Cookies & privacy controls
This page describes the browser storage currently used by the Community Raiders website and creator dashboard.
Privacy questions
Community Raiders is being built by an independent hackathon team. The responsible party is Jacob Nelson. For privacy questions, contact communityraiders1@gmail.com.
Essential sign-in storage
Starting Twitch sign-in uses an essential, browser-bound state cookie to protect the sign-in flow. A successful creator sign-in uses an essential session cookie. These are required for sign-in and are separate from optional sound settings. The API checks creator and community access using the essential session.
__Host-cr_oauth: API-host sign-in state cookie; Secure, HttpOnly and SameSite=Lax; expires after 10 minutes.__Host-cr_session: API-host creator session cookie; Secure, HttpOnly and SameSite=Lax; lasts at most 12 hours and may end earlier with token expiry.- A temporary sessionStorage value keeps an allowlisted dashboard return path during creator login. Account-only player sign-in also binds an allowlisted destination to its single-use OAuth state in server memory for at most ten minutes; a restart ends that pending sign-in safely. It does not store passwords or access tokens.
Your browser does not store Twitch credentials in these controls. Twitch handles its own sign-in and has its own privacy notice. Signing out ends the creator session; browser settings can also clear site cookies.
Account and community data
Website sign-in uses your Twitch identifier, login and display name. Account-only player sign-in does not create a streamer community or a raider. Streamer setup is a separate explicit action. The service keeps the community name and settings, your account-wide physical appearance and base clothing, and each community raider's equipment, progression, inventory records and reward receipts. Shared appearance is linked to your stable player identity. Earlier community appearance records are retained during this alpha transition. These support your community raider and creator workspace. This build does not request your Twitch email address or add chat, subscription or channel-management permissions through creator sign-in.
Access tokens are encrypted on the server; they are not stored in these browser preferences. Expired sign-in requests and sessions are pruned. Account and game records do not currently have an automatic deletion schedule, and full retention and account-management policies are still being finalized. Signing out removes the current application session; it does not delete community/game records or disconnect the Twitch authorization. For privacy questions or access/deletion requests, contact communityraiders1@gmail.com. There is no automated export/deletion workflow in this build.
Community Raiders is an independent project for the Codex x TwitchCon Hackathon. That description does not replace the responsible party or privacy contact above.
Raiderville rooms
Raiderville uses a separate website-player Twitch session. The essential API-host cookies __Host-cr_rv_session and __Host-cr_rv_oauth are Secure, HttpOnly and SameSite=Lax. The sign-in nonce expires after 10 minutes; the player session lasts at most 12 hours or until its token expires. A room code identifies a community campsite; verified identity and that community's existing raider are required to enter. Website-player sign-in does not grant streamer administration.
Campsite participants see the Twitch display names, character appearance and accepted positions of other active participants in the same room. Default rooms last four hours. Inactive presence is hidden after 30 seconds; leaving or signing out retires your current presence. Room, membership and access records are pruned one day beyond scheduled room expiry (about 28 hours from opening with the default duration). Expired sign-in states and player sessions are pruned; rate-limit buckets use hashed network or account identifiers and are pruned after one hour. Stable player/account and community character records do not have an automatic deletion schedule.
Raiderville sign-out ends its website-player session separately from creator sign-out. Closing a room ends access for its participants. Supplied forest ambience starts only after pressing Play; its volume and mute choices remain in memory for that page and are not remembered in browser storage. No campfire audio or proximity audio is included in this build.
Community selection and activity
The website lists only communities where your authenticated Twitch identity already has a raider. A necessary sessionStorage value, community-raiders:selected-community, remembers the last valid community in this tab. An explicit community link takes precedence; it never grants access to another person's character or creator settings.
An authenticated streamer page may send a short activity heartbeat while visible, focused and used within the last three minutes. An active indicator expires after 75 seconds without a fresh signal. This indicates Community Raiders website use, not a Twitch broadcast or continuous attention. Presence is held only in server memory, separated by page/session, and is not an analytics history. Restarting the service starts with no activity signal; inactive markers age out after one hour. The current service uses one application worker.
Chat permission setup
When this separately controlled setup feature is enabled, starting bot or channel authorization uses an essential API-host nonce cookie: __Host-cr_chat_bot_oauth or __Host-cr_chat_channel_oauth. These are host-only, Secure, HttpOnly and SameSite=Lax, and expire after ten minutes. The browser-bound pending request also records hashed state/nonce, the current creator session identifier hash, purpose and expected account/community. Requests are valid for ten minutes; expired records are pruned at startup, new starts and the periodic cleanup loop.
Successful setup records only a historical verification receipt: Twitch ID/login, app ID, authorized scope names, verification time, token-check expiry and the verifying creator ID. Access and refresh tokens from these setup callbacks are discarded after the immediate identity/scope check; they are not saved in this setup feature or shown in the browser. Existing creator and Raiderville session-token handling described above stays separate. Receipts have no automatic deletion schedule yet; privacy requests can use the contact above.
A receipt does not mean permissions are still current, does not activate chat and does not authorize messages. Signing out does not revoke Twitch permissions. You can review or revoke this app in Twitch connection settings; future activation must check the current permissions with Twitch. No chat messages, arbitrary chat history or new optional browser preferences are recorded by this setup feature.
Your privacy choice
The localStorage record community-raiders:privacy:v1 saves only whether you allow remembered sound preferences, so we can respect your choice without asking on every page. It contains no account identifier or tracking ID.
Optional remembered sound
Remembering sound is off until you choose to allow it. The first-visit Accept & play Music button explicitly allows remembered sound and starts music from that click. Reject optional dismisses the prompt silently. In Settings, you can allow remembered sound without starting music; its separate Play music now checkbox is unchecked by default. The compact player keeps quick pause, mute and volume controls. If allowed, community-raiders:music:v1 remembers music volume, mute, playback position and play/pause intent. A playback ownership marker helps cooperating tabs avoid playing over one another. These values stay in this browser and are not sent to our API as analytics.
When enabled, a new page attempts to resume music from the saved position. Browser sound policy can still require another click. Full page navigation may create a short gap; successful playback does not confirm that your device is audible.
Choose Reject optional or turn off Remember sound preferences and save to withdraw permission. This removes the saved music record and prevents further optional storage access. Music you explicitly started may continue in memory until paused or you leave the page. Sign-in cookies are unaffected. Without permission, music can still play after you press Play, but it is not remembered across pages and persistent cross-tab coordination is unavailable.
Storage duration and other technologies
LocalStorage stays until you withdraw the optional choice or clear this site's browser storage. The privacy-choice record remains to remember the choice; clearing it makes the first-visit prompt appear again. The initial red-and-gold bottom bar offers a red Accept & play Music action and clearly discoverable grey Reject optional and Settings actions; Escape rejects without granting permission. Its subtle backdrop does not block the website, and this privacy page stays unblurred. SessionStorage is scoped to the browser tab. If browser storage is blocked, controls still work for the current page but cannot promise to remember your choice.
No analytics or advertising integrations were found in the reviewed website build. This page covers the browser storage controls described above.