Privacy Policy

Last updated: 14 May 2026

Who runs Voding

Voding (the site at vod.ing) is an independently operated Twitch VoD editing tool. The data controller for the purposes of GDPR is the operator of vod.ing. Contact: [email protected].

What we collect

Account data (via Twitch OAuth)

When you sign in with Twitch, Voding receives your Twitch user ID, display name, profile image URL, and an OAuth token scoped to the permissions Twitch shows you at consent. Voding stores the OAuth token in our EU database with restricted access so it can read VoDs and chat on your behalf. You can revoke this at any time from your Twitch Connections settings; the next time you visit Voding the session is invalid and you are signed out.

Billing data (via Stripe)

Paid plans use Stripe. Voding stores your Stripe customer ID, your current plan, your subscription status, and the email address Stripe has on file for your account. Voding never receives or stores card numbers; those go directly to Stripe. Stripe's own privacy policy applies to the data they hold.

Content data (VoDs, chat, clips you create)

Each VoD you request is downloaded from Twitch to our object storage. The chat log for that VoD is downloaded once; the raw file lives in the same object storage and the individual messages are indexed in our Postgres database, which runs on our server in Germany (EU). Clips you create, chat overlays you render, and FCPXML exports you generate are stored in the same object storage. All content data is associated with your user ID and is not shared with any other Voding user.

Logs and usage metrics

HTTP logs (IP address, user agent, requested URL, response status, response time) are retained for 30 days for debugging and abuse prevention. We meter your storage and bandwidth with application-side counters in our own database.

Cookies

Voding uses a single cookie (authjs.session-token) to keep you signed in. It is first-party, HTTP-only, secure, and expires after 30 days. Two short-lived first-party cookies (voding.oauth.state, voding.oauth.terms) exist only during sign-in and are deleted immediately after. We do not use cookies for advertising. The only third-party cookies are Google Analytics' _ga / _ga_*, which load only after you opt in via the cookie banner (see Analytics below).

Analytics

With your consent, we use Google Analytics 4 to understand aggregate usage. It sets the _ga and _ga_* cookies. Analytics does not load until you accept in the cookie banner, and you can decline. We do not use analytics for advertising and do not sell your data.

Service providers (sub-processors)

We use these providers to run the service. They process data only on our instructions, never for their own purposes.

• Twitch: for OAuth and for fetching the public VoDs and chat you ask us to.
• Stripe: for billing.
• Hetzner: our web application and Postgres database host (Germany, EU).
• Plus infrastructure providers (cloud compute and object storage) acting strictly as processors.

We do not sell your data and do not use it to train AI models.

Retention

• OAuth tokens: deleted when you sign out, delete your account, or revoke access on Twitch.
• VoDs, chat logs, clips, renders: kept while your subscription is active; 15-day grace window after you delete content or your account; permanent delete after that.
• HTTP logs: 30 days.
• Billing records: retained for 7 years as required by tax law.

Your rights (GDPR)

You have the right to:

• Ask for a copy of the personal data we hold about you.
• Correct anything that is wrong.
• Have it deleted (subject to legal retention obligations on billing records).
• Export it in a machine-readable format.
• Object to processing.
• Lodge a complaint with your data protection authority.

To exercise any of these, email [email protected] from the address associated with your Voding account. We respond within 30 days.

Changes

If we make a material change to this policy we update the "Last updated" date at the top and, if the change reduces your protections, email you before it takes effect.