Privacy Policy

Last updated: September 29, 2026

HighlightPilot is operated by an individual sole proprietor based in Florida, USA, who is responsible for (the “controller” of) the personal information described here. This Privacy Policy explains how HighlightPilot (“we,” “us”) collects, uses, shares, and stores information when you use highlightpilot.com, our API, and related dashboards (the “Service”).

1. Who this applies to

It applies to customers who create accounts, visitors to our marketing site, people who contact support, Twitch streamers who use our verified opt-out flow, and Twitch streamers and chat participants whose public streams, clips, and chat messages we process when a channel is monitored (even though they do not have a HighlightPilot account). Twitch is a third-party platform with its own privacy terms.

2. Information we collect

Account data: username, email address, password hash (we do not store plaintext passwords), role flags, notification preferences, and optional notification email.
Twitch connection data: OAuth access and refresh tokens for your connected Twitch account, Twitch user id, login/display name, and scopes needed for official clips and related Helix/chat features (typically clips:edit, chat:read, user:read:follows, and user:read:email when connecting from the dashboard).
Monitoring configuration: channels you add, language filters, blacklist entries, detection settings, offline/auto-replace preferences, and optional Discord incoming webhook URL for clip alerts.
Clip and chat-derived data: clip metadata (URLs, thumbnails, titles, scores, trigger reasons), and short chat snippets (chat usernames and message text) or phrase stats used to explain why a clip fired. Full stream video remains on Twitch.
Clip video and AI-derived data: for clips we screen or prepare for our social accounts, we download the clip video from Twitch and derive frames, speech transcripts (made on our own servers), face regions for cropping, AI quality verdicts and scores, and AI-written titles and captions.
Billing data: Stripe customer and subscription identifiers, slot quantities, promo-code redemptions, and billing status. Card numbers are handled by Stripe — we do not store full payment card numbers.
Support and contact messages: name, email, subject, and message content you submit.
Usage and site analytics: product events needed to operate the Service; first-party pageview beacons (path, host, referrer); Vercel Web Analytics; and Google Analytics 4 only if you accept analytics cookies. Theme preference may be stored in local browser storage.
Bot protection: Cloudflare Turnstile challenges on signup, login, and password reset, which process your IP address and browser signals.
Security / session data: JWT access tokens stored in browser local storage (not httpOnly cookies), password-reset tokens, preview-unlock hints when private preview is enabled, and audit logs of sensitive account actions.

3. How we use information

Provide live Twitch chat monitoring and automatic official clip creation for channels you choose
Authenticate you, secure accounts, and prevent abuse
Bill per monitored channel and manage trials via Stripe
Send transactional email (account, billing, optional clip/channel alerts) via Amazon SES when configured, with Resend as an optional fallback
Screen clip quality with AI, including a sample of clips created through customer accounts
Edit clips and publish them on HighlightPilot’s own Instagram, TikTok, and YouTube accounts to showcase the Service
Operate streamer opt-out and stop monitoring opted-out broadcasters
Improve reliability, detect spam/abuse, and understand aggregate site traffic
Respond to support requests

AI processing. To screen clips and draft social copy, we send sampled video frames, speech transcripts, recent chat message text, and clip metadata (channel, game, title) to OpenAI as our service provider. OpenAI states that it does not use API data to train its models by default and may keep it for up to 30 days for abuse monitoring. Speech transcription runs on our own servers. AI results are advisory.

Face detection. To lay out vertical videos we automatically locate face regions in clip frames. We do not identify people or keep face templates.

Social publishing. Videos we publish on HighlightPilot’s Instagram (Meta), TikTok, and YouTube (Google) accounts are public and processed by those platforms under their own policies. Our YouTube publishing uses YouTube API Services; see the YouTube Terms of Service and the Google Privacy Policy.

4. Legal bases (where applicable)

Depending on your location, we may process data to perform our contract with you, with your consent (for example optional marketing or certain cookies), for legitimate interests such as securing the Service and preventing abuse, and to meet legal obligations. If you are in the EEA/UK and need a formal Article 13/14 notice or data processing agreement, email support@highlightpilot.com.

5. Sharing

We share information with service providers only as needed to run HighlightPilot, including:

Hosting and infrastructure providers
Stripe (payments)
Twitch (OAuth, Helix, chat, clip downloads — per your and Twitch’s terms)
OpenAI (AI clip screening, thumbnails, trims, and social copy)
Meta (Instagram), TikTok, and Google (YouTube), for videos we publish on HighlightPilot’s own accounts
Cloudflare (network security, CDN, and Turnstile bot checks)
Google Fonts (web fonts loaded from Google’s servers, which receive your IP address)
Email delivery providers (Amazon SES and, when used, Resend)
Discord (only if you paste an incoming webhook URL for clip alerts)
Vercel (frontend hosting / optional web analytics)
Google Analytics (only if you accept analytics cookies)
Infrastructure and backup providers (for example Linode hosting and, when configured, AWS S3 backups)

We do not sell personal information. We may disclose information if required by law, to protect rights and safety, or in connection with a merger or asset transfer (with notice where required).

Under California law (CCPA/CPRA), “sale” and “sharing” have specific meanings. Based on how we operate today, we do not sell personal information for money, and we do not knowingly share personal information for cross-context behavioral advertising. If you are a California resident and want to make a privacy request, contact support@highlightpilot.com. We honor Global Privacy Control (GPC) signals by not loading Google Analytics.

6. Retention

We keep account and monitoring data while your account is active. Clip metadata, chat snippets tied to clips, AI screening results, billing records, and audit logs are retained as needed to operate the Service, resolve disputes, and meet legal/accounting requirements. Clip videos we download or render for screening and social posts are stored on our servers while needed and may be deleted at any time; videos we publish remain on the social platforms until removed. You may request deletion of your account; some records may remain for a limited period for security, billing, or legal compliance.

7. Cookies and similar technologies

Essential storage (always on): account login uses a JWT stored in browser local storage (cleared on logout). We also use local storage for theme preference, a short-lived preview-unlock hint, and to remember your cookie choice. Cloudflare Turnstile may set cookies needed for bot protection on signup, login, and password reset.

Cookieless measurement (always on): our first-party pageview counter (path, host, referrer) and Vercel Web Analytics do not set tracking cookies.

Google Analytics (only with your consent): Google Analytics 4 sets cookies and loads only after you click Accept in our cookie banner. If you click Reject, or your browser sends a Global Privacy Control signal, Google Analytics does not load. Your choice is remembered for 6 months. You can change it anytime with Cookie settings (also in the site footer). Clearing site data resets your choice and signs you out.

8. Children’s privacy

HighlightPilot is not directed to children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has created an account, contact us and we will take appropriate steps.

9. Your choices and rights

Update profile, notification prefs, and Twitch connection in the dashboard
Disconnect Twitch or revoke access via Twitch account connections
Stop monitoring channels; streamers may use verified opt-out
Request access, correction, or deletion by contacting support (we may verify identity)
Streamers, creators, and chat participants can ask us to delete chat snippets or remove a video from HighlightPilot’s social accounts by emailing support@highlightpilot.com

Depending on where you live (for example EEA, UK, California), you may have additional rights. We will not discriminate against you for exercising privacy rights we are required to honor.

10. Security

We use industry-standard measures such as HTTPS, hashed passwords, and access controls. No method of transmission or storage is 100% secure.

11. International transfers

We may process data in the United States (including through OpenAI, Meta, TikTok, and Google) and other countries where our providers operate. If you access the Service from elsewhere, you understand information may be transferred across borders.

12. Changes

We may update this Policy. We will change the “Last updated” date and, for material changes, provide additional notice where appropriate.

13. Contact

Privacy questions: support@highlightpilot.com, the Contact page, or the Support tab in your dashboard.