Ahribox

Service operator: Ahribox
579-467-2205
info@ahribox.com

Version française

Privacy Policy

1. Responsibility and scope

Ahribox is responsible for personal information processed through the service. The person with the highest authority at Ahribox acts as the person responsible for privacy unless the role is delegated in writing, and can be reached at info@ahribox.com. This policy covers the website, dashboard, billing, stream relay, support, and Ahribox administrative activities.

This policy also covers invited Twitch guests who do not have an Ahribox account.

2. Information collected

Live audio and video are processed transiently to relay the stream and apply scenes. When the signed-in user opens the preview, the protected output is returned transiently to that browser; closing the preview or hiding the page stops those requests. The preview creates no recording. Ahribox does not seek to record the live broadcast, except for media expressly imported or supplied for service features.

Guest sharing: the host reference, invited and verified Twitch channel identity, invitation state, consent and session timestamps, hashed invitation and browser-control tokens, and encrypted broadcast destination. Guest OAuth tokens are used to verify identity and obtain the destination but are not stored by this flow. Limited security records include the invitation reference, action, actor and IP address. The host does not receive the guest's stream key.

3. Purposes

Ahribox uses this information to provide and secure the service, verify access and quotas, process payments, import or transcode authorized clips and custom scenes, play an intro or outro at your request, diagnose failures, prevent abuse, communicate with you, and meet legal obligations.

Guest information verifies the invited collaborator, records and enforces consent, sends the host's entire protected program to that guest's Twitch channel, and supports stopping, expiry and abuse investigation. Connecting Twitch alone does not start a broadcast. Separate consent applies to one host session, for at most twelve hours, and can include a later host start within that window. The program includes live camera and audio, clips, intro/outro, overlays and privacy scenes, not a separately selected guest feed.

4. Providers and transfers

Ahribox shares only necessary information with providers supporting hosting, backups, billing, streaming, software repositories, monitoring, or alerts, including OVHcloud, Stripe, and Twitch. Some providers may process information outside Québec or Canada, where local laws and authorities apply. Ahribox must assess privacy factors and use appropriate contractual and technical safeguards before such a transfer.

5. Retention and deletion

Information is kept only as long as needed to provide the service, resolve disputes, protect security, and meet legal, tax, and accounting periods. Ahribox applies documented retention and destruction rules. Raw MP4 uploads are temporary and are destroyed after validation or final processing failure; only normalized media remains within the applicable account quota. Clips, intro videos, and outro videos can be deleted from the dashboard and are deleted when the account is closed; backup copies age out through normal rotation. Contract copies and payment records may be retained for applicable periods. Longer retention may be required by law or reasonably needed for a claim.

Ending, revoking or expiring a guest invitation clears its encrypted destination and browser-control hash from active storage. Automatic expiry can wait for service recovery during an outage. Hourly cleanup removes ended invitation metadata after more than seven days, once its output reservation is released. Limited security audit records follow the existing 24-month schedule, subject to documented holds. Encrypted backups follow the existing rotation of seven daily, four weekly and six monthly snapshots; active deletion does not rewrite historical backups. Twitch-side VODs, clips and other copies follow Twitch's controls and are not removed by Ahribox invitation cleanup.

6. Security

Ahribox uses safeguards including encrypted destination keys, HTTPS, revocable sessions, access controls, audit logging, encrypted backups, and administrator two-factor authentication. No system is perfectly secure. Ahribox maintains a confidentiality-incident register. If an incident creates a risk of serious harm, Ahribox will notify affected people, the Commission d'accès à l'information, and, where federal law applies, the Office of the Privacy Commissioner of Canada.

7. Cookies and automated decisions

Ahribox uses essential session and security cookies to sign you in, protect forms, and remember language. The service can automatically apply a quota, payment expiry, or capacity limit. You may request human review of an automated decision concerning you.

Essential security cookies also protect the guest invitation, Twitch connection, consent and stop controls in the relevant browser. They do not create an Ahribox account or subscription.

8. Your rights

You may request access, correction, or, where the law permits, deletion or portability of your information. You may withdraw applicable consent, subject to consequences necessary to provide the service and legal obligations. Contact info@ahribox.com; Ahribox may verify your identity and will respond within 30 days where that legal deadline applies. A privacy complaint will be reviewed by the person responsible; you may also seek recourse from the Commission d'accès à l'information.

A guest can end sharing from the consent browser, and the host can revoke it. Host stop ends that authorization; a new host session requires a new invitation and consent. Guests without an Ahribox account can use the privacy contact above for requests or help stopping access if their browser is unavailable. We may verify identity privately; never send a Twitch password or stream key. Withdrawal does not remove copies already held by Twitch or viewers.

9. Minors and changes

The service is not intended for anyone under 18. Ahribox will notify users of a material change to this policy and request renewed consent where required by law.

Effective September 8, 2026

Policy version: 2026-09-08-v5