, and YouTube channels you add to multichat
• YouTube video IDs: IDs of YouTube streams you join for real-time chat sync
• UI preferences: chat collapse state, tab order, visual settings
• Cosmetics: cache of 7TV paints, FFZ/BTTV badges, and badge assignments

We do not collect: chat message content, browsing history, clickstream data, device identifiers, analytics, or telemetry.

How it's used

• Emote sync: your token is sent to heatsync.org to fetch your emotes and sync blocks across devices
• Cosmetics: emote names and user IDs are sent to 7TV / FFZ / BTTV to fetch visual styles and badges
• Username resolution: channel/streamer names sent to decapi.me (Twitch public API wrapper) to resolve usernames to numeric IDs
• Real-time chat: channel names sent to the heatsync WebSocket for live emote broadcasts
• Multichat routing: YouTube video IDs help route live chat to the correct channel

All processing is read-only. The extension does not modify your accounts or settings on any third-party platform.

Third-party services

| Service | Data sent | Purpose |
|---|---|---|
| heatsync.org | auth token, emote names, blocked IDs | fetch + sync emotes |
| heatsync.org WebSocket | channel names | real-time emote broadcasts |
| 7tv.io | Twitch user IDs, emote names | paint gradients + badges |
| frankerfacez.com | emote names | badge metadata |
| betterttv.net | emote names | badge metadata |
| decapi.me | channel names | resolve username → Twitch ID |
| twitch.tv, kick.com, youtube.com | none — DOM read only | render overlays in chat |

No personal data is sold or shared. No analytics SDK is loaded. No third-party tracking.

User rights

• Login/logout: sign in/out from the extension popup. Signing out clears your token and disables sync.
• Data export (GDPR Article 20): visit heatsync.org account settings.
• Account deletion: visit heatsync.org account settings.
• Object/block: block individual emotes per-channel or globally from the extension UI.

Data retention

• Token: until you sign out; auto-deleted on uninstall.
• Emote cache: refreshed every 60s; in-memory.
• Cosmetics cache: global refresh every 24h, per-channel on demand.
• Chat history: multichat messages cached in memory during session only; never written to disk.

Contact

Questions / privacy concerns: mellen@heatsync.org
Security disclosures: see SECURITY.md in the repo