Nugget Streams Privacy Policy
Version 1.0.
Last updated: 2 October 2026. Effective on the day the app is published.
Part of the Terms of Service. US only. You must be 16 or over.
The short version. We collect what the app needs to work and nothing else. Checking that a line was said runs entirely on your phone and sends nothing anywhere. A move in Move It is checked on your phone too, by Google software that tells Google how it is performing. Google never gets your video or your sound. Some Find It finds and every Hunters find are checked from a photo sent to our server. Section 3 has all of it. We do not build a faceprint or a voiceprint, we do not do face recognition, and we never sell your data or share it for advertising.
1. Who to write to
[LEGAL ENTITY NAME], a Wyoming limited liability company, [REGISTERED ADDRESS], United States. privacy@nuggetstreams.com reaches a person.
2. What we collect
When you make an account
| A handle, and an email address or a phone number | So you can sign in and we can reach you |
| A password, stored only as a salted hash | We never see it and cannot recover it |
| An age range from your Apple or Google account | Section 6 |
| The version of the Terms you accepted, and when | Because you are entitled to know what you agreed to |
You can watch without an account. If you do, we hold nothing that identifies you.
When you buy a line
The words of your line, what you paid, and when. Your card details go straight to Stripe and never touch our servers. We keep the last four digits and the card brand so you can recognise a refund.
When you go live
Your stream, and the clips cut from it. The city you are in. How long you streamed and how many deliveries counted. What Stripe tells us about your payout account, which is whether you can be paid and what it still needs, never your bank details or your identity documents.
Automatically
Your device type and operating system version, crash reports, and rough usage so we can tell what is broken. IP address, kept for 30 days, for security and fraud. No advertising identifiers, no analytics or advertising SDKs, no tracking pixels. The one piece of outside software that reports anything by itself is Google's MediaPipe, in Move It, and section 3 says what it sends.
3. The checks, in detail
This is the part people ask about, so here it is precisely.
Saying a line and doing a move are checked in real time while you are live, on your phone, and none of that is stored on our servers or seen by us. Finding an item works differently, and it is at the end of this section.
Speech. A speech model turns what you say into text, which is compared with the line you were given. It matches words. It does not build a model of your voice. There is no voiceprint, no speaker identification and no speaker enrolment anywhere in the app, and we never receive your audio.
Streams are in English, and the model runs on your phone, so the audio never leaves it. You install it once, it is about 76 MB, and it works with no connection at all.
A person in frame. An on-device model decides whether a person is in the picture. It answers is there a person, and nothing else. No face detection, no face geometry, no face recognition.
Telling one person from another. So the same person cannot be counted twice, the app compares the colour of what people are wearing, in three horizontal bands, using a colour histogram. The source file says it in the first line of its own comments: "NO FACES. Nothing in this file looks at a face, and nothing in it may ever be changed to."
It is short lived and then it is gone. The comparison data exists only while the camera is looking, is held in memory rather than written down, and is destroyed when the stream ends. It never leaves the device.
We do not collect biometric identifiers or biometric information as those terms are used in the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, or the Washington biometric statute. We do not scan or map facial geometry, we do not create voiceprints, and we do not use face recognition. If that ever changes we will ask you first, in writing, before collecting anything, and publish how long it is kept and when it is destroyed.
A move. In Move It, the body check and every move are read on your phone by MediaPipe, software made by Google, from where your body is in the picture. MediaPipe sends Google figures about how well it runs and how much it is used, and never your video or your sound: Google's own notice for it says so, and Google's privacy policy covers that data. Your stream and the clips cut from it come to us, the same as in every mode (section 2).
An item in Find It. Most items are recognised on your phone and nothing is sent. For some, your phone sends one still of what the camera is pointing at to our server, where an AI model run by Cloudflare answers whether the item is in it. We do not keep the still.
A find in The Hunters. Every find sends a still to our server, and some items are checked from it by the same AI model. We keep the still of every find with the race's result, so a person can check a win. A still the model says no to is not kept.
4. What we do with it
- Run the service. Show streams, put lines in queues, count deliveries, pay people.
- Take payment and pay out, through Stripe.
- Keep it safe. Fraud, abuse, and stopping somebody getting into your account.
- Moderate. Section 5.
- Support. Answering you when you write in.
- Obey the law, when we are properly required to.
We do not sell your personal information and we do not share it for cross context behavioural advertising, as those terms are defined under California law. We have never done either and we have no plans to. We do not use your content to train any AI model.
5. Moderation, and the AI that reads your line
Every line is screened before it can be bought. A first pass runs on our own servers against a word list. Anything that gets past it is read by a third party AI classifier, which sees the 30 characters of the line and nothing else: not your handle, not your account, not your location, not your payment details.
We are naming this specifically because Apple requires it, and because you should know before you type. If you would rather no third party service saw your line, do not post one.
Reported streams and clips are reviewed by a person, not by an automated system, and no account is ever closed by software alone.
6. Age
16 and over to use Nugget Streams at all. 18 and over to go live or be paid.
We read an age range from your Apple or Google account. That range was set by the account holder or their parent. We call it confirmed, never verified, because it is a declared range and not an identity check. We do not ask for your birthday, we do not check your identity, and in most of the country the platforms return nothing at all.
We keep only the band, not a date of birth, and we delete what the store sends us once we have read it.
If you are 16 or 17, we do not sell your personal information, we do not share it for targeted advertising, and we do not profile you. Consent does not change this and you cannot opt in to it, because Connecticut and Maryland prohibit it outright and we apply that everywhere rather than running two versions.
Nobody under 16. We do not knowingly collect anything from anyone under 16. If you believe a child has an account, write to privacy@nuggetstreams.com and we will delete it. A parent or guardian of a 16 or 17 year old can close the account and get the unspent balance back by writing to the same address, and we will not make it difficult.
7. Who else sees it
| Stripe | Payments and payouts. Your card and, if you get paid, your identity documents go directly to Stripe under Stripe's own privacy policy. We never see them. |
| Cloudflare | Hosting, the database, the live video, and the AI model that checks a Find It or Hunters photo. Section 3. |
| Apple and Google | Distribute the app and provide the age range and push notifications. |
| Google, through MediaPipe | Figures about how the software that checks moves is running. Never your video or your sound. Section 3. |
| A third party AI classifier | The 30 characters of a line, and nothing else. Section 5. |
Nobody else. No data brokers, no advertisers, no analytics companies.
If the business is ever sold, information moves with it, and we will tell you before it does.
8. How long we keep it
| Your account | Until you delete it |
| The raw stream | 7 days, then deleted |
| Clips | Until deleted by whoever they belong to, or on a takedown. Terms section 7 says the order |
| Lines and delivery records | 7 years, because they are financial records |
| Payment records | 7 years, for tax and the card networks |
| Moderation records | 2 years |
| IP addresses | 30 days |
| The delivery check data | Never stored. Destroyed when the stream ends. |
| A Find It still | Not kept. It is checked and dropped |
| Stills of Hunters finds | Kept with the race's result, so a win can be checked |
9. What you can ask for
Anyone, anywhere, whatever your state says. We do not check which state you are in before honouring one of these.
- A copy of what we hold about you.
- A correction, if it is wrong.
- Deletion. In the app under Settings, and at nuggetstreams.com/delete without opening the app.
- To know what we collect and who sees it, which is this document.
- To opt out of sale or sharing. There is nothing to opt out of, because we do not do either.
- Not to be discriminated against for asking. Nothing about your account changes.
Write to privacy@nuggetstreams.com. We answer within 45 days, and we will tell you if we need longer. If we turn a request down we say why, and you can appeal to the same address; if we get the appeal wrong you can complain to your state Attorney General.
Some things survive deletion because the law requires it: payment records, moderation records, and anything under a legal hold. Section 8.
Withdrawing permission for the camera, the microphone or location is in the app's own settings as well as your phone's, and the app keeps working for everything that does not need them.
10. Security
Session tokens are 32 random bytes and only their SHA-256 hash is stored. Passwords are PBKDF2 with 100,000 rounds, a per user salt, and constant time comparison. Everything travels over TLS. Admin actions are logged with who did what, to whom, and why.
No system is perfect. If there is ever a breach affecting you, we will tell you and the regulators we are required to tell, without waiting to be asked.
11. People who appear in a stream and never used the app
You are not our user and nothing here binds you.
If you appear in a stream, you can have it removed with no account, no app and no explanation at nuggetstreams.com/takedown, linked from every video. It comes out of public view when we receive it and we review it afterwards. We aim to reply within 24 hours and to delete it everywhere within 72. We never tell the streamer who asked.
We do not run face recognition and we do not try to identify anybody in a stream. Streamers are forbidden from naming, describing or identifying anyone.
12. Changes
If we change something that matters we will tell you by push and email 30 days before it takes effect, and ask you to accept it. Smaller corrections are posted with a new date. Every version stays at nuggetstreams.com/privacy.
privacy@nuggetstreams.com for anything in this document.
nuggetstreams.com/takedown if you are in a video and would rather not be.