Privacy

Draft, waiting for legal review. Last updated: November 12, 2026, version 1.1

Undercard helps streamers find games where they can be seen, helps viewers find streamers, and helps small streamers support each other. This page explains what we collect, why, how long we keep it and how to turn things off. Short version: we only collect what a feature needs, most things are opt in, we never sell your data and we never use it for advertising.

Contact email coming soon. Until then, use Settings → Feedback & help.

Your privacy choices

What we collect, and why

• Your Twitch account (to log in): your public Twitch user id, username, display name and profile picture. Logging in asks Twitch for no extra permissions, and we don't keep a Twitch access token for it.
• YouTube (optional): if you link your YouTube channel, we keep its public channel id, handle, title, picture and subscriber count (if public), whether you're live right now, and for the creator tools the public video ids, titles and view counts we look up (your recent uploads, a game's most viewed new videos, and your own channel's daily totals for the 30 day history). We never ask for your YouTube or Google login and can't act on your channel. Linking uses the YouTube API Services, so the YouTube Terms of Service apply and Google handles data under the Google Privacy Policy. Data from YouTube is refreshed or deleted within 30 days. Unlink any time in Settings → Connections (or on the YouTube page): that deletes it right away. Thumbnails you test in the thumbnail preview never leave your device.
• Images you post (when image posts are switched on): the pictures you add to squad, neighborhood or profile posts, the short description you write for each, and when you posted them. Before we store an image we remove the hidden data inside it (like GPS location, camera details and comments). Images are kept in our own storage (Cloudflare R2) and shown only to people who can see the post. Images on public pages pass through Cloudflare, which scans them for known child sexual abuse material. Anyone can report an image; moderators can remove it. Deleting the post (or the image) deletes the file; images you pick but never post are deleted within a day.
• Steam (optional): your SteamID and your list of owned games with playtime, to find games you already own.
• Games you add by hand, games you track for alerts, and your settings and preferences (including which kinds of notifications you get, and your answers to the Get started questions).
• Your stream layout (optional): if you fill in "Your stream layout" (camera, where it sits, cam frame, lighting, chat on screen, overlay, alerts, which streaming software you use), we keep your picks. They are only used for anonymous counts on game pages ("6 members here use a small corner cam"), shown once at least 3 members who streamed that game answered, never with names, and they never change where you show up. They appear on your Streamer Card only if you tick that box. Clear them any time in Settings. The "How you look in the row" preview shows other live streams from our latest check of Twitch (the same data as the Watch page) and stores nothing new about them; a picture you try there never leaves your device.
• Stand out plans (optional): if you click "Make my plan" on a game, we save that plan (its steps, which ones you ticked as done, and the date you say you changed your look) so you can find it again in Growth and goals. To build it we use only two numbers about your own picture (how bright it is and how much contrast it has, worked out in your browser) and how long your title is, never the picture or the title itself, and never anything about other streams' thumbnails. "Did it help?" compares your own past streams in that game. Delete a plan any time; deleting your account deletes them all. Up to 10 plans.
• Your typical audience size: viewer counts of your public live streams, to rank games for your size.
• Stream controls (optional): an encrypted Twitch connection with "manage broadcast" (only to set your stream category when you click a button) and "read shoutouts" (only to credit shoutouts you give).
• My stream data (optional, Pro): while you're live, each minute: your viewer count and game, who is in your chat and how many messages each person sends (counts only, never what anyone says), new followers and your subscriber count. Only you see it. People who followed or chatted are kept by name so you can thank them; people who only watched are never named (we keep a scrambled code that can't be turned back into a name, only to count regulars). Thank you whispers are only sent when you write one yourself.
• Path to Affiliate: your progress toward Twitch Affiliate is worked out from your own stream history. After each stream we send you a stream report as a notification (only you see it; it also goes to your browser if you turned on browser notifications). With My stream data on, we also keep the Twitch ids and follow dates of your own followers, and nothing else about them, so we can count your net follower change and follow anniversaries. We never show who unfollowed. Turning My stream data off, disconnecting Twitch or deleting your account deletes that list.
• Twitch follows (optional): a separate, read only Twitch connection that lists who you follow on Twitch, so we can add them to your list here and keep it up to date. It can't follow or unfollow anyone.
• Partner badge (optional): when you press Verify on the Partner page, we read your public Twitch bio (the "about" text anyone can see on Twitch, through Twitch's public API, no extra permissions) to check that it has your Undercard link or your short code. We keep only whether you're a Partner, since when, your code and when we last checked, never the bio itself. We check again about once a week while you have the badge. Staff can also give or remove the badge, and that is written to our moderation log.
• Ideas board: ideas you send in Feedback & help can show on our public What's new page once the team picks them up. Only the idea's title, its votes and its status are shown there, never who sent it.
• Following: the streamers, games and squads you follow here, any game filters and quiet hours you set for live pings, and stream reminders you ask for (deleted once the stream has started). To show "My week" we read the public stream schedules of channels you follow from Twitch and keep them for 24 hours at most. Streamers only see how many people get their go live alert, never who.
• Clip downloads (optional): a separate Twitch connection (the "manage clips" permission) used for one thing: asking Twitch for the download link of one of your OWN clips when you press Download in your Clip Vault. The link is temporary and goes straight to your browser; we never store it or the clip. Disconnecting revokes it.
• Channel point stats (optional, Pro): a separate Twitch connection so Twitch tells us when one of your channel point rewards is redeemed. We keep a count per reward per day, never who redeemed it or what they typed. Disconnecting revokes it and deletes the counts.
• VOD views (optional, Pro): the view count of your own past broadcasts, once a day for 30 days (deleted after 45 days, or when you stop tracking). Streamerversary: your top clip of each month and numbers from your own streams, saved as a share page. Clip Vault: clips are looked up from Twitch when someone opens a vault and kept in memory for at most 24 hours.
• Email (optional): your verified email from Twitch, only if you turn on email (weekly recap and reminders). Every email has a one click unsubscribe.
• Browser notifications (optional): your browser's push subscription, only if you turn them on.
• Discord (optional): if you link Discord with the /link command, we keep your Discord user id. If you also turn on Discord messages, our bot sends the alert types you picked (the same short text as the bell, plus a link here) as a private message, at most 6 an hour and 20 a day, and we keep the time of each message for 2 days to hold those limits. Unlink or switch it off in Settings any time.
• Community (optional): if you join, other members can see your name, picture, usual viewer count, whether you're live and what you're playing, your squads, your Good Neighbor points, and what you post. We record raids and shoutouts you give (Twitch tells us) to award points. Squad captains can connect a Discord webhook, which we store encrypted.
• Things you post: posts, replies, profile wall posts, likes, reposts and bookmarks (bookmarks are private), messages you send in watch party and neighborhood chats, and neighborhood events you plan or join. Posts are visible to the people allowed to see them (open squads and public profiles are public).
• Private messages: messages between friends are stored so both of you can read them. Staff don't read inboxes; a moderator only sees a message if someone in the conversation reports it. Blocking someone stops messages both ways. Deleting a chat removes it for you; deleting your account removes your messages.
• Friends and presence: friend requests you send and receive (who, when, and whether they were accepted or declined; the sender is never told about a decline), your friends list, and when you were last online, so friends can see you're around and join your watch parties. Settings lets you hide that. Removing a friend deletes that friendship; deleting your account deletes all of it.
• Collab requests: the short note you send with a collab request, so the other streamer can read and answer it.
• Watch page: how long you watch a stream here (to make sure only real viewers can add vibes, and to pick the "Live for you" streams on your Home feed together with who and which games you follow), the vibes you give, your saved searches and alerts. Streamers who are members can see how often they showed up in searches and the search words that found them, never who searched.
• Our Twitch panel (if a channel adds it): Twitch gives the panel a random id for each viewer that is not your name or account. When you pick a vibe or say hi in the panel, we keep that id with your choice for that one stream so you can only vote or say hi once (how long the panel was open: 2 days; hellos: 90 days; vibes: 180 days, then deleted). The streamer only ever sees counts, never who. Vibes picked in the panel count toward that streamer's vibes on our Watch page. Viewers who are not logged in to Twitch can only look.
• Chat activity samples: to show which games have talkative audiences, we briefly read the public chat of a rotating sample of small streams (the way a logged out visitor can) and count messages per game. We don't store names or words, only totals per game.
• Tabletop: if you use the Tabletop, we store your tables (name, description, game system), who is at each table and their role, scenes, tokens and fog, the table chat and dice rolls (the last 2,000 lines per table), turn order and conditions on tokens, drawings, walls and props (houses, roads, chests...) on the map, the picture each token uses, scheduled sessions (they show on the calendar of everyone at the table, with reminders), sheet templates (and the feelings list for bonds), the character sheets you write (stats, resources, weapons, gear, abilities, journal and bonds), and requests to join open tables. Pings and the GM's shared ruler are passed along live and never stored. People at the table see the board, chat and rolls; rolls and whispers sent to the GM are seen only by the GM, co-GMs and you; your sheet is seen by you and the GM unless you share it. Drawings on the GM layer are seen only by the GM and co-GMs. With line of sight on, each player is only sent the tokens their own characters can see. The stream view link shows the board as players see it to anyone who has that link; the GM can make a new link at any time. A reported chat line is shown to our moderators (only that line). Deleting a table deletes all of this, including any map or token images uploaded to it; a map or token image you replace is deleted within a few hours.
• Billing: handled by Stripe. We never see your card number.
• Founding member and calm mode: whether your account was made during the free beta (so we can keep your founding price later), and your calm mode choice (hide your own viewer counts while live or always).
• How you found us: if you arrive from a tagged link or another website, we remember that source (for example "reddit") for 30 days and save it with your account when you sign up, so we know which posts and ads work.
• Site analytics (you can turn this off above): Google Analytics and Microsoft Clarity record pages visited, clicks and scrolling, and Clarity makes anonymous session recordings and heatmaps. Clarity masks what you type and the admin and settings screens. They set their own cookies and follow Google's and Microsoft's privacy policies.

What we never do

• We never sell your data, rent it or trade it.
• We never use Twitch data, YouTube data, or anything else we know about you, for advertising or to target you with offers.
• We never store Twitch chat messages, and never connect a viewer's activity across different channels. (Messages you write in our own party and neighborhood chats are kept so others can read them; moderators can remove them.)
• AI helpers are off unless you turn them on. When on, only the words you type into a helper (and, for chat rules, the etiquette you picked) are sent to Anthropic (Claude) to write suggestions. We don't keep what you send or what comes back, only a daily count for the limit, and turning AI off deletes those counts.
• We never act on Twitch for you except when you click to: set your stream category, or send a thank you whisper you wrote yourself.

Cookies and storage

• sid: keeps you logged in, 30 days.
• ss_src and ref: how you found us and who referred you, 30 days.
• oauth_state, next, g_state: short lived (10 minutes) while you log in or connect something.
• dsid: keeps game developers logged in to the developer portal, 30 days.
• ss_notrack: remembers that you turned analytics off, 1 year.
• ss_theme: remembers whether you picked the light or dark look, 1 year. Only stores "light" or "dark".
• ss_start: your answers from the Get started questions (what brings you here, a few choices about streaming, watching or your game), so we can set things up the way you asked right after you sign in. 1 hour, deleted as soon as you're signed in. Not readable by scripts.
• ss_role: what you picked on the start page (stream, watch or make games), so the welcome questions start there. Up to 7 days, deleted once you answer.
• Our cookies are secure and same site, and all but ss_notrack, ss_role and ss_theme are not readable by scripts. Your browser also keeps a few small settings (like a collapsed sidebar, pinned tools, how you sort the Watch page, or which streaming software Launch should open) on your own device.
• Google Analytics and Microsoft Clarity cookies, only if analytics is on (see "Your privacy choices").

Who else is involved

Twitch (login, live data, the embedded player and chat), YouTube / Google (only if you link a channel or watch a YouTube stream here: public channel and video data, the embedded player and live chat), Steam (your game library), IGDB through Twitch (game details), Stripe (payments), our email provider (only if you turn on email), Discord (only if your squad connects it or you link your own Discord: then Discord delivers the private messages you asked for), Anthropic (only if you turn on AI helpers: just the words you type into a helper, not kept by us, not used to train AI), GIPHY (when you search for a GIF, the words you search go to GIPHY through our server, and any GIF in a post loads straight from GIPHY's servers, so GIPHY sees the viewer's IP address like any website would), our hosting and backup providers, and Google Analytics and Microsoft Clarity (unless you turn them off). Each only gets what it needs to do its job.

How long we keep things

Short version: data about other people's channels is a short cache, data about you stays until you delete it or turn the feature off, and a few things clean themselves up on a timer. Here is the full list.

• Live data about channels that aren't members (names, titles, viewer counts from our checks of Twitch): 24 hours, then deleted. Over the long term we keep only running averages per game (like when a game is busiest, or how chatty its streams are), never a list of channels or a day by day log.
• Names of raiders who aren't members: 24 hours. After that the raid stays in your raid history as a number of viewers and a time, without the name.
• Stream schedules of channels you follow (for "My week"): 24 hours, then we ask Twitch again. Stream reminders you set are deleted an hour after the stream was due to start.
• Clip Vault: clips are kept in the server's memory only, for at most 24 hours. Nothing about them is written to our database.
• Data from YouTube (channel facts, video stats, your channel's history): refreshed or deleted within 30 days. Unlinking deletes it right away.
• My stream data, viewers: people who chatted or followed, and the scrambled codes we count lurkers with, are forgotten after 90 days of not showing up in your streams.
• My stream data, your stream totals (one line per stream: minutes, average and peak viewers, chatters, new followers): kept so you can compare month by month and year over year, until you turn My stream data off, disconnect Twitch or delete your account. The minute by minute viewer curve of each stream is kept for about 400 days.
• Watch page search statistics (how often members showed up in searches and the words that found them): 120 days.
• Chat activity counts (messages per minute in members' live streams, never the words): 60 days.
• VOD views (only if you turn it on): tracked for 30 days, deleted after 45 days or when you stop tracking.
• Notifications: the newest 100 for each person; older ones are deleted.
• Log in session (the sid cookie): 30 days, or until you log out.
• Get started answers (the ss_start cookie): 1 hour, and deleted as soon as you're signed in.
• How you found us (the ss_src cookie): 30 days.
• Images you picked but never posted: deleted within a day.
• Site analytics (Google Analytics and Microsoft Clarity): only if you haven't turned them off, and kept for as long as Google's and Microsoft's own settings say.
• Backups: a copy of the whole database is made once a day on our server, and only the newest 7 are kept. If off site backups are switched on, one copy per weekday (replaced each week) and one copy per month are also kept with our storage provider. Backups are only used to fix mistakes, and only the site owner can open them.
• Everything else (your account, settings, posts, squads, friends, tables, games): until you delete it or delete your account.

How to take your access back

You can cut us off at any time, from our side or from theirs.

• Here: Settings → Connections is where you turn off each optional connection on its own. Disconnecting a Twitch connection also revokes it on Twitch.
• On Twitch: go to twitch.tv/settings/connections and press Disconnect next to Undercard. Twitch tells us right away, and we drop your Twitch permissions, delete your stream data and log you out. Your account stays until you delete it.
• On Google (if you signed in to the developer portal with Google): go to myaccount.google.com/permissions and remove Undercard. Linking a YouTube channel here never uses a Google login, so there is nothing to remove there for that; unlink it in Settings → Connections instead.
• Everything at once: Settings → Delete my account.

Your data, your choice

Download my data (Settings) gives you a copy of everything tied to your account. Delete my account removes everything right away, including stream data and connections. You can turn off any optional connection on its own, from here or from Twitch's or Google's side (see How to take your access back). If you're in the EU or UK you can also ask us to correct or restrict your data, or object to how we use it, and you can complain to your data protection authority. California residents have similar rights; we don't sell or share personal information. To ask anything, see the contact line at the top of this page.

Age

Undercard is for people 13 and older (16 where your country requires it). We don't knowingly collect data from younger children; if you think a child signed up, tell us and we'll delete the account.

Changes

If we change this page in a way that matters, we'll say so on the site before it takes effect.

Terms · Copyright and DMCA · Our promise · What's new · Undercard is not affiliated with or endorsed by Twitch or Valve.