Last updated 30 October 2026
The short version
- We store the minimum needed to run drills for your channel: your Twitch profile, encrypted Twitch tokens, a 7-day chat log and your drill results.
- The chat log is used for one thing: checking that a new blocked term won’t ban your regulars. It is never shown on stream, never sold and never used to train AI models.
- We don’t run ads or third-party analytics, and we don’t sell data.
- You can delete the chat log at any time, pause logging, or delete everything by signing out.
Who we are
ModScrim is run by Harsh Bhanushali and Dhairya Patel (“we”). It is an independent project and is not affiliated with or endorsed by Twitch. This policy covers the ModScrim website and app, including the streamer console, the mod view, the OBS overlay and demo rooms.
What we collect
If you sign in as a streamer
- Twitch profile: your Twitch user ID, login, display name, avatar link and broadcaster type (partner, affiliate or neither). We use the broadcaster type to respect Twitch’s grading limits for your channel.
- Twitch tokens: the access and refresh tokens Twitch issues when you approve ModScrim, and the permissions you granted. They are encrypted before storage and never sent to a browser.
- Your channel’s filters: your public blocked terms and AutoMod levels, read from Twitch and cached so the console can show them.
- Chat log: messages posted in your channel’s chat while logging is on. For each message we keep the message ID, the chatter’s user ID and login, the text, a tokenised copy of the text used for matching, and the time. We skip messages that arrive through shared chat from other channels.
- Drill data: the settings you choose, the generated lines, every mod action with its time, scores, grades from Twitch or the local matcher, proposed, rejected and pushed terms, fresh-wave results and the after-action report.
- Audit log: a record of pushes, undos, sign-ins, sign-outs, revocations, chat-log deletions and overlay key changes, with the time and who did it.
If you join a drill as a mod
- The display name you type, your actions and their times, and your scores. If you sign in with Twitch instead of typing a name, we use your Twitch user ID to confirm you moderate the channel, then discard the token.
- A participant token kept in your browser’s session storage so you can reconnect after a refresh.
If you use a demo room
Demo rooms use a sample channel and never call Twitch. We keep what you do in the room until it deletes itself two hours after its last activity.
From every visitor
To stop abuse we count join attempts and demo-room creations per IP address for a short time (see How long we keep it). Our hosting provider, Cloudflare, processes IP addresses and request details to deliver and protect the service.
How we use it
- To run drills: show the practice chat to your mods, keep score and produce reports.
- To grade your filters with Twitch and to propose blocked terms.
- To run the false-ban check, which compares proposed terms with your recent chat so a term that would match a regular is rejected. This is the only use of the chat log.
- To keep the service secure, prevent abuse and fix problems.
We don’t use your data for advertising, we don’t sell it, and we don’t use chat logs to train AI models. An optional coach’s note may be written by Cloudflare Workers AI from your drill’s numbers only; no chat text or attack text is sent, and the note is labelled “AI-written”.
Where the law asks for a legal basis, we rely on providing the service you asked for (your sign-in and drills) and on our legitimate interest in keeping it secure.
What we do on Twitch
With the permissions you grant, ModScrim reads your blocked terms and AutoMod levels, checks attack lines with Twitch’s Check AutoMod Status, receives your chat for the chat log, and adds or removes blocked terms only when you press Approve and push or Undo. It never changes your AutoMod settings and never posts attack text to chat.
| Permission | Why ModScrim asks | Used in |
|---|---|---|
moderator:read:blocked_terms | Read your public blocked terms | Step 1, Read filters |
moderator:manage:blocked_terms | Add the terms you approve, and remove them when you press Undo | Step 6, push and undo |
moderator:read:automod_settings | Read your AutoMod levels. ModScrim never changes them | Step 1, Read filters |
moderation:read | Check attack lines against your filters with Check AutoMod Status, and see who your mods are | Step 4 and mod sign-in |
user:read:chat, user:bot, channel:bot | Receive your channel’s chat for the 7-day false-ban check | Step 1 and Step 5 |
user:write:chat | Post one fixed line when a drill starts. Requested only if you turn the announcement on | Optional |
How long we keep it
| Data | Kept |
|---|---|
| Your Twitch profile (user ID, login, display name, avatar link, broadcaster type) | Until you sign out or revoke ModScrim |
| Your Twitch tokens, encrypted | Until you sign out or revoke ModScrim |
| Chat log for the false-ban check | 7 days, then deleted automatically; sooner if you press Delete chat log |
| Drills: lines, mod actions, scores, grades, proposed and pushed terms | 30 days, or until you sign out |
| After-action reports and report exports | Until you sign out |
| Audit log of pushes, undos, sign-ins, sign-outs, chat-log deletions and overlay key changes | Until you sign out |
| Mod display names | Until the streamer signs out |
| Mod actions and scores | With the drill they belong to, 30 days at most |
| A mod’s participant token | In that mod’s browser session storage; it expires after 12 hours |
| Join-attempt counters, by IP address | 2 minutes |
| Demo rooms | 2 hours after their last activity |
| Server logs | Cloudflare’s platform retention, a few days and at most 7. Logs never contain tokens, chat text or attack text |
Cookies and browser storage
We use only the cookies the service needs. There are no advertising or analytics cookies.
__Host-mfd_s: keeps you signed in to the console for up to 7 days.__Host-mfd_oauth: protects the Twitch sign-in step; it expires after 10 minutes.- A demo-room cookie that ties your browser to your own demo room.
- Session storage in a mod’s browser holds the participant token for the current drill.
Who else handles it
- Cloudflare hosts ModScrim and stores its data (Workers, Durable Objects, D1, Queues and R2). Data may be processed in any country where Cloudflare operates.
- Twitch receives the requests ModScrim makes on your behalf, as described above.
We share data with anyone else only if the law requires it. Share links for reports are off by default; when you turn one on, anyone with the link can see that report’s numbers, never chat lines or attack text.
If you chat on a channel that uses ModScrim
If a streamer whose chat you post in uses ModScrim, your messages from the last 7 days may be stored in that channel’s chat log, with your user ID and login, for the false-ban check. They aren’t shown on stream, aren’t combined with other channels and are deleted after 7 days. To ask for earlier deletion, ask the streamer to press Delete chat log, or contact us.
Your choices and rights
- Delete chat log empties the log immediately. Pause logging stops new messages being stored.
- Sign out and delete my data revokes your tokens at Twitch, removes the chat subscription and deletes your profile, tokens, chat log, drills, reports, exports and audit log. Deletion completes within a minute.
- If you remove ModScrim from your Twitch connections instead, we delete the same data once Twitch notifies us of the change. Signing out first is the quickest way to be sure.
- Depending on where you live, you may have rights to access, correct, delete or export your data and to object to some processing. Contact us and we’ll respond within 30 days. You can also complain to your local data protection authority.
Security
Twitch tokens are encrypted with AES-256-GCM and the key is held in Cloudflare’s secret store. Session cookies are HttpOnly, Secure and limited to our site. Every message from Twitch is checked with a signature before we use it. Overlay links carry a private key you can rotate at any time. No system is perfectly secure; if you find a problem, please report it privately through the source repository.
Children
ModScrim follows Twitch’s age requirements and isn’t directed at children under 13. If you believe a child has given us data, contact us and we’ll delete it.
Changes
If we change this policy, we’ll update the date at the top and, for significant changes, tell signed-in streamers in the console before the change takes effect.
Contact
Harsh Bhanushali and Dhairya Patel, [email protected].