Live Lobby · version 2026-10-03 · updated 2026-10-11

Privacy Policy

This Privacy Policy explains what Simplified Security Solutions LLC ("Live Lobby", "we", "us") collects when you use Live Lobby, why, who can see it, how long we keep it, and how to have it deleted. Live Lobby is a control room for live shows that bring viewers on stage: debates, panel shows and interviews streamed on Twitch or YouTube. This policy covers our website at staging.livelobby.io, the desks we run for each show (the control panel, the join page, the green room and the overlay), the desktop edition, and our connections to Twitch, YouTube and X. It applies to account holders and their crew, to guests who join a show, to viewers whose live chat a desk reads, and to visitors to staging.livelobby.io.

Who we are and what this covers

Live Lobby is operated by Simplified Security Solutions LLC, in the United States. You can reach us at support@livelobby.io; reports of abuse go to abuse@livelobby.io.

Each desk is run by its owner, who decides who comes on the show, who is put on stage and what is said; the owner's crew of directors and moderators act for them. We provide the service and keep the records this policy describes. If you are a guest or a viewer, you can write to us directly about anything here, and you can also contact the show's host.

What we collect

• Your account: your name, your email address and your password (stored only as a scrypt hash); your two-factor secret (encrypted) and recovery codes (hashed); when you last signed in; and which version of our Terms and policies you accepted, when, and from which IP address.
• Billing: your plan, the status and dates of your subscription, and the IDs of your customer record and subscription at Stripe, our payment provider. Stripe collects your card and billing details on its own pages; card numbers never reach us.
• Desks and shows: each desk's settings, its queue and seats, the show's motion, the names guests use, what a viewer types after !debate, the cues sent to guests, and the desk's audit trail: a record of what happened on the desk (who joined, was seated, muted or removed, by whom, and when), with the IP address of the person acting.
• Guests: the name you give, or the identity you prove (a Twitch username, a YouTube channel ID and name, or an X handle); your place in the queue or on stage; and your IP address. Before your camera starts you agree to the show's notice and rules, and the desk records that agreement: the time, the name you used, your IP address, your browser and the version of the notice.
• Video and audio: on a desk using peer-to-peer video (the default, on every plan), cameras and microphones go directly between the browsers of the people on the show. Our relay carries them only when a direct connection is not possible or the host has chosen to hide guests' IP addresses from each other, and it does not keep them. On a desk using Live Lobby media servers (the Studio plan), video and audio pass through our servers and are recorded, as below.
• Recordings: on desks using Live Lobby media servers, each participant's camera and microphone, recorded as separate files, with the participant's name, the times and a checksum; and a log of every time a recording is opened (by whom, when and from which IP address). Chat is not part of a recording. Peer-to-peer shows are not recorded by us.
• Reports: when someone on a show presses Report, or writes to us about a show: who reported, what or whom it was about, what they wrote, their IP address, and a copy of the desk's recent audit trail, consent records and seats at that moment.
• Support requests: when you ask us for help, from your account or with the form on our site: your name and email address, what you write and what we answer, which desk it is about if you say, when, and the IP address it was sent from. We email you a receipt and each of our answers, and our support mailbox is told that a request is waiting (its number and topic, not what you wrote). If you write to our support or abuse address, or reply to one of our emails, that email reaches our mailbox.
• Connected platforms: what we receive from Twitch, YouTube and X, and what we do with it, is set out in their own sections below.
• The desktop edition: when a desktop desk checks its licence, about once an hour, we note when, from which IP address, and which version, and we keep the random number the app made when it was installed, which ties its desk key to that computer. For a day, and only in memory, we also note which IP addresses use a desk key for our media servers, to notice one key used in two places at once. If you press Send logs, or the app fails to start and sends its report, we receive its recent logs with your email address and IP address.
• Technical: the IP address, browser and pages of each request to our servers, and error reports, which our servers log as they run.
• Email addresses from our old home page: an earlier version of our home page asked for an email address before it showed our plans and prices. It no longer does, and the address its form sent to now keeps nothing and sets no cookie. Addresses given then are kept until you ask us to remove them, and are used only to write to you about Live Lobby.

YouTube and Google user data

Live Lobby uses YouTube API Services. This section is about Google user data: what we receive from Google's APIs when the owner or a director of a desk connects a YouTube channel, and what a desk then reads from YouTube. If you connect a channel, the Google Privacy Policy also applies, to what Google does with your information, and you agree to the YouTube Terms of Service. Everything here applies to Google user data ahead of the general sections of this policy, and nothing in those sections widens what we do with it.

Who signs in with Google, and the one permission we ask for

• Only a desk's owner or director signs in with Google, by pressing Connect YouTube on the desk page, in the control panel, or on the Desktop page for the desktop edition. Viewers and guests never sign in with Google: a YouTube viewer who wants to join proves who they are by posting, in your live chat, the short code their join page shows them.
• We ask for one permission (OAuth scope): https://www.googleapis.com/auth/youtube.force-ssl, which lets an app manage a YouTube account. We ask for it because it is the narrowest permission that lets your desk read your live chat and also post in it and remove messages and people from it; read-only access can do the first and none of the rest. If you untick it on Google's page, the connection is refused and nothing is kept.

What we access

• Your channel: its ID and title, when you connect and at least once a day while you stay connected; with them, the access and renewal tokens Google issues and the permissions Google says you granted.
• Your live broadcast: while your control panel, host stage or overlay is open, whether your own channel has a live broadcast, and that broadcast's title and live chat ID.
• Its live chat: while that broadcast is live, its chat messages: for each one, its text, when it was sent, its author's channel ID and display name, and whether the author is the channel's owner, a moderator, a channel member or verified; and the chat's own notices, such as a message deleted or a viewer banned.

How we use it

• To put viewers who type !debate (or the join command you set) in your queue, and to match the codes guests post in chat to the right guest.
• To post one short message in your live chat, at most once every 15 minutes, when a viewer asks with !join, when you open the queue, or on the reminder schedule you choose: how to join ("To join the debate, open your join address and type the code it shows you here in chat."), or, while your queue is closed, that it is closed ("The debate queue is closed at the moment.").
• To time out or ban someone in your live chat, or delete a message the desk read there, only when you or your crew press the button.
• To show you and your crew which channel is connected, what is being said in chat and who has joined; and to show the YouTube display name of a viewer you put on stage on your overlay, which your audience sees.
• Nothing else. We do not upload, edit or delete videos; we do not create or change broadcasts, streams, playlists or channel settings; we do not read comments, subscribers, analytics, your email address or your Google profile; and we read no chat but your own live broadcast's.

Limited Use

Live Lobby's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide the features described above, which you can see working in Live Lobby.
• We do not sell it, and we do not use or transfer it for advertising, including personalised, retargeted or interest-based advertising.
• We do not use it to decide anyone's creditworthiness or for lending, and we do not transfer it to data brokers or information resellers.
• We do not use it to develop, improve or train artificial intelligence or machine learning models, our own or anyone else's.
• We transfer it to others only as needed to provide those features (to your desk, and to the service providers that host and operate the Service for us, named in "Who sees it"), for security purposes such as investigating abuse, to comply with the law, or as part of a merger, acquisition or sale of our business, with notice to you.
• Our staff do not read it, except with your agreement for specific data (for example a report sent from your show, below), when it is necessary for security purposes such as investigating abuse or stopping a desk that misuses YouTube, to comply with the law, or once it has been aggregated and anonymised for our internal operations. Our administrators can see the title of the channel a desk is connected to, so that they can disconnect it if it is misused.

Where it is kept, who sees it, and how it is protected

• On our platform: your channel's ID and title, the access and renewal tokens, when they expire and the permissions granted, in our database on our servers in the United States. The renewal token stays on our platform and never reaches your desk, which only ever holds a short-lived access token (it expires within the hour): a hosted desk keeps it in a vault encrypted with a key held outside the desk's storage, and a desktop desk holds it on your own computer. Google user data travels only over encrypted connections.
• On your desk: you and your crew see your channel's name, your broadcast's title, its chat and the names of viewers who take part; your guests see the chat too if you mirror it to their green room. The names and channel IDs of viewers who join your queue or are moderated appear in that show's audit trail on your desk, as do your channel's name and your broadcasts' titles, and your desk deletes those entries after 30 days (while a hosted desk is stopped, we run that deletion for it every day; a desktop desk that is not running deletes them when it next starts). In a guest's consent record, a YouTube name and channel ID are deleted after 30 days with the record itself; if a legal hold keeps the record longer, the name and channel ID are blanked at 30 days all the same. A viewer who joins from YouTube chat is kept in your desk's saved show, in the queue or in a seat, by their display name and channel ID, until they leave or are removed, and is taken out of it after 30 days; what they typed after !debate is shown to your crew and not saved. If your crew blocks a YouTube viewer from your desk, the block keeps their channel ID and display name, with the reason your crew gave, for as long as it lasts, at most 30 days, so that it works. Other chat is used as it arrives and not stored: the desk holds the most recent lines in memory, for your crew and your green room, and never writes them down.
• Reports: when someone on your show reports a problem - you, your crew or a guest - the report sends us the recent entries of your desk's audit trail, YouTube names and channel IDs included. That copy is kept with the report as the record of the case and deleted 2 days after the case is closed, unless a legal hold keeps it longer. The report itself, which may name the viewer it is about, is kept as the record of the case, as "How long we keep it" says; 2 days after the case is closed, the YouTube names and channel IDs in what was reported (every channel ID, and every name of three or more characters your desk's records show came from YouTube) are replaced with a one-way code, unless a legal hold keeps them.
• Nobody else: we share YouTube data with nobody else, except the service providers that host and operate the Service for us and the authorities described in "Who sees it".

How long we keep it, and deleting it

• Keeping it current: while you are connected we read your channel's ID and title from YouTube again at least once a day, and we delete the tokens and channel details we keep for a connection that we have not been able to refresh within 30 days.
• Disconnect: Disconnect on your desk page (or on the Desktop page, for the desktop edition) deletes the tokens and channel details we keep for that desk at once, and revokes Live Lobby's access at Google - unless another desk here is still connected to the same channel, since Google would end that connection too; the access is revoked when the last of them disconnects. It also has your desk delete everything it keeps from YouTube, whatever its age: the YouTube names and channel IDs in its audit trail and consent records, the YouTube viewers in its saved show, and its blocks of YouTube viewers. A desk that is running deletes them at once. A hosted desk that is stopped, or not answering, has them deleted by us within 7 days; a desktop desk that is not running deletes them when it next starts. Deleting the desk or closing your account does the same, and deletes the desk's storage with it.
• Revoking at Google: you can also revoke Live Lobby's access yourself at any time from your Google Account, at security.google.com/settings/security/permissions. We notice at the next renewal, normally within the hour, and then delete what we kept for it and have your desk delete what it keeps, as for a Disconnect - and in every case within 30 days of the revocation.
• Asking us: write to support@livelobby.io to have the YouTube data we hold about you deleted, whether you connected a channel or were a viewer in one's chat, and we delete it within 7 days. Copies in our nightly backups are deleted within 7 days of being made. Deleting data from Live Lobby does not delete anything YouTube stores; to delete data held by YouTube, use YouTube and your Google Account.

Twitch

If you connect a Twitch account to a desk, or sign in with Twitch on a join page, Twitch's Privacy Notice also applies, to what Twitch does with your information.

• If you connect Twitch to a desk: we keep your Twitch username and user ID, the access and renewal tokens Twitch issues, the permissions you granted, and the list of channels you moderate. We ask Twitch for permission to read and send chat (chat:read, chat:edit, user:write:chat), to send whispers (user:manage:whispers), to time out and ban (moderator:manage:banned_users), to change chat settings and Shield Mode for Storm mode (moderator:manage:chat_settings, moderator:manage:shield_mode), and to see which channels you moderate (user:read:moderated_channels), so that a desk can read only your own channel or one you moderate.
• How the desk uses it: it reads your channel's chat for !debate and the other join commands; whispers each guest their private stage link, or, if Twitch will not deliver the whisper, posts a line in chat pointing them to your join page; posts reminders of how to join; and times people out, bans them and runs Storm mode when you or your crew press those buttons.
• Your viewers: chat is used as it arrives. The desk holds the most recent lines in memory, for your crew and your green room, and does not write chat down, except that what a viewer types after !debate is saved with their place in your queue until they leave or are removed. A viewer who joins or is moderated appears in your desk's audit trail by their Twitch username.
• Sign in with Twitch, on a join page: we ask Twitch for no permissions. We learn your Twitch user ID, username and display name, pass them to that desk once, and revoke the sign-in at Twitch straight away. Our records note which Twitch username signed in on which desk; after 2 days the username in that note is replaced with a one-way code.
• Where it is kept: the renewal token stays on our platform and never reaches your desk, which receives access tokens that expire. While you are connected we renew them automatically.
• Taking the access back: Disconnect on your desk page (or on the Desktop page, for the desktop edition) deletes the tokens and details we keep for that desk at once, and tells your desk. Deleting the desk, revoking a desktop desk key or closing your account does the same. Disconnecting does not withdraw Live Lobby's access at Twitch itself: to do that as well, open Connections in your Twitch settings and disconnect Live Lobby there.

X

If you connect an X account to a desk, or sign in with X on a join page, X's Privacy Policy also applies, to what X does with your information. This section says what we take from X, what we do with it, and when it is gone. This platform does not connect X accounts to desks, or offer Sign in with X, at present. What follows is what happens when it does. Post on X, which only opens X's own page with your join link filled in, sends us nothing.

• If you connect X to a desk: we keep your X account's ID, @handle, name, the address of its profile picture and whether it is protected; the access and renewal tokens X issues for the permissions you grant, and which permissions X says you granted; the IDs of the subscriptions we hold at X so that it tells us about your account; and, for each day, how many mentions of your account X delivered and how many replies your desk sent.
• Your viewers, while you are connected: when someone chats in your live broadcast on X, or posts @mentioning your account, X sends us the message or post, its ID, and its author's X ID, @handle, name and picture. We pass it straight to your desk and do not store it: it is held in memory until it is delivered, a few seconds at most, and a mention's ID and author for up to a day so your desk can reply to it once. A viewer who joins your queue from X, or is moderated, is identified on your desk by their @handle and X ID, which appear in that show's audit trail on your desk like any guest's name, for as long as "How long we keep it" says for a desk's audit trail.
• If you sign in with X on a join page: we ask X only who you are - your X ID, @handle, name and picture - and use it once, to tell that desk; then we revoke the permission at X. We keep nothing about you: our records note that someone signed in with X on that desk, and not who. The desk shows your @handle, your picture and X's logo beside your place in its queue.
• How we use it: to show which account is connected, to put viewers who type !debate in your chat or in a post mentioning you in your queue, and to do on X what you and your crew choose. We do not use X data for advertising, and we do not sell it or share it with anyone but the service providers and authorities described in "Who sees it".
• Where it is kept: the tokens stay on our platform and never reach your desk: every request to X is made by the platform. You and your crew see your account's name and picture, and your viewers' messages, on your desk.
• Keeping it current: while you are connected we read your account's @handle, name and picture from X again at least once a day - except while we have switched X off for everyone, or your desk is stopped, when we only renew the tokens - and we delete the tokens and account details we keep for a connection we have not been able to refresh within 30 days, a pause or a stopped desk included. The daily counts are deleted after three days.
• Taking the access back: Disconnect on your desk page deletes the tokens and account details we keep for that desk at once, deletes our subscriptions for your account at X, revokes Live Lobby's access at X, and tells your desk to let go. Deleting the desk or closing your account does the same. Connecting the same X account to another desk moves it there, since X allows one connection per account. You can also revoke the access yourself at any time on X, at x.com/settings/connected_apps: we delete the tokens as soon as X tells us or refuses a renewal (within two hours), and your account's details within 30 days unless you connect again.

How we use it

• To run the Service: to put guests in queues and on stage, draw overlays, carry video, connect the platforms you choose, and provide the features you use.
• To keep shows safe and enforce the Acceptable Use Policy: the audit trail, consent records, reports and recordings exist so that a threat, abuse or a crime can be reviewed and acted on.
• To secure the Service: to detect and stop abuse, automated sign-ups and attacks. Cloudflare Turnstile, a check that a visitor is a person, runs on sign-up, checkout, password reset and the support form for this.
• To bill you, support you, and tell you what you need to know about your account and your desks.
• To comply with the law: to answer valid legal process, to report child sexual abuse material as the law requires, and to preserve evidence.
• We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it for advertising of any kind. We make no decisions about anyone by automated means that have legal or similarly significant effects.
• Our legal bases, where the GDPR or the UK GDPR applies: performing our contract with you; our legitimate interests in running a safe and secure service; complying with our legal obligations; and your consent where we ask for it, as when a guest agrees to the recording notice or you connect an account.

Who sees it

• The desk's owner and crew see their own desk: the queue, the seats, the chat it reads and its audit trail. Owners and directors can open their desk's recordings; moderators cannot.
• Guests on a show see the host and the others on stage, their own place in the queue, and the stream's chat if the host mirrors it to the green room. With peer-to-peer video, the people on a show can learn each other's IP addresses, which direct connections need, unless the host turns on hiding them.
• The show's audience sees what the host broadcasts: the overlay shows the video and the names of the people on stage.
• Our staff see what they need to run the Service, support you, handle reports and keep it safe. Every opening of a recording is logged. For YouTube data the narrower rules in its own section apply.
• Service providers that process data for us, only to provide the Service: a US hosting provider, whose servers in the United States run our platform, the desks and the media servers; Cloudflare, which carries all traffic to our sites (and so sees IP addresses and requests), protects them from attacks, runs Turnstile, stores recordings, connects guests to desktop desks, and passes email sent to our support and abuse addresses on to our mailbox; Stripe, which takes payments and receives your email address, name, account ID and plan (Stripe's Privacy Policy); Resend, which sends our emails (password resets and welcome links, the link back to your account after a checkout, what became of a payment we refund, crew notices, notes about changes to your account, warnings about attempts to sign in to your account, and support receipts and answers) and so receives your name and email address, the names of the desks and people those emails mention, and what they say, including the text of our support answers; and Anthropic, whose AI tools we use to run the Service: at our direction, and only to operate, maintain and fix it, they may read our server logs, our records of what happens on the platform and our database, which hold the information this policy describes. Anthropic handles what they read under its commercial terms, which do not allow it to train its models on it.
• Independent services that you or your show use, which handle data under their own policies: Twitch, YouTube (Google) and X, when you connect them or sign in with them; VDO.Ninja, which sets up peer-to-peer video connections and receives the room and stream names (random, labelled Guest or Host, never a name) and IP addresses; Google Fonts, from which a desk's own pages (its control panel, stage, microphone page and overlay) load their typefaces, so Google receives your IP address and browser details when one of those pages loads them (our website at staging.livelobby.io serves its typefaces itself); and the image servers of Twitch and X, when a page shows a chat emote or a profile picture.
• Law enforcement and courts, as described in the Law Enforcement Guidelines, and the National Center for Missing & Exploited Children where the law requires.
• A buyer or successor, if Live Lobby is sold or merged, who must keep to this policy for what we hold.

Cookies and storage on your device

We use cookies and your browser's storage only for what the Service needs to work. We use no advertising or analytics cookies, and our pages load no trackers.

Our guest pages set no cookies of their own. In your browser's storage, the join page and green room keep your stage pass and seat (so that a reload puts you straight back), the name you typed, your sound preference and, if you signed in with X, your handle, name and picture address; the control panel and host stage keep your crew name and display preferences (and, if you sign in with a desk code instead of your account, that code); the overlay keeps a note that it has just reloaded. None of it leaves your browser except to the desk it belongs to, and you can clear it at any time in your browser's settings.

How long we keep it

Deleting it, and your rights

• Your Account page lets you change your name and password, manage two-factor and your subscription, sign out other devices, and close your account.
• Disconnect Twitch, YouTube or X on your desk page (or the Desktop page) to delete what we keep for that connection, as their sections describe.
• Deleting a desk deletes its storage (settings, saved show, audit trail, consent records and token vault), its recordings unless they are held, and its connections. A desk whose records are under a legal hold cannot be deleted until the hold is lifted.
• Closing your account cancels your subscription, deletes your desks and everything recorded in them (a desk under a legal hold keeps its storage, out of use, until the hold is lifted), revokes your desktop desk keys and their connections, signs you out everywhere and stops you signing in. Ninety days later your name, email address, password and two-factor details are erased, and your customer record at Stripe is deleted; the invoices and payment records Stripe keeps for us still carry the name and email address on them, because the law requires us to keep them.
• To see, correct, export or delete the information we hold about you, or to object to a use of it, write to support@livelobby.io. We answer within 30 days, and delete YouTube data within 7 days of your request. Something under a legal hold cannot be deleted until the hold ends. If you were a guest or a viewer on a show, tell us which show and when, and we will tell you what we hold about you and delete what the law allows.
• California residents have the rights described in the CCPA, including to know, to delete, to correct and not to be discriminated against for exercising them; we do not sell or share personal information as the CCPA defines it. Residents of the EU, the EEA and the UK have the rights in the GDPR, including access, rectification, erasure, restriction, portability and objection, and may complain to their supervisory authority. To exercise any of these rights, write to support@livelobby.io.

Security

• Every connection to our sites and desks is encrypted (TLS), and so are our connections to Twitch, Google, X and Stripe.
• Passwords are hashed with scrypt; two-factor secrets are encrypted (AES-256-GCM); recovery codes, password-reset links and desk keys are stored only as hashes.
• Each hosted desk runs in its own isolated container, on a separate domain from your account, with a read-only system and no extra privileges. A hosted desk keeps its tokens in an encrypted vault (AES-256-GCM) whose key is held outside the desk's storage.
• The renewal tokens for Twitch, YouTube and X stay on our platform; a desk receives at most an access token that expires.
• Sign-in cookies are host-only, Secure and HttpOnly, and forms are protected against cross-site requests. Administrative access is limited to named staff accounts, and every opening of a recording is logged.
• No system is perfectly secure. If a breach affects you, we will tell you as the law requires.

Where it is processed

Our servers are in the United States, and Cloudflare carries our traffic through its worldwide network. If you use Live Lobby from outside the United States, your information is transferred to and processed in the United States, whose data protection laws may differ from those where you live.

Children

The Service is for adults: account holders, crew and guests must be 18 or older. We do not knowingly collect information from anyone under 18, and we delete it when we learn of it. A desk reads its stream's public live chat, which anyone may write in; it uses those messages as they arrive and keeps them only as each platform's section says.

Changes and contact

The updated date at the top changes whenever this policy's words do. When it changes materially, its version date changes too, and you will be asked to accept it at your next sign-in. If we change what we do with Google user data, we will ask for your consent before we do it. Questions, requests and complaints: support@livelobby.io. Version 2026-10-03; updated 2026-10-11.

See also: Terms · Rules · EULA · Law enforcement.