Privacy Policy

Last updated: 14 May 2026

Who runs Voding

Voding (the site at vod.ing) is an independently operated Twitch VoD editing tool. The data controller for the purposes of GDPR is the operator of vod.ing. Contact: info@vod.ing.

What we collect

Account data (via Twitch OAuth)

When you sign in with Twitch, Voding receives your Twitch user ID, display name, profile image URL, and an OAuth token scoped to the permissions Twitch shows you at consent. Voding stores the OAuth token (encrypted at rest) so it can read VoDs and chat on your behalf. You can revoke this at any time from your Twitch Connections settings; the next time you visit Voding the session is invalid and you are signed out.

Billing data (via Stripe)

Paid plans use Stripe. Voding stores your Stripe customer ID, your current plan, your subscription status, and the email address Stripe has on file for your account. Voding never receives or stores card numbers — those go directly to Stripe. Stripe's own privacy policy applies to the data they hold.

Content data (VoDs, chat, clips you create)

Each VoD you request is downloaded from Twitch to Voding's S3 bucket in eu-central-1 (Frankfurt). The chat log for that VoD is downloaded once and stored in a MongoDB cluster in the same region. Clips you create, chat overlays you render, and FCPXML exports you generate are stored on the same S3 bucket. All content data is associated with your user ID — it is not shared with any other Voding user.

Logs and usage metrics

HTTP logs (IP address, user agent, requested URL, response status, response time) are retained for 30 days for debugging and abuse prevention. AWS CloudTrail records S3 access by user, used for bandwidth accounting against your plan. We do not run third-party analytics or advertising trackers.

Cookies

Voding uses a single cookie — auth-session — to keep you signed in. It is first-party, HTTP-only, secure, and expires after 30 days. We do not use cookies for advertising or third-party analytics.

Who we share data with

• Twitch — for OAuth and for fetching the public VoDs and chat you ask us to.
• Stripe — for billing.
• AWS — as our storage and bandwidth provider (S3, CloudTrail).
• Hetzner — as our compute provider (eu-central-1, Frankfurt).
• MongoDB Atlas — as our chat-log storage provider, same region.

We do not sell your data, do not share it with advertisers, and do not use it to train AI models.

Retention

• OAuth tokens: deleted within 24 hours of you signing out or revoking from Twitch.
• VoDs, chat logs, clips, renders: kept while your subscription is active; 30-day grace window after cancellation; permanent delete after that.
• HTTP/CloudTrail logs: 30 days.
• Billing records: retained for 7 years as required by tax law.

Your rights (GDPR)

You have the right to:

• Ask for a copy of the personal data we hold about you.
• Correct anything that is wrong.
• Have it deleted (subject to legal retention obligations on billing records).
• Export it in a machine-readable format.
• Object to processing.
• Lodge a complaint with your data protection authority.

To exercise any of these, email info@vod.ing from the address associated with your Voding account. We respond within 30 days.

Changes

If we make a material change to this policy we update the "Last updated" date at the top and, if the change reduces your protections, email you before it takes effect.