1. Who processes your data, and in what capacity
derush.tv is a tool that helps Twitch streamers and their teams go through their VODs, find the good moments and edit them into short clips. Running that service means processing personal data — yours, and sometimes other people's.
The controller for that processing is Vincent Brach; full details are in the legal notice. For anything concerning your data: [email protected].
2. What we process, and why
We collect nothing 'just in case'. Every row below matches an identified need of the service. The legal basis says what allows us to process it: contract (the service does not work without it), your consent (you may refuse, with no consequence), our legitimate interest (we have a serious reason, and you may object), or a legal obligation.
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Email address | Create and identify your account, send service messages (verification, password reset, billing) | Contract | Life of the account + 30 days |
| Password | Authenticate you. Stored hashed with bcrypt — we cannot read it | Contract | Life of the account |
| Two-factor authentication (secret and backup codes) | Protect your account if you turn the option on | Contract / Legitimate interest (security) | While the option is on |
| Twitch ID, username, avatar and follower count | Link your channel, show your profile, fetch your VODs and clips | Contract | Life of the account + 30 days |
| Twitch, Google and Discord access tokens | Act on your behalf with those services: read your VODs, sign you in, post your notifications | Contract | Until you disconnect that service, or delete your account |
| Sessions and connected devices | Keep you signed in and let you revoke an access | Contract | Session expiry + 30 days |
| Stripe customer and subscription IDs | Manage your paid subscription | Contract | Life of the account; accounting records: 10 years (legal obligation) |
| Notifications read or dismissed | So we don't show you an announcement you've already seen | Legitimate interest (usability) | Lifetime of the account |
| Welcome questionnaire answers (profile, how you work, goals, how you found us) | Tailor what the product puts up front to how you work, and understand how people discover us | Legitimate interest (service relevance) — optional questions, editable at any time | Lifetime of the account |
| Referral code: yours, and the one you may have entered | Know who told you about derush.tv. A code owner sees how many people used it, never who they are | Legitimate interest (tracking sign-up origin) — optional; once entered, a code cannot be changed | Lifetime of the account |
| Notes, segments, markers, folders, team messages | The core of the service: your review work | Contract | Life of the account; anonymised if you leave and the channel carries on |
| Availability and recurring unavailability (planning) | Coordinate your volunteer team | Contract | While you take part in the channel |
| Presence sessions and activity log on a channel | Let the team know who is working on what and organise the review | Legitimate interest (team coordination) | 12 months |
| Files imported into the Studio: video, images, audio, renders, thumbnails | Produce and export your edits | Contract (we act as processor for their content) | Life of the project, then deleted within minutes. Renders: 12 months. Imported files never attached to a project: 90 days |
| Transcripts and subtitles | Search the spoken content of your VODs, and generate subtitles for a Studio media | Contract | VOD transcript: 90 days, and deleted with the VOD. Studio media transcript: kept 90 days so it can be reapplied without recomputing. Subtitles placed in an edit follow that edit, like your texts and effects |
| IP address, browser header, requested pages | Run the site, detect abuse, diagnose outages | Legitimate interest (security and operations) | 90 days for access logs; application logs bounded by volume (about 100 MB per service) |
| Application error reports (account ID, technical trace) | Fix bugs | Legitimate interest | 30 to 90 days depending on the Sentry plan |
| Voice-over recording (microphone) | Record spoken commentary from your browser to edit into a video. The microphone is only opened when you explicitly ask for it, and the recording stays in your browser until you accept it: redoing or cancelling a take sends us nothing. Any transcription runs on our own infrastructure, with no sub-processor. | Contract | Lifetime of the editing project; 90 days if no project uses the media |
| Audience measurement (_ga cookies) | Understand which pages get visited | Consent — refusable, withdrawable at any time | 13 months |
We process no special category data within the meaning of Article 9 GDPR: no opinions, health, religion, orientation or biometrics. We do not collect your location, and never access your camera: the site explicitly blocks both at the browser level. The microphone is reachable only for the voice-over recording described above, and only once you have allowed it.
3. If you do not have an account with us
This section concerns you even if you have never visited derush.tv. It covers two situations: you are a viewer of a channel that uses our services, or you are a streamer yourself and you raided one of them. We owe it to you under Article 14 GDPR, which applies when data is collected somewhere other than from the person themselves.
When a Twitch channel uses derush.tv and goes live, our system joins its public chat room and records the messages written there. We keep: your Twitch username, your Twitch ID, your message content and its timestamp. If you suggest a moment through our Twitch extension, your username, your ID and the reason you type are also recorded.
Why: so the channel's team can find the highlights of a stream — a surge of messages, a chat reaction, a moment you flagged yourself. The legal basis is our legitimate interest, and the streamer's, in making use of the reactions of an audience speaking publicly on a public service.
If you are a streamer and you raided a channel that uses derush.tv, we record your Twitch username, your ID and the number of viewers you brought, with a timestamp. A raid is a public and deliberate act, announced in the chat of the channel you join: we reveal nothing that the act itself does not already make visible. This recording only happens if the receiving streamer enabled the feature, and it stops as soon as they turn it off.
If you subscribed, resubscribed, gifted subscriptions, started following a channel or sent bits during a live stream of a channel that uses derush.tv, and its streamer has expressly allowed derush.tv to receive these events, we record your Twitch username, the nature of the event, its tier or amount and its timestamp — never the text of your message. Polls, predictions and hype trains only carry totals, no individual vote or bet. These events are deleted 90 days after the stream.
Who receives them: the channel's team. If that channel enabled Discord notifications, your Twitch nickname and the reason you wrote are also posted in the Discord server it attached, and therefore pass through Discord (United States). This depends on a per-channel setting: it does not happen if the channel has not enabled it.
For how long: messages are deleted 90 days after the stream ends. What remains afterwards is aggregate statistics — a message count per minute — that identify nobody. Markers you suggest are kept for 12 months, or deleted with the VOD if that happens sooner.
Who can see it: only the review team of the channel concerned. One channel's data is never visible from another. The streamer can export their own channel's chat to a file.
Other people may appear in the content being processed: stream guests, voice-chat participants, people filmed in an imported video. That content is imported by our customers, who contractually undertake to hold the necessary rights. If you appear in a piece of content and want to act, write to us: we will pass it to the customer concerned and help you.
4. Who we share this data with
We sell no data and run no advertising. The only third parties that access data are technical providers acting on our instructions, under a processing agreement.
| Provider | What it receives | Why | Where |
|---|---|---|---|
| Hostinger | All service data: account, VODs, notes, captured chat, backups | Hosting the servers and the database | France |
| Stripe | Email, name, payment method, billing address | Collect subscription payments. We never see your card number | United States / Ireland |
| Cloudflare (R2 and CDN) | Videos, images, audio, renders, and the IP address of people viewing them | Store and deliver Studio files | Global network |
| Amazon Web Services (Remotion Lambda) | The content of your video compositions: media, text, subtitles | Compute the final render of your edits | Germany (eu-central-1) |
| Sentry | Account ID, technical error trace, URL | Detect and fix outages. Neither your email, nor your IP, nor your cookies are sent | United States or Germany depending on plan |
| Google (Analytics) | IP address, measurement ID, pages visited | Measure site traffic — only if you consent | United States |
| Google (reCAPTCHA) | IP address, interaction signals on the sign-in and sign-up pages | Prevent automated account creation | United States |
| Twitch, Google, Discord | Your access tokens, for the calls you ask us to make | Sign-in, reading your VODs, notifications | United States |
| Discord (channel notifications) | The Twitch nickname of whoever created a marker or a clip, and the reason they typed | Post the notification in the Discord server you attached to your channel. Only if you enabled those notifications | United States |
Transcription of your videos is done by a model running on our own servers. Your audio and video content is sent to no third-party AI provider and is used to train no model.
We may also disclose data where the law requires it, or in the event of a business transfer — in which case you would be told beforehand.
5. Transfers outside the European Union
Most of your data never leaves France. The servers, the database and the backups are hosted in France, by a provider established in the European Union: that hosting is not a transfer at all.
Some of the other providers above are established in the United States or run part of their infrastructure there. That is a transfer of data outside the European Economic Area, governed by Chapter V GDPR.
- Google LLC (Analytics, reCAPTCHA): entity certified under the EU-U.S. Data Privacy Framework, supplemented by standard contractual clauses.
- Stripe: standard contractual clauses.
- Sentry: standard contractual clauses; European hosting is available depending on the plan.
- Cloudflare: standard contractual clauses; the network is global by design.
- Discord: standard contractual clauses. Only concerns channels that enabled Discord notifications.
6. How long we keep your data
Durations are in the table in section 2. Three principles govern them.
- While your account exists, we keep what is needed for it to work. Accounts with no sign-in for 24 months are identified automatically, but their deletion is not yet automated: we will email you before switching it on. You can delete your account at any time from your settings, or ask us to.
- When you delete your account, the data identifying you is erased and the content you produced for a still-active channel is anonymised — it remains useful to the team, but is no longer linked to you.
- Some data cannot be erased on request: the accounting records tied to your payments, which French law requires us to keep for ten years. We isolate them from the rest and make no other use of them.
Our database backups are encrypted and kept on a 30-day rotation. Data you have had deleted may therefore survive in a backup until it expires. Those backups are not used in production; if a restore were to happen, the deletion would be reapplied.
7. Your rights
You can access your data, correct it, have it erased, obtain a usable copy, ask for a processing operation to be restricted, object to processing based on our legitimate interest, and withdraw at any time a consent you have given.
- Delete your account: Settings > Privacy > Delete my account.
- Export your data as JSON: Settings > Privacy > Export my data.
- Audience measurement: the 'Manage cookies' button at the bottom of every page.
- Everything else: [email protected].
We respond within one month. If our answer does not satisfy you, you can complain to the CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — at cnil.fr.
8. How we protect this data
- All traffic with the site is encrypted (HTTPS, with HSTS).
- Passwords are hashed with bcrypt: even if the database leaked, they would not be readable.
- Session tokens live in cookies that JavaScript cannot read, and refresh tokens are never stored in clear text.
- Access to a channel's data is controlled by a role-based permission system: a team member only sees the channel they belong to.
- Imported files are quarantined first, validated, and only then made available.
- Metadata in imported images (GPS location, device model, date, author) is stripped during processing: it is neither stored nor published with the video.
- Twitch, Google and Discord access tokens, and two-factor secrets, are encrypted in the database (AES-256-GCM): reading the database is not enough to use them.
- Our databases and processing queues are not exposed to the internet.
No system is invulnerable. In the event of a data breach posing a risk to your rights, we notify the CNIL within 72 hours and tell you directly if the risk is high.
10. Artificial intelligence
derush.tv uses automated processing to help you spot good moments: speech transcription, silence and volume-peak detection, and detection of chat surges.
Transcription is performed by a model running on our own servers. Your content is sent to no external AI provider and is used to train no model, ours or anyone else's.
These processes produce suggestions, never decisions. Nothing is done automatically on your behalf, and no decision producing legal effects concerning you is taken on that basis.
11. Minors
derush.tv is not intended for people under 15 and we do not knowingly collect their data. If you hold parental authority and believe your child has created an account, write to [email protected]: we will delete the account and the associated data.
12. Changes to this policy
We update this page when our processing changes. The last-updated date is at the top. If the change concerns trackers subject to consent, your previous choice stops being valid and we ask you again.
13. Contact us
For any question about this document or about how your data is processed: [email protected].
Exercise your rights - Cookie policy - Legal notice - Terms of service