Privacy Policy

Last updated: July 20, 2026

Makers on Stream ("we", "us", or "our") operates https://makersonstream.app, a directory and calendar service for maker and craft streamers and their viewers. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

Information we collect

Account information

When you register, we collect your email address, display name, password (stored as a secure hash), timezone, and account role (viewer or creator).

Creator profile information

If you create a maker profile, we may store your bio, avatar, categories, tags, project spotlight, schedule events, and public profile URL.

Connected platform data (Twitch and YouTube)

If you choose to connect Twitch or YouTube, we request read-only access to import your public channel information and scheduled streams into MakersOnStream. Specifically:

  • Twitch: channel ID, display name, email (if granted), upcoming schedule data, and live status.
  • YouTube: channel ID, channel name, upcoming live broadcast schedule, and live status via the youtube.readonly scope.

We use this data only to display your connected platforms on your profile and to populate your public schedule and calendar. We do not upload, edit, delete, or post content to Twitch or YouTube on your behalf.

Viewer activity

Logged-in viewers may favorite creators, bookmark events, and subscribe to personalized calendar feeds. We store these preferences linked to your account.

Technical data

We use session cookies to keep you logged in, CSRF tokens to protect forms, and may record IP addresses for login rate limiting and security.

How we use your information

  • Provide and operate the service (profiles, discovery, calendars, reminders).
  • Import schedules from connected Twitch and YouTube accounts (one-way; we do not push changes back).
  • Send account-related email (verification, password reset, optional event reminders).
  • Maintain security and prevent abuse.

How we share information

We do not sell your personal information. We share data only in these cases:

  • Public profiles: creator bios, schedules, and connected platform names/URLs you choose to make public.
  • Service providers: hosting and email delivery needed to run the site.
  • Legal requirements: when required by law or to protect rights and safety.

How we protect sensitive data

We apply technical and organizational measures to protect personal and sensitive data we store, including account credentials and OAuth tokens from connected platforms:

  • Encryption in transit: traffic between your browser and our servers is protected using HTTPS/TLS.
  • Passwords: passwords are never stored in plain text. They are hashed with bcrypt before storage and cannot be recovered from the database.
  • OAuth and platform tokens: access and refresh tokens for connected services (such as Twitch and YouTube) are encrypted at rest using AES-256 before being saved to the database. Encryption keys are kept separate from application data and are not committed to version control.
  • Session and login security: session cookies are marked HttpOnly and SameSite; remember-me tokens are stored as one-way hashes; CSRF tokens protect form submissions; and login attempts are rate-limited by IP to reduce abuse.
  • Access controls: account data and connected-platform credentials are available only to the authenticated account holder (and to administrators when needed to operate or secure the service). We do not use platform tokens to post, edit, or delete content on your behalf.
  • Server and configuration hygiene: secrets (database credentials, OAuth client secrets, encryption keys, and SMTP credentials) are stored in server configuration outside public web assets.

No method of transmission or storage is completely secure. We take reasonable steps to protect your data, but we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately and change your password.

Data retention

We retain account data while your account is active. If you disconnect Twitch or YouTube, we deactivate the connection and stop importing new schedule data. You may request account deletion by contacting us.

Your choices

  • Disconnect platforms: Dashboard → Connections → Disconnect for Twitch or YouTube.
  • Update profile: edit your account and profile settings in the Dashboard.
  • Delete account: email us at admin@makersonstream.app.

Third-party services

OAuth connections are subject to Twitch and Google/YouTube privacy policies. We only access the permissions you approve during the connection flow.

Children's privacy

The service is not directed to children under 13, and we do not knowingly collect their personal information.

Changes

We may update this policy from time to time. We will post the revised date at the top of this page.

Contact

Questions about this Privacy Policy? Contact us at admin@makersonstream.app.