about & privacy
chatter.boo is a small independent web client for twitch chat, built and run by sarah. it exists because phone chat apps lose your place and your history the moment the tab sleeps — this site doesn't. it is not affiliated with twitch. this page explains exactly what the site does and doesn't do with data, in plain language. the terms of use are the other page — what you agree to by signing in.
nothing. there are no analytics, no trackers, no ad networks, and no third-party scripts. the server keeps no access logs — we don't record your IP address, what you read, or when you visited. reading signed-out is anonymous to us.
the same place any chat client gets them: twitch's public chat feed. the site joins a channel's chat the way an app like Chatterino does and stores what's already public — username, display name, message text, emotes, badges, and timestamps. nothing here is scraped from anywhere private.
every channel follows the same rules, and nothing is kept forever: if nobody visits a channel here for 7 days the site stops logging it, after 30 days its data is deleted entirely, and only the newest 100,000 messages per channel are kept regardless. two exceptions, both your call, both in settings: "save your messages" keeps your own messages past those cleanups until you turn it back off, and "don't log your messages" is the opposite — nothing you say gets stored here at all.
settings (the gear) → "your data". everything is self-serve and takes effect immediately:
download your data gets you one JSON file with everything the site stores about you — every message, your uploads, channel list and board votes. delete your data erases all of it permanently, including what your messages were quoted saying in other people's replies. don't log your messages stops anything new from being stored — from then on your messages exist on twitch only and won't appear here at all. and delete your account makes the site forget your twitch tokens, channel list and votes, and signs you out everywhere.
streamers get the same controls for their channel: download or delete the entire stored log of your own channel, and "don't log your channel" wipes it and blocks the channel from being logged here again until you say otherwise.
never used chatter.boo? your public twitch messages may still be in a logged channel here. signing in with twitch is the identity check — it proves you're you without a password ever touching this site. sign in once, delete your data, flip "don't log your messages" if you want to stay out for good (that choice survives even account deletion), then delete the account the sign-in created. two minutes, no email, no asking anyone.
these are your GDPR rights — access, portability, erasure, and objection — and they work the same for everyone, EU or not. anything you can't do self-serve, get in touch (below) and it'll be handled directly.
it's gone here too. the site shows a "message deleted" placeholder instead, and the server will not hand out the original text — not in history, and not inside reply quotes either.
sign-in uses twitch's standard OAuth page, so your password never touches this site. the permissions requested are exactly what the features need and nothing more: send chat as you (so you can chat from here), list your emotes (so the picker shows your sub emotes), and view/manage your block list. the site cannot read your whispers, email, payment info, or anything else. tokens live on the server, are used only for those actions, and signing out removes your session. idle sessions expire on their own after 90 days, and once an account is signed out everywhere, its tokens are deleted from the server too. want it all gone at once? "delete your account" in settings → your data.
one optional extra: if you're a twitch moderator, "enable mod tools" in the account menu asks for moderation permissions too (ban/timeout users and delete messages in channels you moderate). that's only requested if you turn it on yourself — regular sign-in never asks for it.
before an upload is saved, all EXIF metadata — GPS location, device model, and the rest — is stripped out (only the orientation flag is kept so photos don't display sideways). you choose at upload time whether the file auto-deletes after an hour, a day, a week, a month, or never. uploads are content-validated and rate-limited.
blocks here are your real twitch block list, managed through twitch's own API — the site doesn't keep its own copy. block someone here and they're blocked in every twitch client you use, and vice versa.
chat is twitch's, so reports go to twitch: report ↗ on a message or a person's card opens their twitch card for that channel, where twitch's report lives (under ⋯, with their recent messages to pick from). hide takes a message off your screen, the chat card's hidden list keeps words or @users off it for good (your device only), and block (above) hides someone everywhere. the one report chatter.boo takes itself is report without the arrow, on messages that link an image or clip uploaded here — that content is ours, so it's reviewed here and deleted if it breaks the terms of use.
there's no public directory of channels — only people you give the link to (chatter.boo/twitch/channelname) will find it. keep in mind the underlying twitch chat is public either way.
your browser loads emote images directly from twitch, 7TV, BTTV and FFZ's image servers — as with any image on the web, those servers see your IP when the images are fetched. that's the whole list: no third-party scripts, fonts, CDNs, or analytics load from anywhere.
HTTPS everywhere with auto-renewing certificates; the domain is DNSSEC-signed and pinned to its certificate authorities (CAA), so DNS answers and cert issuance are both hard to spoof. the server is a single firewalled machine that exposes only the site itself, with hardened remote access, and two-factor auth protects the accounts that control the domain and server. sessions are HttpOnly cookies, uploads are validated by content rather than filename, and the database is backed up nightly. security gaps get fixed as they're found, and this page gets updated when anything changes.
deliberately boring: one small rust program and a sqlite database on a $6 server, behind the caddy web server for TLS. the frontend is a single hand-written javascript file — no frameworks, no build step. small enough that one person can actually understand and maintain all of it.
get in touch — sarah.fyi. ideas and bug reports have their own box: “ideas & bugs” in the site header.