Security

Redeems sits between your channel and your stream, so we treat it with care. Here is how it works, in plain words.

Signing in

• You sign in with Twitch. We never see or store a password.
• Sessions live in a secure, HttpOnly cookie, so scripts on a page can’t read them.
• Editors sign in with their own Twitch account. Only the channel owner can manage the team, replace overlay links, reconnect Twitch or delete the channel’s data.

What we ask Twitch for

When you connect your channel, Twitch shows you exactly what we ask for. Each permission is there for one feature:

• Read subscriptions: so subs and gift bombs can spin the wheel and open packs.
• Read and manage channel point rewards: so we can create the rewards for packs, spins and knocks, and refund points when something can’t play. We only change rewards Redeems created.
• Read bits: so cheers can count as subs, packs or knocks.
• Bot in your channel: so our own bot account can post results in your chat. It never posts as you.
• Manage predictions: so the snowball fight can open and settle a Twitch Prediction, when you switch that on.

You can take access back any time under Twitch Settings → Connections.

How your data is kept

• Encrypted tokens. The Twitch access tokens you grant are encrypted with AES-256-GCM before they’re stored.
• Each channel walled off. The database itself enforces that a channel’s requests can only reach that channel’s rows, using PostgreSQL row-level security. A bug in one screen can’t show another streamer’s data.
• Secret overlay links. Each overlay link carries a long random key. We look it up by its hash, and you can replace it in one click. The old link stops working at once.
• Staff access is logged. When we help a streamer from our side, every change is written to an audit log.

On the web

• The site is served only over HTTPS, with a strict Content Security Policy that only runs our own scripts.
• Pages can’t be framed by other sites, and requests are rate limited.
• Uploaded card art must be an image, is checked when it arrives, and is served in a sandbox so it can never run as a page.

Your data, your call

Channel owners can delete everything from Settings → Delete everything. That removes your wheels, cards, viewer collections and overlay links, and disconnects Twitch. The privacy page lists what we store.

Found a problem?

If you think you’ve found a security issue, please email support@redeems.tv before telling anyone else, so we can fix it first. We’ll reply as quickly as we can.

← Back to Redeems