Privacy Policy

Last updated: July 30, 2026

Introduction

Dirework is self-hosted, open-source software. Each instance is independently deployed and operated. This policy describes the software's default data handling; the operator of the instance you use is the data controller responsible for its configuration, retention, and legal obligations.

Who Operates This Instance

Instance operators: Replace this section with your name or organization and contact details before deploying. Users should know who is responsible for this instance.

Eligibility

You must be at least 13 years old to use Dirework, consistent with Twitch's minimum age requirement. If you are under 18, you must have the consent of a parent or legal guardian to use this service.

Data We Collect

The following data may be stored in the instance's Cloudflare D1 database.

Authentication Data

Twitch user ID, username, display name, and profile image URL — retrieved through Twitch OAuth when the owner signs in.
Session records and cookies — used to keep the owner signed in. Session cookies are secure, HTTP-only, and SameSite Lax in production; sessions expire after 30 days.

Bot Account Data

Bot Twitch user ID and username — identifying the connected bot.
Bot OAuth access and refresh tokens — credentials that let the bot read and send chat messages. They are stored in D1. The refresh token never leaves the server; an access token is returned only to a caller that presents the bot console bearer token and needs to open the Twitch chat connection.

Configuration and Task Data

Timer settings, overlay styles, phase labels, bot command settings, aliases, and response templates.
Tasks submitted through Twitch chat, including task text, status, author display name, author Twitch ID, and chat color.

Bearer Tokens

Random bot and overlay tokens are stored so OBS and the bot console can use token-gated pages without an owner session. Anyone who obtains one of these URLs can use that page until the operator regenerates its token.

Operational Logs and Metrics

Dirework does not include product analytics, advertising trackers, or third-party tracking scripts. It does emit limited operational logs and metrics to the operator's Cloudflare Workers account so failures and abuse can be diagnosed. The application uses fixed event names and status labels and is designed not to record request bodies, authorization headers, session cookies, bearer tokens, OAuth tokens, or Twitch chat messages.

Cloudflare may also process ordinary network and request metadata as the hosting provider. What is retained and who can access it depends on the instance operator's Cloudflare plan and logging configuration.

Twitch chat messages are not persisted by Dirework. A command can still create or update a stored task, and the resulting task text is retained as described above.

How Data Is Used

Data is used only to authenticate the owner, operate the Twitch bot, execute timer and task commands, save configuration, render overlays, prevent abuse, and diagnose service failures. Dirework does not use stored data for advertising or user profiling.

Third-Party Services

Twitch (id.twitch.tv, api.twitch.tv, and Twitch IRC) provides authentication, bot authorization, profile data, and chat transport. Twitch processes data under its Privacy Notice.
Cloudflare hosts Workers, D1, rate limiting, and operational logs or metrics. Cloudflare processes data under the operator's Cloudflare agreement and configuration.

A fork may add other services. Instance operators must update this policy if they do.

Data Storage and Security

Application data is stored in Cloudflare D1 and processed by the two Cloudflare Workers belonging to the instance operator. Dirework applies owner checks, bounded input validation, rate limits, secure session-cookie settings, redacted error logging, and token-gated public routes.

Bot OAuth tokens are sensitive. Dirework does not currently add application-layer encryption to their D1 columns, so operators must tightly restrict Cloudflare and GitHub access, use MFA, and rotate credentials after any suspected database or account disclosure.

The instance operator is responsible for account security, least-privilege access, backups, log retention, incident response, and compliance with applicable law. See the repository's security policy for the production checklist and private vulnerability-reporting process.

Data Retention

Sessions — expire after 30 days.
Tasks — remain until cleared by the operator or a permitted chat command.
Configuration and account data — remain until removed by the operator.
Bot OAuth credentials — remain until the bot account is disconnected.
Bearer tokens — remain until the operator regenerates them or removes the instance data.
Operational logs and metrics — follow the operator's Cloudflare settings and retention period.

Backups or exported data may persist separately until the operator deletes them.

Your Rights

Direct instance-specific requests to the instance operator. Depending on applicable law, you may request access, correction, export, or deletion of stored data. You can disconnect the bot account, revoke Twitch access in Twitch Connections Settings, and ask the operator to regenerate exposed bearer URLs.

Instance operators: Add a working privacy contact and a process for handling access and deletion requests before making the instance public.

Software-level questions or security reports — use the channels in the repository's security policy.
Instance-specific privacy requests — contact the instance operator directly.