Privacy Policy

What we receive

• Discord sign-in: your Discord user ID, username and avatar (the “identify” information). We don't receive your email, password or servers.
• Guest sign-in: only the display name you type.
• Your profile edits: the display name and avatar you choose on the account page.

Where it is kept

• Your sign-in lives in an encrypted session cookie in your browser. It isn't stored in a database.
• Rooms are kept in the server's memory only: members, chat messages, the stream list and queue, and moderation state. They are removed when the room ends and when the service restarts.
• The operator can see, live, which rooms exist and who is in them (display name, whether signed in with Discord, room name and whether it has a password). The operator cannot see chat messages, passwords or voice. The operator can also close a room or remove a person from it. This view is not stored. The server's logs record only that an admin looked, with a shortened IP address, and hosting logs are kept by Railway for a limited time.
• Voice and screen shares are relayed live through LiveKit and are not recorded.
• Torrents and video links work through your own Stremio app. A magnet, its torrent hash, file name, size and length are shared with the room, so friends who have Stremio can play the same torrent themselves; trackers that point at private or local addresses are dropped. A video link you paste is never sent to us or the room: only a random id, the name, size and length are. It stays in this browser tab (session storage) so a refresh keeps working, and is gone when you close the tab. Your Stremio address and the Chrome permission to reach it stay in your browser. When friends watch through a live feed, your browser sends them the picture and sound through LiveKit, relayed like a screen share and not recorded.
• Video files you add from your own device are never uploaded or stored. The room sees the file's name, size and length and a short fingerprint (a hash of a few small slices) used to check that two people have the same file. If friends without the file are watching, your browser sends them a live picture and sound through LiveKit, relayed the same way as a screen share and not recorded. On Chrome and Edge the browser can remember which file you picked (a reference kept in your browser, never sent to us) so it can reopen after a refresh; you can clear these on your account page.
• Preferences such as volume, captions, fit or fill and your TV output choice are saved in your browser's local storage and never sent to us.

Third parties

• Discord handles sign-in under its own privacy policy.
• YouTube and Twitch players are embedded and may set their own cookies and collect data under their policies.
• The app is hosted on Railway, and voice and screen sharing run through LiveKit.
• We don't run analytics or advertising and don't sell data.

Your choices

• Change your display name and avatar, or sign out, from the account page.
• Delete your account from the account page (while you're not in a room). This signs you out and removes your profile and your membership records from rooms. Because there is no database, there is nothing else to erase; signing in again with Discord simply starts fresh.
• You can also remove the app's access from Discord under User Settings, Authorized Apps.

Children

The app isn't directed at children under 13, and you must meet Discord's minimum age to sign in with it.

Changes and contact

We'll update the date above when this policy changes. Questions or requests: open an issue at github.com/dsameendra/nexus-lounge.