Privacy Policy

Effective Date: August 5, 2026

1. Introduction

PixelyChat ("we," "our," or "us") is a free desktop application for live streamers. This Privacy Policy explains what data PixelyChat's desktop application and this website (pixelychat.com) handle, and how.

PixelyChat is built as a local desktop application by design. We do not operate a backend service that stores or processes your chat data, and we don't want to — your streaming data is yours.

2. Information the Desktop App Handles

All of the following stays on your own device, in your operating system's application data folder:

• Authentication tokens: When you connect Twitch, YouTube, or Kick, PixelyChat stores the resulting OAuth access/refresh tokens locally. In installed (non-development) builds, these are encrypted using your operating system's own secure credential storage (Keychain on macOS, DPAPI on Windows, and the equivalent secret storage on Linux where available) via Electron's safeStorage API, so PixelyChat itself never handles the encryption key directly.
• Chat data: Live chat messages, usernames, and related event data (follows, subs, gifts) are fetched from each connected platform solely to display them in the app and in your on-stream overlay. This data is not written to a persistent log or database — it exists in memory while the app is running.
• Settings: Your app preferences (overlay style, TTS voice, translation languages, and so on) are saved to a local configuration file.

None of the above is transmitted to PixelyChat's developer, sold, or shared with any third party.

3. A Note on Our OAuth Relay

Twitch, Google, and Kick's login flows all require a confidential client secret at one step (exchanging or refreshing a token) that a desktop app cannot safely store on its own. To handle just that one step, PixelyChat calls a small relay service we operate. The relay forwards the token request to the relevant platform and returns the result — it does not store access tokens, refresh tokens, or display names. Optionally, on a successful first login it may store an irreversible hash of your platform account id (not the id itself) so we can show approximate unique connected-account counts on our website. Re-logins and token refreshes are not stored again. It exists primarily so a secret value never has to ship inside the app itself.

4. Google OAuth & YouTube API Services

PixelyChat's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect YouTube, PixelyChat requests two scopes:

• youtube.readonly — to read messages from your own live chat.
• youtube.force-ssl — used only if you choose to send a message to your own live chat from within PixelyChat. This is the narrowest scope Google offers for posting a live chat message; YouTube's API does not provide a scope limited to live chat alone for write access. PixelyChat's own code only ever uses this scope to read and post live chat messages — never to upload, edit, or delete videos, or to manage any other part of your channel.

Data obtained via the YouTube API is used solely to display your live chat and, if you choose, send messages back to it. It is stored only on your local device, never transmitted to us, and never sold or shared with any third party.

You can disconnect YouTube at any time from within PixelyChat, or revoke PixelyChat's access entirely from your Google Account permissions page.

5. Twitch, Kick, and TikTok

Each of these uses a different login mechanism, and we want to be precise about how each one actually works:

• Twitch: Uses Twitch's official OAuth flow, opened in your system's default web browser. PixelyChat never sees your Twitch password.
• Kick: Uses Kick's official OAuth flow, loaded in a login window inside the app that points directly at Kick's own login page. PixelyChat never sees your Kick password — the window is only used to complete Kick's own authorization step, and the resulting session may be remembered for your next login the same way a browser would.
• TikTok: TikTok does not offer a public OAuth flow for third-party apps. PixelyChat opens an in-app window pointed at TikTok's own login page; once you've signed in there, PixelyChat reads your public username to identify your account for connecting to your LIVE chat. PixelyChat never sees your TikTok password.

Chat messages, usernames, and related event data from all three are processed strictly locally to render your unified chat feed.

6. Website Data

This website (pixelychat.com) does not currently use any analytics, tracking scripts, or cookies. If that changes in the future, this policy will be updated to reflect it before any such tool is added.

7. Data Retention & Deletion

Nothing described above is retained on any server we operate. Uninstalling PixelyChat and removing its local application data folder (shown in-app under Logs → Open Logs Folder, or your OS's standard application data location) permanently deletes all locally stored settings and tokens.

8. Security

All communication with platform APIs (Google, Twitch, Kick, TikTok) uses HTTPS/TLS. Locally stored tokens are encrypted using your operating system's own secure storage mechanism via Electron's safeStorage API in installed builds, as described in Section 2.

9. Children's Privacy

PixelyChat is a tool for streamers and is not directed at children under 13. We do not knowingly collect data from children under 13.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected here with an updated Effective Date.

11. Contact Us

Questions about this policy or our data practices are welcome at:

Email: pixelychat@proton.me