Vods
Browse auctions

Draft, not yet in effect. This policy is waiting for legal review. The parts in square brackets are still to be filled in.

Privacy policy

Last updated: October 22, 2026

Who we are

Vods is a marketplace where creators auction sponsorship slots on their upcoming streams and videos, and advertisers bid for them. Vods is run by Vods, Inc., 7190 W Sunset Blvd, Los Angeles, CA 90046, United States (“Vods”, “we”). This policy explains what we collect about you, why, who else sees it, and the choices you have.

For any question about your data, write to support@vods.com.

What we collect

Your account

  • Your name, your email address and whether you have confirmed it, and your password, which we store only as a salted hash.
  • When you choose a password, we check it against known data breaches by sending Have I Been Pwned the first five characters of a hash of it. The password itself never leaves our servers.

Signing in with Google

If you sign in with Google, we ask only for Google’s basic sign-in permissions, and Google tells us your name, your email address (only one Google has confirmed), your Google account id and the address of your Google profile picture. We don’t keep Google’s access or refresh tokens. Signing in with Google is separate from connecting a YouTube channel, which asks for its own permission.

Your profiles

  • A creator profile: your display name, your about text, up to five additional links, the picture and banner you upload, and the advertiser categories you refuse. Until you upload a picture or a banner, your creator profile uses those of one of your channels whose details you approved showing to advertisers (Showing your numbers to advertisers); failing that, in your own account area only, your Google profile picture, if you signed in with Google.
  • An advertiser profile: your company or brand name, its website, a description, the logo and banner you upload, and the category of what it sells.
  • The address of each channel you add, and, once you connect it, what its platform tells us (Connected channels).
  • Which version of our terms and this policy you accepted, and when.

Auctions, bids and orders

  • The auctions you list: the slot, its terms, the stream or video it is on, and its picture if you add one.
  • Your bids: the amount, the maximum you set for automatic bidding, the time, and the IP address and browser you bid from. Your maximum is never shown to anyone else.
  • Your orders: the creator’s acceptance or rejection and its reason, the ad material (scripts, links and files), proof of delivery (replay links, timestamps, the viewer numbers the creator reports, screenshots or clips, and their confirmation that the ad was disclosed), disputes with their proposals and evidence, refunds and payouts.
  • The result of each check that an order’s replay is still up (Replay checks), and an advertiser’s report that it is gone.
  • Strikes, for an auction won and not paid for or for a replay taken down before its retention term ended, and the orders that ended because one side did not do its part.

Payments

  • Card details go straight from your browser to Stripe, our payment provider, and never reach our servers. From Stripe we keep each card’s brand, last four digits, expiry date and a fingerprint that tells cards apart without revealing their numbers, for every card you have saved.
  • To pay a creator, Stripe runs its own onboarding and identity checks and holds their bank details. We keep the creator’s Stripe account id, its country, whether it can receive payouts, what Stripe still needs from them, and their bank’s name, the last four digits of the account and a fingerprint of it.
  • A record of every charge, fee, refund and payout on each order, and of what is held back from a creator’s payouts to recover a refund made after their share was released.

Messages, comments and reviews

  • The messages you send in an order’s thread.
  • The comments you post on auctions, including ones later removed.
  • The reviews you write and the replies you post.

Reports, blocks and watched auctions

  • The reports you make: what you reported (a listing, an advertiser, a comment or an order’s thread), the reason you chose and any details you add.
  • The accounts you block, the order you blocked each one from, and when.
  • The auctions you watch, and when you started watching each.

Your account’s standing

The warnings, bid limits, payout holds and suspensions the Vods team applies to your account, with its reasons and when each is lifted, and the cases opened about your account or your orders, with the team’s decisions (Fraud checks, reports and sanctions).

Security and technical data

  • For each signed-in session, the IP address and browser it started from, and when.
  • For each device you sign in from, its browser and operating system (such as “Chrome on Windows”, never the full browser string), and when it was first and last seen. We keep these to notice a sign-in from a new device and email you about it. That email names the device, the time, the IP address and the approximate place, and we keep a record of what it said.
  • The approximate place (city and country) an IP address is in. We work it out on our own servers, with MaxMind’s GeoLite2 database held there, so no address is sent to MaxMind. It is shown in the new-device email and in the list of devices signed in to your account. This product includes GeoLite Data created by MaxMind, available from https://www.maxmind.com.
  • The list of devices signed in to your account, in your settings, shows you each one’s browser and system, IP address, approximate place, and when it signed in and was last active.
  • If you turn on two-step sign-in: the secret your authenticator app shares with us and your one-time backup codes, both stored encrypted.
  • Our server logs record each request’s method, the address asked for (with any tokens removed), the result and how long it took. They do not record your IP address or what you sent.
  • Reports of errors in our software (Who we share it with).

Connected channels

A creator proves a channel is theirs by connecting it: through the platform’s own approval screen for YouTube, Twitch and Kick, and with a Livestream API link for Rumble. A channel you only typed the address of is shown to nobody but you and the Vods team, and we never fetch anything from it.

The access a platform gives us, and a Rumble link, are encrypted before they are stored, with a key kept outside our database. They are used only by our servers, never sent to a browser and never written to our logs.

We read each connected channel again regularly, so what we keep stays current: YouTube and Rumble about every 20 hours, Kick about every 11 hours and Twitch every hour.

Disconnecting a channel, on your Channels page, ends our access (we ask the platform to end it first) and deletes everything we read from the platform about the channel. Auctions and orders keep the channel’s name and address as the record of what was sold, and orders keep the results of their replay checks (Replay checks).

Showing your numbers to advertisers

On every platform, a channel’s details and figures are shown on your listings only if you approve it. Before you connect a channel, the connect step says plainly that connecting lets Vods show advertisers its details and numbers on your listings, where its platform gives them:

  • The details: its handle, pictures and description, its upcoming scheduled streams, its category, language and country, and on Twitch its tier.
  • The numbers: its subscribers and followers, its views, its recent streams with their numbers, and for YouTube, YouTube Analytics figures such as views, watch time, viewers and your audience’s shares by age group and by gender.

Each platform gives only some of these: its section below says what we read from it. Listings are public, so anyone who views one, advertisers included, sees what you approved.

  • Each connected channel has a “Show my numbers to advertisers” switch on your Channels page. Turning it off hides that channel’s details and figures from your listings at once, and you can turn it back on at any time.
  • With the switch off, your listings show only the channel’s name and a link to it.
  • We record the date you gave your approval.
  • You always see your own channel’s figures on your Channels page.

YouTube

Vods uses YouTube API Services. If you connect a YouTube channel, you agree to the YouTube Terms of Service, and Google’s use of your information is covered by the Google Privacy Policy.

What we ask for

Two read-only permissions, asked together on Google’s own screen: to see your YouTube account, and to see YouTube Analytics reports for your channel. We never ask for revenue reports, and we cannot upload, change or delete anything on YouTube.

What we read and keep

  • Your channel: its YouTube id, name, handle, address and description, the addresses of its picture and banner (the images stay on YouTube’s servers), when it was created, whether live streaming is switched on, and, where it names them, its country and the language of its title and description.
  • Its public counts: subscribers (none if you hide the count), videos and total views.
  • From YouTube Analytics, for the last 28 days: views, watch time, average view duration, subscribers gained and live views; and your audience’s shares by age group and by gender, where YouTube provides them.
  • Your ten most recent completed live streams: their titles, dates, lengths, views, and average and peak concurrent viewers.
  • The next few live streams you have scheduled: their titles and start times.
  • The access Google gives us, encrypted.

We show these figures as YouTube returns them. We don’t combine them across channels or work out new figures from them.

When you send proof for an order, and then daily while we check its replay (Replay checks), we use your connection to ask YouTube whether the replay is a video on your channel that others can still watch. We keep only the result of each check, in our own words: never what YouTube says about the video.

How we use it

To prove the channel is yours, which you need before you can list an auction on it; to show the channel and its figures: to you on your Channels page and, only if you approve it, on your listings, so advertisers can see the audience they are bidding for (Showing your numbers to advertisers); and to check that an order’s replay is still up for its retention term.

How long we keep it

We read it again from YouTube about every 20 hours. Anything we have not been able to refresh for 30 days stops being shown and is deleted. We keep only the channel’s name, address and YouTube id, as the record of which channel you proved, until you disconnect it, and the results of replay checks, which stay with their order.

Taking back access and deleting your data

  • Disconnect the channel on your Channels page: we ask Google to end our access, then delete the YouTube data we hold at once, except the results of replay checks, which stay with their order.
  • Or remove Vods’ access in your Google security settings. Our next refresh is then refused, your channel asks to be reconnected, and its YouTube data is deleted within 30 days.
  • Or ask us to delete it, at support@vods.com. We delete the platform data we hold about you within 7 days of your request.

Twitch, Kick and Rumble

Connecting one of these platforms may not be open to you yet. What we read from them is shown to you on your Channels page and, only with your approval, on your listings, as YouTube’s is (Showing your numbers to advertisers).

Twitch

One permission, to read your subscriber count. We keep your Twitch account id, login, display name, description, creation date and the address of your picture; your follower count and, for affiliates and partners, your paid subscriber count; your tier (partner, affiliate or standard); what you stream (your category) and your language; your recent past broadcasts with their titles, dates, lengths and views; and your next few scheduled streams with their titles and start times. Twitch lets this be kept for 24 hours: we read it again every hour, and stop showing it and delete it once it is 24 hours old.

When you send proof for an order on Twitch, and then daily while we check its replay (Replay checks), we ask Twitch, with Vods’ own access rather than yours, whether the replay is still up on your account. We keep only the result of each check.

Kick

Two permissions, to read your account and your channel. We keep your Kick account id, name, channel name, description, the addresses of your picture and banner, your paid and gifted subscriber counts, and your category and the language of your stream. Kick’s answer also holds your email address, and your stream’s address and key: we don’t read, keep or log any of them. Kept for 24 hours, as Twitch’s is.

Rumble

Rumble has no approval screen: you paste your Livestream API link, which works like a password, so we encrypt it as we do the other platforms’ access. From Rumble’s answer we keep only the account’s or channel’s id and name and its follower, paid subscriber and gifted subscriber counts. The answer also holds your stream key, recent followers’ names, what subscribers paid and your chat: none of it is kept. Disconnecting deletes our copy of the link; the link itself keeps working until you reset it on Rumble.

Google user data

Vods’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • We use Google user data only for the features this policy describes: signing you in, proving your channel, showing your channel and its figures on Vods, and checking that an order’s replay is still up.
  • We never sell it, never use it for advertising or to judge creditworthiness, and never pass it to advertising platforms or data brokers.
  • We don’t transfer it to anyone else, except to show your channel and its figures on your listings with your approval, as described above; to tell an order’s advertiser that its replay is no longer available; to comply with the law; or for security.
  • Nobody at Vods reads it unless you ask us to, or it is needed for security (such as investigating abuse or a bug) or to comply with the law.

Replay checks

A creator promises to keep an order’s replay up for its retention term. Vods checks it through the platform’s own API, never by loading the platform’s pages:

  • When a creator sends proof, we check that the replay is on the order’s channel: on YouTube and Twitch by asking the platform about the video, on Kick by the channel its address names. A Rumble replay’s address is checked only for being on Rumble.
  • Then we ask YouTube or Twitch daily, while the retention term runs (a permanent replay, for a limited time after it airs), whether the replay is still up. Kick and Rumble replays are not checked this way. A YouTube check uses the creator’s own connection to the channel; a Twitch check uses Vods’ own access to Twitch.
  • The result of each check stays with the order: whether the replay was available, gone or could not be checked, and why, in our own words.
  • A replay found gone on two checks in a row opens a case for the Vods team, and both sides of the order are emailed. While the term runs, the advertiser can also report the replay gone, on any platform, which opens the same case.

How we use it

  • To run your account and keep it secure: signing in, two-step sign-in, confirming your email address, resetting your password, refusing breached passwords and telling you of a sign-in from a new device.
  • To run auctions and orders: listings, bids, winners, charging the winner, holding the payment, delivery, disputes, refunds and payouts.
  • To show creators’ channels and figures to advertisers, with each creator’s approval, and each figure marked with where it came from.
  • To check delivery: that an order’s replay is on its channel and stays up for its retention term (Replay checks).
  • To send the emails your account and your orders need: confirmations; security notices, such as a sign-in from a new device, a password change or two-step sign-in switched on or off; outbid notices, and reminders before an auction you bid on or watch ends; wins and payments; order deadlines and decisions; message digests; reviews; payouts; and notices about your account’s standing or a listing of yours taken down. We send no marketing email.
  • To prevent fraud and abuse: bots, fake bids, stolen cards and deals taken off Vods, by comparing accounts, reviewing reports and applying sanctions (Fraud checks, reports and sanctions).
  • To find and fix faults in our software.
  • To meet our legal obligations, such as keeping payment records.

We do not sell your data, and we do not use it to show you ads or to build advertising profiles.

Fraud checks, reports and sanctions

  • To spot fraud, we compare accounts with each other: the IP addresses their bids and sign-ins come from, the fingerprints of the cards they have saved, and the fingerprint of the bank account their payouts go to. We also look for patterns in bidding, in wins left unpaid and in disputes, and for contact details sent again and again in an order’s messages.
  • These checks never act on their own. A match opens a case for the Vods team, and a person on the team decides what, if anything, to do. Reviewing a case, the team sees which accounts share a card, a payout bank account or an IP address.
  • A report you make goes to the Vods team. Whoever you reported is not told that you did, and we don’t tell you what came of it.
  • The Vods team reads an order’s messages only inside a case about that order, such as a report of its thread or a dispute, and every reading is recorded.
  • The Vods team may warn an account, limit its bidding, hold its payouts or suspend it, and may give a creator a strike for a replay taken down before its retention term ended. A sanction may also cover accounts linked to it by a saved card or a payout bank account. Each is recorded on the account with the team’s reasons, which stay internal, and kept once lifted (How long we keep it).
  • You are told of a warning, a bid limit or a suspension by email and in your account area, and of a payout hold on your Payouts page, always in general words.

What other people see

  • Anyone, signed in or not, can see a creator profile’s name, picture and about text; the name and address of the channel each of its auctions is on and, where the creator has approved it, that channel’s details and figures; and its auctions with their slots, prices, bid counts, results and the advertiser categories each refuses.
  • The pictures, logos and banners you upload for a profile or a listing are public files, which anyone with their address can open. An order’s files are not (Security).
  • Bid history is public, but bidders appear as numbers (“Bidder 1”), never by name, and nobody else sees your maximum.
  • Comments are public. An advertiser’s name is shown masked to its first and last characters; a creator’s replies show their profile name.
  • Reviews and their replies are public once published, and so is a creator’s rejection rate.
  • The other side of an order sees your profile and everything in the order: its details, ad material, proof, dispute and messages. If you block them, the order’s thread tells them that you did.
  • No other user sees the auctions you watch or the reports you make.
  • The Vods team sees what it needs to run Vods and decide cases. It reads an order’s messages only while handling a case about that order, and each reading is recorded.

Who we share it with

We share data only with the companies that run parts of Vods for us, each for its own job, and with the platforms you connect:

  • Stripe takes payments, stores cards, onboards and checks creators, and pays them out. It receives your email address and Vods account id when you save a card or set up payouts, and for a creator also their country and their verified channel’s address. On the pages where you save a card or pay, its script collects information about your device to prevent fraud. The Stripe Privacy Policy covers what Stripe does with it.
  • Cloudflare sends our emails (it receives your address and the message), runs the bot checks on the sign-up, sign-in and password screens (it receives your IP address with each check), stores uploaded files, and runs our domain names.
  • Railway hosts our servers, our database and our logs.
  • Sentry receives reports of errors in our software: from our servers with the request’s id and the account id involved, from your browser with the page’s address (any tokens removed) and your browser type. Neither carries your name, email address or IP address.
  • Google signs you in if you choose Google, and answers our reads of a YouTube channel you connect and of its orders’ replays.
  • Twitch, Kick and Rumble answer our reads of a channel you connect, and Twitch our checks of an order’s replay.
  • Have I Been Pwned receives only the first five characters of a hash of a new password.

Channel pictures and banners, and a Google profile picture shown on a creator profile, are loaded from the platforms’ own servers, so your browser contacts them when you view a page that shows one.

We also disclose data when the law requires it, or to protect people or Vods from fraud or harm. If Vods is merged or sold, your data would pass to the new owner under this policy, and Google user data only with your consent first.

We never sell your data.

Cookies and local storage

We use no advertising or analytics cookies, and nothing that tracks you across other sites.

  • Your session. Signing in sets a cookie that keeps you signed in, which scripts on the page cannot read. Signing out removes it.
  • Signing in with Google. A cookie that lasts a few minutes ties Google’s answer to the browser that asked for it.
  • Payments. On the pages where you save a card or pay, Stripe’s script runs and sets its own cookies to prevent fraud.
  • Bot checks. On the sign-up, sign-in and password screens, Cloudflare Turnstile runs a check in your browser.
  • Local storage. We keep one setting in your browser: whether you collapsed the menu in your account area.

Each of these is needed for Vods to work, so there is no setting to turn them off; blocking them stops sign-in or payments from working.

How long we keep it

  • Your account, your profiles and the devices you have signed in from: while your account is open.
  • The auctions you watch and the accounts you block: until you take the auction off your watchlist or undo the block.
  • Platform data: YouTube’s for at most 30 days without a refresh, Twitch’s and Kick’s for 24 hours, and all of it until you disconnect the channel (Connected channels).
  • Bids, payment records, saved cards, ad material, proof, replay checks, dispute proposals, messages, review replies, reports and the record of the Vods team’s actions are never changed or deleted while your account is open: they are the evidence for orders, disputes, bank disputes and fraud checks. Removed or hidden comments and hidden reviews are kept, marked as removed or hidden.
  • Warnings, bid limits, payout holds, suspensions, strikes and the cases about your account are kept while your account is open, lifted or closed ones too: they are the record of how Vods dealt with fraud and abuse.
  • If your account is deleted, we delete your platform data within 7 days and remove your name and contact details from the rest. Records of auctions, orders and payments are kept for 30 days, because tax, accounting and dispute rules require them.
  • Server logs and error reports are kept by Railway and Sentry for the limited time our plan with each allows. Deleted data can stay in our database backups until they are replaced.

Your choices

  • See and change your profiles, channels and card on your account pages.
  • In your settings, see the devices signed in to your account and sign any of them out, and, if you sign in with a password, change it and turn two-step sign-in on or off.
  • Disconnect any channel at any time, on your Channels page.
  • Turn off “Show my numbers to advertisers” for any channel, take an auction off your watchlist, or undo a block you made, at any time.
  • Remove Vods’ access to your Google account in your Google security settings.
  • Ask for a copy of your data, for a correction, or for your account or your platform data to be deleted, by writing to support@vods.com from your account’s email address. We delete platform data within 7 days of a request; some records are kept, as the section above says.
  • Depending on where you live, you may have further rights, such as objecting to how we use your data or complaining to a data protection authority.

Security

  • Passwords are stored only as salted hashes, and passwords known from breaches are refused.
  • If you sign in with a password, you can add two-step sign-in with an authenticator app. Its secret and your backup codes are stored encrypted.
  • We email you when your account is signed in from a new device, and when your password changes or two-step sign-in is switched on or off.
  • Platform access and Rumble links are encrypted with a key held outside our database.
  • Card details never reach our servers.
  • An order’s files are private: shown only to its two sides and the Vods team, through links that expire within minutes.
  • Everything between your browser and Vods is encrypted (HTTPS).
  • The Vods team signs in separately from users, by invitation only and with a second factor, and its decisions are recorded.

No system is perfectly secure. If you find a problem, tell us at support@vods.com.

Children

Vods is for people aged 18 or older and is not directed at children. If you believe a child has an account, write to us and we will delete it.

International transfers

The companies that run parts of Vods for us are based in the United States and process data there and in the other countries where they operate. If you use Vods from elsewhere, your data is transferred to and processed in those countries.

Changes

If this policy changes, we will publish the new version here with its date. Before we use your data in a new way, we will tell you by email and ask you to accept the updated policy.

Contact

Vods, Inc., 7190 W Sunset Blvd, Los Angeles, CA 90046, United States. Email: support@vods.com.