1. Scope
This page describes the security measures actually implemented in StreamCalc. It covers the manual calculator (which handles no server-side personal data) and the optional Twitch connection. We describe what is implemented, not absolute guarantees — no online service can promise perfect security, and this page deliberately avoids claims we cannot verify.
2. Data in transit
- The app is served over HTTPS from the hosting platform.
- Requests to Twitch's API and to exchange-rate services are made over HTTPS from the server or browser as appropriate.
- Your manually entered calculator figures are not transmitted at all (see the Privacy Policy, section 2).
3. Twitch OAuth security
- Authorization Code flow with server-side exchange. The Twitch client secret never reaches the browser; the code-for-token exchange happens on the server.
- CSRF/state protection. Each connection attempt creates a one-time, short-lived state value. The callback consumes it atomically before exchanging the code, which rejects replayed or forged callbacks.
- Redirect validation. The OAuth redirect URL is validated against a strict configured value before use.
- Minimal scopes. The app requests only the scopes needed for identity, reading the broadcaster's current subscriptions (Affiliate/Partner only), and the Bits leaderboard.
- Safe error handling. The OAuth callback redirects only with short, fixed status codes; raw provider error details are never shown in the browser or written to logs.
4. Token storage
- Access and refresh tokens are encrypted (AES-GCM) before being stored in the server-side database. The encryption key lives in a server-side environment secret and is never exposed to the browser.
- Tokens are never placed in browser localStorage/sessionStorage by the Twitch feature, in URLs, or in client-visible errors.
- Access is restricted per user: database row-level security rules allow each signed-in user to read and modify only their own connection and imported data.
- Token refresh happens server-side; expired or revoked tokens produce a readable status rather than a broken state.
5. Access control
- The Twitch connection feature requires a signed-in account. The identity used for Twitch data reads is the channel linked through OAuth — never an arbitrary user-supplied channel ID.
- Imported figures are never written into your calculator automatically; they require your explicit confirmation (see the Legal Disclaimer & Terms).
6. What we do not claim
- No claim of formal security certifications (such as SOC 2 or ISO 27001).
- No guarantee against all breaches, misconfigurations, or third-party (hosting, Twitch, rate-service) failures.
- No promise of specific backup, retention, or recovery capabilities for stored data.
- No claim that the app has undergone an independent security audit.
7. Your responsibilities
- Keep your sign-in credentials for the hosting platform's authentication secure.
- Use "Disconnect" if you no longer want StreamCalc to hold a Twitch token — this revokes access and deletes stored data.
- Do not share screenshots or copy-estimates containing data you consider sensitive; the copy feature places estimates on your clipboard at your request.
8. Reporting a vulnerability
If you believe you have found a security issue, please report it privately rather than publicly:NeonPulse.GG.Gaming@gmail.comWe will review reports in good faith and credit reporters where appropriate, with your consent.