Privacy Policy

Summary

StrimQ has two halves. The offline half — Picture-in-Picture, auto-PiP, TV Mode, Radio Mode, the in-page overlay and the keyboard shortcuts — runs entirely inside your browser without uploading your media to StrimQ. The online half — signing in, watch parties and Streamer Broadcast — sends real data about what you are watching to the StrimQ server, and some of it is kept indefinitely.

This page describes what the code does. Every claim below can be checked against the source at github.com/aziz0220/pipmedia.

If you never sign in and never join a watch party

The socket to StrimQ is opened on demand, not on install or on browser start, and the reconnect paths require an active feature such as a watch party, broadcast or Studio session. Picture-in-Picture, cross-tab controls, TV Mode and Radio Mode all run entirely in your browser. Your settings stay in chrome.storage.local on your device and are deleted when you uninstall.

What the extension reads from pages

On supported pages the content script runs in each frame, from the first moment the document exists. That is necessary because a video can be anywhere and because many players create their media element before the page has finished loading.

On a page with media it reads:

• <video> and <audio> elements and their playback state — playing, position, duration, volume, mute, speed, live, PiP availability
• the poster image, and a frame drawn from the video for the popup thumbnail
• the Media Session metadata the site itself publishes (title, artist, album, artwork)
• the page title and the page URL
• on a small set of sites, specific player controls (next, previous, quality, chapters, skip ad)

It does not read form fields, passwords, cookies or page text outside the player, does not intercept network requests, and injects no advertising. Players in closed shadow roots are discovered using the browser's own shadow-root access, preserving the page's root mode. The page-world script observes media play calls to register detached players and notice media inside shadow roots.

None of this leaves your browser unless the tab is in a watch party or is being broadcast.

What the extension sends, and when

• Google sign-in (you start it). The token Google returns, plus a random per-installation device ID. The server exchanges it with Google and stores your email address, display name, Google profile picture URL and Google account ID, creates a free-tier subscription row, and creates a broadcast channel for your account.
• Watch parties (you start or join them; sign-in required). For the one tab you put in the party: the page URL and a canonicalised form of it, the media title, the thumbnail URL, your display name and avatar, and then a continuous stream of playback state — position, duration, play, pause, seek, speed, volume, buffering, stalled, ended, ad state, and whether your copy is in Picture-in-Picture — up to roughly three times a second while playing, for as long as the party runs. Skipping to another video sends the new URL, title and thumbnail. Your other tabs are not sent.
• Connection quality, only while a party is running. A round-trip measurement in milliseconds, posted to the server with no URL and no page data. The server keeps at most the last 200 samples in memory and never writes them to disk.
• A health check immediately before the party socket opens. It carries no data.
• Streamer Broadcast (off unless you turn it on; public by design). Every media item you open in the broadcasting tab — URL, title, thumbnail, platform — is sent to the server and published on your public channel page. Playback changes and their original observation times are recorded for a public timeline replay. This does not upload a recording of the original video or stream. Broadcasting from private browsing tabs is refused.
• Replay following (you explicitly start it). The extension downloads the public recording and controls play, pause, speed and position in the matching original tab you choose. It does not join a party or publish that tab as a new broadcast. Stop following releases control; leaving the recording or closing either tab ends it. The provider still sees activity in its own player.

The extension talks to exactly one server: the StrimQ backend, at the address compiled into the build. It contains no analytics SDK, no crash reporter, no advertising network and no third-party tracker.

What the extension shares with this website

When you have a StrimQ page open, the extension's content script hands that page — inside your own browser, over window.postMessage — the media snapshot for all of your tabs (titles, URLs, thumbnails, playback state), your settings, and the access token it holds, so the dashboard can show and control them. That data is rendered by the page; it is not uploaded to the server by virtue of being shown, and no data is exchanged this way with any site other than StrimQ's own.

What stays on your device

• Your settings, saved TV Mode and Studio layouts, filters, sorting and layout preferences
• A random 32-byte device ID generated on first run — not derived from your hardware or your identity
• If you sign in: the access token, obfuscated with AES-GCM. The key is derived from the device ID, which sits in the same storage area — treat it as "not plaintext", not as "safe from anyone with access to your browser profile"
• Playback snapshots buffered while the socket is offline; they expire after 5 minutes
• Video preview frames used to draw thumbnails, produced and consumed in the browser

All of it is deleted when you uninstall the extension.

What the server keeps, and for how long

• Live party state — Redis, 4 hours. Code, media URL, title, thumbnail, host, participant list, current position. Deleted when the party ends; expires on its own if it does not.
• Presence — Redis, 2 minutes. While your socket is connected the server records that your account is online, with a socket count and a session count, so operators can see who is connected. Each record expires two minutes after the last update.
• Account data — PostgreSQL, until deleted. Email, name, avatar URL, Google ID, device ID, last seen, subscription tier, Stripe customer ID if you have one, theme preference.
• Usage counts — PostgreSQL, indefinitely. A daily row per account: parties created, parties joined, seconds of party time. No URLs.
• Watch-party history — PostgreSQL, indefinitely. Every create, join, leave, end and skip writes an audit row; for create, join, end and skip that row includes the media URL, title and thumbnail. There is no expiry job. This is a durable history of what you have watched in a party, tied to your account.
• Broadcast history — PostgreSQL, indefinitely and publicly, if you used Streamer Broadcast. This includes media links, titles and playback changes. Recent changes also have a bounded live copy in Redis. Unpersisted changes stay in a retry queue until written to PostgreSQL; there is currently no automatic expiry job for the durable recording. If the creator adds a stream-recording link, its title, URL, reference positions and creator-reported availability are also stored and public. Removing that mapping removes the link metadata, while the broadcast timeline remains.
• Server logs include watch-party media titles and URLs alongside the account that acted on them. Retention depends on how the server is operated.

Who can see your watch-party data

• Other participants — your display name, avatar, playback position, play/pause and buffering state, and the media itself.
• Anyone holding the party code. Looking up a live session by its code needs no sign-in and returns the media URL, title, thumbnail, host ID and participant count. Treat a party code as a semi-public link.
• StrimQ operators. The admin surfaces list live sessions including their media titles, and the database holds the history above.
• The public, for channels you explicitly broadcast and their recorded timelines. A party permission setting does not publish its private join code in Browse.

Third parties

• Google — sign-in, at your request.
• Stripe — subscription payments, on Stripe's own pages. Neither the extension nor this site ever sees your card number.
• Original media providers — opening an original source or loading its artwork connects your browser to that provider. A timeline replay does not start a provider player automatically.
• Sentry — server-side error reporting. It is off unless the operator of a deployment configures a Sentry DSN; where it is on, server error reports may contain the request context of the operation that failed.

No advertisers, no data brokers, no analytics vendors. Data is not sold or transferred for advertising, profiling or creditworthiness.

Cookies

This site sets no cookies. Your sign-in token and your theme choice are kept in localStorage in your browser.

Your choices

• Stay offline. Do not sign in and do not join a party; nothing is sent, and every offline feature keeps working.
• Turn StrimQ Online off in the extension's settings.
• Sign out. The extension discards its stored token. Your account and its history stay on the server.
• Leave a party at any time; reporting for that tab stops immediately.
• Choose viewer permissions when you host. That controls what other people may do, not what they can see — participants can always see the media and each other's positions.
• Uninstall. Everything on your device is removed. Everything on the server is not.
• Disable StrimQ in incognito from your browser's extensions page, if you do not want incognito tabs to appear in the popup or to be eligible for a watch party.

Deletion and export

There is currently no in-product way to delete your account, delete your watch history, or export your data. The dashboard's "delete session history" control hides entries from your dashboard — it writes an additional record noting that you asked for them to be hidden, together with your IP address and browser user-agent, and the underlying rows stay in the database.

To have your account and its associated subscription, usage, audit and broadcast records removed, ask us using the contact below and we will do it by hand. Under the GDPR, the CCPA and comparable laws you may request access to, correction of, export of, or deletion of the personal data described here.

Children

StrimQ is not directed at children under 13. Watch parties require a Google account and Google's own age requirements apply. We do not knowingly hold data from children under 13; if you believe we do, contact us and we will delete it.

Changes

If what the product does changes, this page changes with it and the date at the top moves. New categories of data leaving your browser, or new recipients, will also be called out in the changelog and in the store listing.

Contact

Privacy questions, and access or deletion requests: open an issue. We aim to respond within 5 business days.