Klaxon

Klaxon — Privacy Policy

Last updated: 24 October 2026 · Terms of Service

Klaxon is a self-hosted tool that lets its users publish posts to their own connected social media accounts (such as X, Facebook, Instagram, Bluesky, Threads, TikTok and YouTube) from one place. It also offers on-stream OBS overlays and an optional chat bot for your Twitch channel. This policy explains what data Klaxon handles.

What we store

• Account details — your username and a securely hashed password (we never store your password in plain text).
• Social connections — the API keys and access tokens for the social accounts you choose to connect. These are encrypted at rest (AES-256-GCM) and are used only to publish content on your behalf when you ask.
• Content you create — the text, templates and media you submit in order to post it to your selected networks. Media is deleted right after it is sent (see Media handling); a copy of the post text is kept only for your analytics and expires on the schedule described under Post analytics & insights.
• Overlays & chat bot — the settings for any OBS overlays and the optional chat bot you set up (such as your commands, timers and shoutout wording). If you connect a dedicated Twitch account for the chat bot, its access token is encrypted at rest (AES-256-GCM) like your other credentials and is used only to read your channel's chat and post the commands, timers and shoutouts you configure.

How your data is used

Your credentials and content are used solely to perform the actions you request — publishing your posts to the networks you connect, via those networks' official APIs. Klaxon does not sell your data, does not use it for advertising, and does not share it with anyone other than the social networks you explicitly post to.

Media handling

Images and videos you attach are held only for as long as it takes to send them to your chosen networks, then deleted. For platforms that require it (e.g. Instagram), a file may be served briefly from a random, unguessable URL so the network can fetch it, and is removed immediately afterwards.

Post analytics & insights

After you publish a post, Klaxon keeps a lightweight record of it — the network's post ID, a link to the post, a copy of the post's text, and engagement counts (such as likes, comments, shares and reach/views). Klaxon periodically uses the stored post ID to ask the network's official API for updated engagement figures, so it can show you analytics such as follower growth, per-post performance, and best time to post. It does not keep your media. This information is visible only to you and, where applicable, your account's administrator.

Klaxon also takes periodic snapshots of your public follower/subscriber counts on each connected network to draw growth charts. These snapshots and the post records above are automatically deleted 90 days after they are created — and immediately if you delete your Klaxon account.

On-stream overlays & chat bot

Klaxon's OBS overlays and the optional chat bot connect to your Twitch channel's chat. The chat bot reads incoming messages to detect the !commands you set up and reply to them, and to post your timers; the emote and prize-draw overlays read chat to show emotes or run a !tombola draw. These messages — and the usernames in them — are processed in real time only to provide the feature you enabled and are not stored by Klaxon. We do not build profiles of your viewers or use their data for anything else.

The shoutout command looks up public Twitch information about the person you choose to shout out — their last-streamed game and their public clips — and can play one of their clips on your overlay. This uses only public data made available by Twitch.

Website analytics

On our public pages we count visits using our own first-party analytics — no cookies and no third-party trackers. For each visit we record only the page, the time, and a one-way hashed token derived from your IP address and browser that rotates every day, so we can count visits and approximate unique visitors without storing your IP or being able to identify you or follow you across days. These aggregate figures are kept for up to 90 days and are used only to understand how much traffic the site receives.

Third-party networks

When you connect and post to a network, your content and the relevant token are sent to that network. Their handling of your data is governed by their own privacy policies (e.g. Google/YouTube, Meta/Facebook & Instagram, X, TikTok).

The overlays and chat bot also connect to the services that power them: Twitch (chat and public clip data), 7TV and BetterTTV (emote images for the emote overlay), and Spotify or Last.fm (your current track for the Now Playing overlay). Each is used only to provide the overlay you turn on, and your use of them remains subject to their own terms and privacy policies. Klaxon is not affiliated with or endorsed by Twitch, 7TV or BetterTTV.

Google user data & YouTube API Services

Klaxon uses YouTube API Services and Google APIs. When you connect your YouTube account, Klaxon requests only the permissions it needs:

• youtube.upload — to upload a video to your channel only when you choose to post one.
• youtube.readonly — to read your channel's name and subscriber count, so Klaxon can show your follower analytics.

Klaxon stores only what is required to provide these features: an encrypted Google refresh token (AES-256-GCM), and periodic snapshots of your public subscriber count to draw growth charts. Klaxon does not store your videos, does not read any private account data beyond the above, does not allow humans to read your Google data, does not use it for advertising, and does not sell it.

Klaxon's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

By connecting YouTube you also agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. You can review or revoke Klaxon's access to your Google account at any time at Google Account permissions.

How we protect your data

Klaxon applies the following safeguards to sensitive data — including your Google/YouTube tokens and every other connected-account credential:

• Encryption in transit. All traffic to and from Klaxon is served over HTTPS/TLS, so your data is encrypted while it moves between your browser, Klaxon, and the platform APIs.
• Encryption at rest. All access tokens and API credentials — including your Google refresh token — are encrypted with AES-256-GCM before being written to the database, and are never stored in plain text.
• Password protection. Account passwords are stored only as a salted scrypt hash, never in a readable form.
• Restricted access. The application and its database run on a private, firewalled server. Access is limited to the operator for maintenance only; no human reads your Google user data, and it is never used to develop, improve, or train any AI or machine-learning models.
• Least privilege. Klaxon requests only the minimum scopes needed for the features you use, and uses each token solely to perform the action you asked for.
• Secure deletion. Disconnecting an account, or deleting your Klaxon account, permanently removes the associated encrypted credentials from the database.

Data retention & deletion

Analytics data — post records, engagement counts and follower snapshots — is automatically deleted 90 days after it is created. You can disconnect any social account at any time, which removes its stored credentials. If your account is deleted, all of its associated data is removed from the database.

Contact

For any questions about this policy or your data, contact the operator of this Klaxon instance via the site it is hosted on.