Privacy Policy

Whalecuts is a personal project operated by Travis Worthing (“we”, “us”), based in British Columbia, Canada. It lets a creator archive and search publicly available Twitch VODs — their own and other creators’ — transcribe them, assemble clips, render them to video, and — optionally — publish those renders to their own connected YouTube and TikTok accounts. This policy explains what data the service handles and the choices you have. Questions or requests: worthingtravis@gmail.com.

We only collect what the service needs to function:

• Twitch identity. When you sign in with Twitch, we receive your Twitch user ID, login, display name, and profile image so we can identify your account. We never receive or store your Twitch password.
• Content you create here. Transcripts of the VODs you archive, the clips and lists you build, render settings, and the rendered video files those produce.
• Connected-platform credentials. If you connect YouTube or TikTok, we store the access/refresh tokens those platforms issue so we can act on your behalf when you ask us to. See “Connected platforms” below for exactly what each grants.
• Operational data. Session cookies that keep you signed in, short-lived cross-site-request-forgery (CSRF) cookies during a connect flow, and standard server/request logs.

Connecting a platform is entirely optional and only happens when you click “Connect” and approve the permissions on that platform’s own consent screen. You can disconnect at any time (see “Your choices”).

TikTok. We request access to your basic TikTok profile — your nickname, avatar, and an opaque account identifier — which we show back to you so you can confirm you’re posting to the right account, and the ability to publish a video you have rendered here to your own TikTok account when you explicitly choose to. When you publish, TikTok pulls the rendered file directly from our content-delivery URL — we do not upload or hand TikTok any data beyond that link and the post settings you select (caption, privacy level, and the interaction/disclosure options you set). We keep a record of each publish (the privacy level you chose, the resulting post ID, and its status).

YouTube. If you connect YouTube, we store a credential that lets us upload a render you create here to your own YouTube channel when you ask, and we keep a record of the resulting video. Our use of YouTube data is also governed by the Google Privacy Policy; you can review or revoke our access at your Google security settings.

Platform access and refresh tokens are encrypted at rest with AES-256-GCM before they are written to our database, and decrypted only in memory at the moment we make an authorized call on your behalf. TikTok rotates its refresh token on each use; we persist the rotated value and never retain your platform password. Rendered video files are stored in cloud object storage so that you (and, for a publish, the destination platform) can fetch them.

We do not sell your data or use it for advertising. We share data only with the platforms you connect and the infrastructure providers that run the service:

• Twitch — sign-in and reading the VODs/metadata you archive.
• YouTube / Google and TikTok — only when you connect them and only to perform the actions you request.
• Hosting & data — application hosting (Vercel), database (Neon), cache (Upstash), and cloud rendering/object storage (Amazon Web Services). These process data on our behalf to operate the service.

We may also disclose data where required by law, or to protect the rights, safety, or property of our users or the service.

Disconnect a platform. You can disconnect YouTube or TikTok from the app’s settings at any time, which deletes the stored credential for that platform. You can also revoke our access directly from your TikTok connected-apps settings or your Google security settings.

Delete your data. To request deletion of your account and the content associated with it, email worthingtravis@gmail.com and we will action it within a reasonable period. Disconnecting a platform does not delete content already published on that platform — manage that from the platform itself.

We keep your data for as long as your account is active or as needed to provide the service. Credentials are removed when you disconnect a platform; account content is removed on a deletion request, subject to any retention required by law.

The service is not directed to children and is intended for users who meet the minimum age required by the platforms they connect.

We may update this policy as the service evolves. Material changes will be reflected by a new effective date at the top of this page.

Questions, privacy requests, or deletion requests: worthingtravis@gmail.com.