Privacy policy

1. Who is responsible

Sigvart operates Artifact Section and is responsible for the personal information processed to run this service (the “data controller”). For privacy questions or requests, email privacy@skravle.app.

2. Information we process and why

• Website and playback requests. Our hosting and video infrastructure receives technical information such as your IP address, requested URL, connection time, and browser information to deliver content, diagnose failures, and protect the service.
• Twitch and Kick sign-in. If you sign in, we process your platform user ID, username, authorization credentials, and session information to authenticate you and enable chat. Your password is entered with the platform, not Artifact Section. Twitch authorization also enables access to your available emotes. Artifact chat and Watch Together use your Twitch identity.
• Chat. We process message text, usernames, user IDs, timestamps, emotes, badges, replies, and moderation events to display and deliver chat. These come from you, Twitch, Kick, and their chat-history sources. Messages are visible to others in the relevant room. Artifact messages stay in the selected Artifact channel. We store channel names, creator Twitch IDs, and configured emote sources to provide channel settings.
• Artifact reactions. Reactions are linked to the message and your Twitch ID. Other channel members see reaction counts; the interface shows you your own selections. Poll results saved before polls were removed are deleted within seven days of their creation.
• Media uploads. When you choose a file with the chat upload button, your browser sends it directly to Nuuls, which also receives your IP address and browser connection information. The returned media link is added to your draft; you decide when to send it in chat. Files hosted by Nuuls are accessible through their links.
• Watch Together. We store submitted YouTube video or playlist links, X post links, and their public metadata, the submitter’s Twitch identity, votes linked to Twitch IDs, and shared playback state. Other connected users can see suggestions, submitter names, vote totals, and the participant count. The server also tracks who has joined while connected, using temporary random identifiers for guests. X videos are streamed to you through our server, so X sees a request from our server rather than your IP address.
• Preferences and contact. We save playback, chat, and appearance preferences in your browser. If you email us, we receive your email address and the information you provide to handle your request.

Guests can read Artifact, Twitch and Kick chats and join Watch Together. Posting, voting and playback controls require sign-in. Twitch guests connect to public IRC. Other people may copy messages or links you share.

Optional chat translation. Choosing Translate sends the selected message’s text and your target language through Cloudflare to DeepL. Rendered emotes, links, @mentions, emoji and inline code are replaced with placeholders in your browser; author metadata, login credentials and surrounding messages are not included. Names or personal information written as ordinary message text may still be sent. Translation results are shown only to you and are not posted in chat. Your language preference is saved locally. Identical requests may reuse translated text in a five-minute Cloudflare edge cache, which can remain until expiry after deletion of the original message. Displayed translations are removed with their original messages. We persist only a day and character count for the translation budget, and use your IP address for request limiting. DeepL processes submitted text under its applicable API terms and privacy policy.

3. Reasons for using personal information

Where the GDPR applies, the proposed basis for delivering requested playback, authenticated chat, and shared viewing is performance of the service agreement with you (Article 6(1)(b)), where that processing is necessary. Security, abuse prevention, moderation, troubleshooting, and responding to general enquiries rely on legitimate interests (Article 6(1)(f)): keeping the service working and protecting its community. Processing required by law relies on Article 6(1)(c).

Where consent is required for optional storage or tracking, it must be requested separately. This policy and continued use of the website do not constitute consent. You can withdraw consent where processing relies on it, without affecting earlier lawful processing.

Your right to object: you can object to processing based on legitimate interests by contacting us. We must stop unless we can demonstrate overriding legitimate grounds or need the information for legal claims.

4. Cookies and browser storage

The site uses local storage to remember your last stream or video link, selected channels, website theme, chat appearance, and layout. These preferences remain until replaced or cleared in your browser.

The optional keep-screen-awake preference is also saved in local storage. An offline recovery page and its static styling and script are stored in browser Cache Storage by a service worker. This offline cache does not store chat messages, access tokens, API responses, or video. Browser updates or clearing site data may remove it.

Twitch sign-in tokens use local storage, with tab storage as a fallback. It is cleared on logout or when the site detects expiry or invalidation. Temporary sign-in state uses tab storage. For Artifact chat, shared viewing, and shared game invitations, the token is also sent to the Artifact gateway over an encrypted connection and kept in memory for validation.

Kick uses a secure, HttpOnly session cookie (__Host-artifact_kick) lasting up to 30 days and a temporary sign-in cookie (__Host-artifact_kick_flow) lasting up to 10 minutes. Kick access and refresh tokens are stored on the server. Logout clears the site session and requests token revocation.

You can log out, revoke access in your Twitch or Kick account settings, and delete cookies or site storage in your browser. Clearing browser data resets preferences and may interrupt sign-in; it does not delete messages or server records. Embedded providers have separate sessions and may use their own cookies, storage, advertising, or measurement technologies.

5. Hosting and third-party services

Cloudflare delivers the website, API relays, and Kick session and room storage. A separate server runs Artifact chat and video services.

Depending on loaded features and content, your browser connects to Twitch, Kick, YouTube/Google, Vaughn Live, AngelThump, Rumble, w.tv, Odysee, X, 7TV, BetterTTV, FrankerFaceZ, Recent Messages (robotty.de), and media or image hosts you select. These services receive connection information, such as your IP address and browser details, and relevant channel or content identifiers. Some requests, including emotes, thumbnails, chat connections, or restored playback, can begin when the page loads.

Joining a shared Gartic Phone game or opening its lobby sends your browser to Gartic Phone, which receives connection information and handles its own identity, gameplay, advertising, cookies, and storage. The game loads only after you choose to open it. We do not send your Twitch or Kick tokens to Gartic Phone.

Recent Messages supplies recent Twitch chat history without receiving your Twitch token. Kick also supplies recent public chat history. Live stream suggestions come from creature.watch through our server relay. YouTube metadata is retrieved through a server-side public metadata reader or the YouTube Data API, depending on configuration. X live broadcasts are looked up and streamed to you through our servers, so X sees requests from our servers rather than your IP address.

Providers handle information under their own privacy policies, including Twitch, Kick, Google, and Cloudflare. We may also disclose information when legally required or necessary to address abuse or establish, exercise, or defend legal claims.

These services may process information outside the European Economic Area.

6. How long information stays

• Twitch chat: the custom chat feed is held in browser memory. Recent history is retrieved from the external history service, which has its own retention practices.
• Kick sessions: server session records expire after up to 30 days or are cleared on logout. The room cache holds up to 200 messages; on joining, entries older than one hour are pruned and up to 100 are returned. Idle cleanup normally clears the room after about five minutes without viewers, but upstream failures can delay cleanup.
• Artifact chat: messages are stored in the gateway database for seven days and remain available across service restarts. Older messages are automatically removed, with background cleanup running once a minute. Moderation can remove messages sooner. Reactions are removed with their message. Polls and their votes expire seven days after the poll was created, or sooner if the site owner removes the poll. Twitch user IDs, usernames, and bans persist across restarts and currently have no automatic expiry.
• Gartic Phone invitations: the current invite, publishing Twitch user ID and username, and timestamps persist on the gateway until replaced, removed, or expired after six hours. Copies shared outside the site remain outside our control.
• Watch Together: suggestions, submitter identities, votes, and playback state persist across restarts. A completed or deleted item and its votes are removed from the active queue. Stopping playback retains the suggestion; unplayed suggestions have no automatic expiry.

Removing information from the site does not remove copies held by Twitch, Kick, other providers, or other users. Database backups may retain earlier copies.

7. Your privacy rights

Where the GDPR applies, you may request access to your information, correction, deletion, or restriction of processing. You may receive information you provided in a portable format where processing is automated and based on consent or contract. These rights have legal conditions; for example, some records may need to be retained for legal obligations or claims.

Email privacy@skravle.app with your request and relevant platform username or ID. Do not send passwords or access tokens. We may ask for proportionate verification of account ownership. We normally respond within one month; if an extension is permitted for a complex request, we will explain it within that month.

You can complain to your local data protection authority. In Norway, this is Datatilsynet. For information controlled independently by another platform, contact that provider as well.

8. Changes to this policy

We will update this page when our practices change and revise the date above. Material changes will be highlighted on the website, with advance notice where required.