Retro Stream
Privacy policy
Draft — needs legal review before sale. Version 2026-10-15. This describes what the service does today. It has not been reviewed by a lawyer, and the parts in [brackets] are placeholders the operator must fill in before Retro Stream is sold.
Who is responsible
[Legal name and address of the operator], who runs retro-stream.io (“we”). Contact for anything in this policy: privacy@retro-stream.io. [EU/UK representative, if one is required.]
What we hold
- Your account: username, display name, an optional email address (and whether you verified it), and your password as an Argon2id hash — never the password itself.
- Sign-in factors: your authenticator (TOTP) secret, encrypted with a key kept apart from the database; hashes of your recovery codes; and for each passkey its public key, a name you chose, a counter and when it was last used. A passkey's private key never leaves your device.
- Sign-ins: for each browser session and each signed-in app or TV — when it was created and last used, its IP address, its browser or device name (for example “Living room TV”).
- Boxes and people: the boxes you own or can use and your role on each; for each box, what it reports about itself (name, model, serial number, software version, its addresses on your home network, whether it is streaming and which console); invites; your friends and blocks; the game sessions (parties) you host or join.
- Push tokens (only if you allow notifications in the app): the token Apple or Google gave your device, so we can tell you about a friend request or a party invite while the app is closed.
- Usage counters: daily counts per account, per box and per network address — sign-ups, requests relayed to your box and their size, relay (TURN) credentials and relayed bytes — used only to keep the service available and to stop abuse.
- A security log: sign-ins and failed attempts, factor and password changes, membership and ownership changes, relayed requests (method, path and result only), and automatic abuse throttles, each with the IP address.
What we never hold
Video, audio or controller input; your console account credentials; your box's configuration or profiles. Streams between the app and your box are end-to-end encrypted (DTLS-SRTP): when they pass through our relay, the relay forwards encrypted packets it cannot read, and records only addresses and byte counts. When the website or app relays a settings request to your box, the content passes through and only the method, path and result are logged.
What we use it for, and why we may
- To provide the service you signed up for — signing you in, connecting your apps to your boxes, friends and parties (performance of our contract with you).
- To keep accounts and the service secure and available — the security log, rate limits, usage counters and abuse throttles (our legitimate interest in a working, abuse-free service).
- To send account mail you asked for (verification, password reset) and notifications you turned on.
No advertising, no sale or rental of data, no profiling, no third-party analytics, and no third-party scripts or fonts on these pages.
Who else sees it
- Other users see what the feature needs: members of a box see each other's username and display name; friends see your presence as you set it (online status, and what you're playing only if you allow it); party guests see the host's box name and console.
- Apple and Google deliver push notifications: the notification text (for example “Neil invited you to play on Neil's box”) and your device token pass through them, under their own privacy terms.
- Our mail provider [name, if SMTP is configured] carries account mail.
- Hosting: [today the service runs on hardware the operator owns; name any hosting provider or VPS region used for the relay, and where it is].
- Authorities, only where the law requires it.
How long we keep it
| Data | Kept |
|---|---|
| Your account and everything tied to it | Until you delete it; then deactivated at once and erased after 30 days |
| Browser sessions | 30 days from sign-in, or until you sign out or revoke them |
| Signed-in apps and TVs | Until you sign out or revoke them on the website; idle ones expire |
| Push tokens | Until you sign that device out, Apple/Google report it invalid, or you turn notifications off |
| Usage counters | 90 days |
| Security log | 12 months; after an account is erased its entries keep only an anonymous id |
| Server access logs | Rotated by size, normally a few days |
| Backups | 14 daily and 8 weekly copies; erased data leaves the backups within 8 weeks |
Your rights
You can download everything we hold about you as JSON, correct your profile on the account page, and delete your account. Deleting an account that owns boxes asks you first to hand them to another owner or release them; it is refused while you are the only owner of a box other people use. Depending on where you live you may also have the right to object, to restrict processing, and to complain to your data-protection authority [name the lead authority]. Write to privacy@retro-stream.io for anything the pages don't do.
Children
Retro Stream accounts are not meant for children under 13 [or the higher age of digital consent where you live, up to 16 in parts of the EU]. Younger players can play on a family member's box without an account of their own — as a guest of the box owner's party or on the box's own network. If we learn that an account belongs to a child below that age without a parent's consent, we delete it.
Security
Passwords are hashed with Argon2id and checked against a local copy of the Pwned Passwords list (nothing about your password is sent anywhere); two-factor secrets are encrypted; passkeys and two-factor protect sensitive changes; every page is served over HTTPS; the database is not reachable from the internet. No system is perfect: if a breach affects your data we will tell you and the authorities as the law requires.
Where it lives
[Country of the servers.] If you use the service from another country, your data is transferred there [state the transfer mechanism, e.g. standard contractual clauses, where required].
Changes
We will post changes here with a new version date, and tell signed-in users about significant ones before they take effect.