Privacy Policy

This is a standard template and should be reviewed by a licensed attorney before launch.

CH Entertainments LLC ("we", "us") owns and operates StreamHub (also called VibeMatch). This policy explains what information we collect, how we use and share it, how long we keep it, and the choices and rights you have. It applies to the StreamHub website and apps (the "Service"). By using the Service you agree to this policy.

The short version. We collect what we need to run the Service and keep it safe: your account, what you post, and technical records such as your IP address and device model when you sign up, sign in or go live. We do not sell your personal information, we do not use advertising trackers, and we never collect your exact location. Location is optional: only if you tap "Use my location" do we keep a rough area about 3 miles wide, which you can turn off at any time. We may share information with law enforcement when legally required or to protect people's safety.

1. Information we collect

Information you give us

Account information: username and password (stored only as a salted hash), your confirmation that you are 18 or older, and your agreement to our terms.
Security information: if you turn on 2-step verification, we store an encrypted authenticator key and hashed one-time recovery codes, and we record sign-ins, failed sign-ins, lockouts and security changes (such as turning 2-step verification on or off) with your IP address.
Profile information: profile picture, photos, bio, stream title and a city you may type in (optional).
Content: live video and audio you broadcast, chat messages, posts, comments, likes, gifts, and reports you send.
Transactions: virtual coin balances, gifts sent and received, Super Fan subscriptions. Coin purchases are paid by card through our payment processor, Stripe, which collects and holds your card details; we receive only the result of the payment (see "Payment and fraud signals" below).
Direct messages: private messages you send to other users. They are stored on our servers so the other person can read them. Either person can delete the conversation from their own side; a copy may be kept if it is reported (see below) or a legal request requires it.
Email address (optional): if you add one, it is used for a verification code, password resets and important account notices. We do not use it for marketing.
Phone number (optional): if you verify your account, you enter a US mobile number so we can text you a one-time code. A text-message and number-lookup provider receives the number to send the code and to check that it is a real mobile number and not an internet (VoIP) number. After verification we keep only the last 4 digits and a one-way hash of the number (used to stop one number from verifying many accounts), not the full number.
Payment and fraud signals: when you buy coins, our payment processor tells us the result of card checks (security code, ZIP, 3D Secure), a card fingerprint that does not reveal the card number, and any refund or dispute. We use these, along with your account age, verification status and purchase and gift history, to stop fraud, and we may send the processor records of your account activity to answer a dispute.
Communications: emails you send us.

Information collected automatically

IP address and network information, with the date and time, when you create an account, sign in (successfully or not), accept our terms, or start a broadcast.
Device and browser information sent when you sign up or sign in: device platform and model, operating system version, app version, browser type (user agent), screen size, language and time zone.
Usage information: which channels you watch and the chat you take part in (while connected), follows and subscriptions, and ad views and clicks (counted per ad, not tied to your profile).
Push notification token: if you allow notifications in the app, we store a token from your phone's notification service (Expo, and Apple or Google) so we can send alerts such as messages, gifts, new followers and "someone you follow is live". You can turn alerts off in Settings or in your phone.
Crash and error reports: when the app or website hits an error, it may send us the error message, device details and your username so we can fix it.
Recordings: live streams, including what a guest shows inside someone's Date Box or Guest Box, are automatically recorded and kept for 72 hours so the streamer can save a replay and so we can review reports. Replays and clips are kept until their owner deletes them. When a stream or chat message is reported, we may keep a copy of the video, chat and messages as evidence.
Blocks and moderators: your block list and the chat moderators you appoint.
Automated safety checks: about every 20 seconds our server takes a still picture from each live stream (public or private) and an automated tool checks it for nudity. If it is very sure, the stream can be ended automatically; if it is less sure, a person may look at the picture. Pictures that are flagged or lead to a stream being ended are saved for review (14 days if cleared, up to 90 days otherwise) and are only seen by our admins. Pictures that are not flagged are not kept. The tool runs on our own server; the pictures are not sent to other companies. If you think a stream was ended by mistake, contact support.
Approximate location (optional): if you tap "Use my location" in Nearby or Meet, your device sends its position once while the app is open (we do not track you in the background). We immediately round it to a square about 3 miles wide and keep only that rounded square and the time, never the exact spot. It is used to put people closer to you first in Nearby and Meet, and other people only ever see distances such as "within 10 miles", and only if they have turned it on too. It is not sold or shared, it counts as off after 7 days without an update, and you can turn it off at any time in the same screen, which deletes it. It is deleted with your account and is included in your data download. Staff cannot see it.
Safety records: reports made about you or by you, moderation actions, and (for legal compliance) records of when you accepted our terms.

What we do not collect

We never collect or keep your exact location. The "city" shown on your profile is only text you type. We may be able to infer a general area from your IP address, as any website can. Using your phone's or browser's location is optional and off unless you choose it (see "Approximate location" above).
We do not access your contacts, and we do not read your photo library. The app only receives pictures you choose to upload.
The camera and microphone are used only while you broadcast or use Date Box, and only after you give permission on your device.

2. Cookies and similar technologies

The website stores your sign-in token and a few preferences in your browser's local storage and session storage. These are needed to keep you signed in and remember choices (for example which home tab you last viewed). We do not use advertising cookies or third-party analytics trackers. The mobile app stores your sign-in token and server address in your device's secure storage. You can clear this by logging out or clearing site data. Because we do not track you across other sites, we do not respond to "Do Not Track" signals.

3. How we use information

To run the Service: create accounts, show streams and chat, process gifts and subscriptions, show profiles and posts.
To keep the Service safe and lawful: detect and prevent fraud, abuse, spam and underage use; enforce our rules; investigate reports; and respond to legal requests.
To show you ads that we select ourselves (we do not use data about your activity to target ads, and we do not share your data with advertisers).
To improve and fix the Service and to communicate with you about it.
To comply with law and protect our rights and the rights and safety of others.

4. How we share information

Publicly: your username, profile picture, bio, city (if you add it), photos, posts, comments, followers and following lists, stream and chat are visible to other users and to anyone with the link. Anyone who sees your stream can record it.
Service providers: companies that host and deliver the Service for us (for example servers, hosting and network providers). They may only use the information to provide services to us.
Technical services used by the website: the website loads a video-playback library from the jsDelivr content network, and, if you use face-tracking in the web studio, a face-detection library from jsDelivr and a model file from Google. Broadcasting from a browser uses Google's public STUN service to set up the connection. These services can see your IP address and basic request information as part of delivering those files or connections.
Legal reasons and safety: we disclose information when we believe it is required by law (for example a subpoena, court order or search warrant), or necessary to protect someone's life or safety, investigate or prevent crime, fraud or abuse, or enforce our terms. This can include account information, IP addresses with timestamps, device information and content. We report apparent child sexual abuse material and child exploitation to the National Center for Missing & Exploited Children (NCMEC) as required by federal law. See our Law Enforcement Guide.
Business transfers: if we are involved in a merger, acquisition, financing or sale of assets, information may be transferred, subject to this policy.
With your consent or at your direction.

Creator tax and payout information. If you choose to join the Creator program, we collect the information on IRS Form W-9: your legal name, business name, federal tax classification, address and Social Security Number or EIN, plus your electronic signature record (typed name, date and time, IP address, device) and a ledger of payments we make to you. We encrypt your tax ID, show only its last four digits in the product, let only authorized admins with two-step verification read it, and record every time it is read. We use it only for tax reporting to the IRS and states, identity and fraud checks, paying you, and legal compliance. We keep tax and payment records for at least 7 years, even after you close your account, then delete them. We do not sell this information.

We do not sell your personal information and we do not share it for cross-context behavioral advertising.

5. How long we keep information

Information	How long
Account, profile, posts, photos, comments	Until you delete them or your account. Deleting your account removes them from the Service (copies in our automatic database snapshots are deleted when those snapshots rotate out, within about 14 days).
Sign-in, IP address, device and consent records	180 days after the event, including after you delete your account, for security, abuse prevention and legal compliance. Records may be kept longer if needed for a legal request, investigation or preservation order (a "legal hold"). When a report involves a possible minor, the related records and any saved video are kept for one year, as the law requires.
Stream recordings	72 hours, then deleted automatically, unless saved as a replay by the streamer or kept as evidence for a report.
Replays and clips	Until the owner (or an administrator) deletes them, or the account is deleted.
Direct messages	Until the conversation is deleted by both people or an account is deleted. Reported conversations may be kept as long as needed to review the report.
Notifications, push tokens, error reports	Notifications are trimmed automatically; push tokens until you sign out of the phone, turn alerts off or delete your account; error reports for a short period.
Reports and moderation records	As long as needed to enforce our rules and meet legal obligations.
Creator agreement, W-9 information and payment records	While you take part in the Creator program, and at least 7 years after your last payment (or longer if the law requires), even if you delete your account. If you were never paid, they are deleted when you delete your account.
Transaction and coin ledger records	As long as required for accounting, tax and legal purposes.

6. Security

We use reasonable safeguards such as hashed passwords, signed sign-in tokens and access controls. No system is perfectly secure, so we cannot guarantee absolute security. Tell us at [CONTACT EMAIL] if you believe your account was compromised.

7. Your choices and rights

Edit or delete: you can edit your profile, delete posts and photos, and delete your account in the app and website.
Download your data: in the app (Profile) and on the website (Settings) you can download a copy of the personal data we hold about your account.
Permissions: you can turn off camera, microphone and photo access in your device settings.
Request a copy or correction: email [CONTACT EMAIL]. We will confirm your identity (for example by asking you to write from within your signed-in session or by confirming account details) before releasing or changing information.

California and other US state privacy rights

Depending on where you live (for example California, Colorado, Connecticut, Virginia, Texas, Utah, Oregon and other states), you may have the right to: know what personal information we collect, use and disclose; access and get a copy of it; correct it; delete it; opt out of the "sale" or "sharing" of personal information (we do neither); limit use of sensitive personal information (we do not use it for purposes that require this right); and not be treated unfairly for using these rights. To use these rights email [CONTACT EMAIL] with the subject "Privacy request". You may use an authorized agent. We will respond within the time required by law (generally 45 days). If we deny your request, you may appeal by replying to our response, and you may contact your state attorney general.

California categories (last 12 months): identifiers (username, IP address, device identifiers); internet or network activity (sign-in and usage records); commercial information (virtual coin and gift transactions); audio, electronic and visual information (streams, photos, voice); and inferences are not created. We collect these directly from you and from your device, use them for the purposes in section 3, and disclose them for the reasons in section 4. We do not sell or share personal information and have no actual knowledge of selling or sharing information of consumers under 16.

8. Children

The Service is only for people who are 18 or older. We do not knowingly collect information from anyone under 18. If you believe a minor is using the Service, email [CONTACT EMAIL] and we will investigate and remove the account.

9. Where information is stored

Information is processed and stored in the United States. If you access the Service from elsewhere, you are sending your information to the US.

10. Changes to this policy

We may update this policy. If a change is important we will notify you in the app or website and ask you to accept the new version. The date of the current version is shown below.

11. Contact

CH Entertainments LLC
[COMPANY ADDRESS]
Email: [CONTACT EMAIL]

Version 2026-10-25.1