SKWAD · Privacy
Privacy policy
EFFECTIVE 27 SEP 2026 · LAST UPDATED 14 OCT 2026
This policy explains what personal data SKWAD handles on skwad.ai and in our products, why, how long we keep it, and the choices you have. The details for SKWAD Pulse, our live viewership tool, are set out in their own section.
Who we are
SKWAD GG LLP, India (SKWAD, we, us) runs the website skwad.ai and the SKWAD platform, including SKWAD Pulse (Pulse).
Pulse is an internal operations tool for live esports broadcasts that we produce or support. It is used by our staff and crew and by the event organisers we work with. It is not a consumer product and is not directed at children.
skwad.ai and enquiries
skwad.ai sets no cookies and uses no analytics or advertising trackers.
When you send an enquiry through the Get started form we collect your name, work email, company, role (if you give it), the areas you are interested in, your message and the time you sent it. We use them only to reply to you and follow up on your enquiry. With each enquiry we also keep your browser type and a shortened one-way hash of your IP address, to spot abuse; to limit repeated submissions we keep a separate hash of your IP address, which expires after two hours and is then removed automatically, typically within a few days.
Enquiries are stored on Amazon Web Services in Mumbai, India, and emailed to our team through Amazon Simple Email Service. Please do not send confidential information through the form.
SKWAD Pulse
During a live broadcast, Pulse watches the public YouTube live streams of the event and shows our crew live viewer counts, stream problems (for example a stream that goes off air) and possible unauthorised re-streams. After the event it produces an aggregate report for the organiser.
Live chat monitoring is currently switched off. When it is switched on for an event, Pulse also shows the overall mood and topics of public live chat and stream problems viewers report in chat (for example "no audio" or "buffering").
YouTube API Services
Pulse uses YouTube API Services. By using Pulse you agree to be bound by the YouTube Terms of Service. YouTube data is also subject to the Google Privacy Policy.
Pulse reads public data only, server-side, with an API key. It does not ask you to sign in with Google or YouTube, does not use OAuth, and never posts, comments, likes, moderates or uploads anything to YouTube. Because Pulse holds no authorisation to any YouTube account, there is nothing to revoke; if that ever changes, you will be able to revoke access at any time through Google's security settings page.
What Pulse collects
1. Public YouTube data
- Live stream details: title, channel, live status, scheduled and actual start and end times, concurrent viewer count.
- Channel details: name, handle and ID of the channels we are asked to monitor.
- Public live chat messages on those streams, only when chat monitoring is switched on for an event. It is currently switched off.
- Search results for public live streams whose titles match the event, to find possible unauthorised re-streams.
Chat authors. When chat monitoring is switched on, we do not store chat authors' names, channel IDs or profile pictures. Each author is replaced by a one-way hash, used only to count how many different people are chatting and to avoid counting one person's repeated messages as many reports. Raw chat text is deleted after 30 days (see How long we keep it).
2. Accounts and sign-in
Since 8 October 2026 everyone who uses Pulse has their own account. An admin creates it by sending a personal invite link, which works once and expires after 48 hours. For each account we store:
- your name and email address;
- your password, as an argon2id hash only (we never store the password itself);
- the secret for your authenticator app, encrypted at rest;
- your sign-in sessions, which expire after 12 hours without activity (and after 7 days at most) and can be revoked at any time;
- an activity log of sign-ins and account changes, such as invites, role changes and resets.
We also record your name against actions you take in Pulse (for example, who confirmed a channel or closed an issue). Accounts for event organisers (clients) are read-only.
Pulse sets a session cookie to keep you signed in. If you tick "Don't ask for a code on this device", it sets a second cookie that skips the authenticator step on that browser for 30 days. We use no advertising or cross-site tracking cookies.
The Stream Wall loads embedded YouTube players. Loading a player and playing a video can send information from your device to YouTube, including information needed to display content, assess playback restrictions and prevent abuse. YouTube may serve content and advertisements and use cookies or similar technologies according to the Google Privacy Policy. Privacy-enhanced embedding does not mean that no data is sent to YouTube. Only one visible player starts automatically on a screen; additional players start when you choose to play them.
3. Crew reports (optional)
If a broadcast team turns it on, crew can send stream-quality reports to Pulse from a Slack channel or a WhatsApp Business number. WhatsApp phone numbers and message IDs are stored only as keyed hashes, never in plain text, together with the report text and any attached screenshot. For Slack we store the sender's display name and the report.
4. Share links
Organisers can receive a report through a private share link. Anyone with the link can view that one report until it expires (90 days) or is revoked.
5. Report emails
Pulse can email day and whole-event reports from pulse-noreply@skwad.gg to the organiser contacts that an admin enters for an event. By default, an admin must approve each email before it is sent. A deployment can enable unattended automatic sending, but it is off by default and an admin must choose it for the event; an automatic email is sent only after the report freezes and its delivery checks pass. Those email addresses are stored with the event. Replies go to the SKWAD project management office (PMO) mailbox, not to the sending address.
6. Technical data
Our servers and our network provider (Cloudflare) process IP addresses, browser type and request logs to deliver the service, keep it secure and investigate abuse. We use IP addresses to rate-limit sign-in attempts. Access logs keep request paths and are used only to run and secure Pulse.
Why Pulse uses it
| Purpose | Data |
|---|---|
| Show a live broadcast's reach and stream problems (and, when chat monitoring is on, chat mood) to our crew and the organiser | Public YouTube data |
| Detect unauthorised re-streams to protect the organiser's broadcast rights | Public YouTube search results |
| Give each person their own access, run Pulse securely and know who did what | Account, sign-in and technical data |
| Fix stream problems reported by crew | Crew reports |
| Share a post-event report with the organiser | Aggregate report data, share links |
| Email reports to the organiser's contacts after admin approval, or through admin-chosen automatic delivery where that is enabled | Organiser contact email addresses |
We do not sell personal data, use it for advertising, build profiles of individual viewers, or report unique viewers, demographics or audience retention.
Automated analysis
Chat monitoring and the third-party AI text-classification service are currently switched off. If both are enabled for an event, Pulse sends the stream title and message text, with no author information, to classify mood, topic and whether a message reports a stream problem. Results are used in aggregate (totals, trends and stream alerts); no decision is made about any individual viewer.
How long we keep it
| Data | Kept for |
|---|---|
| Website enquiries | The record expires 24 months after you submit it. Amazon DynamoDB then removes it automatically, typically within a few days. |
| IP address hash used to limit repeated enquiries | The rate-limit record expires after 2 hours. Amazon DynamoDB then removes it automatically, typically within a few days. |
| Raw live chat message text (when chat monitoring is on) | 30 days, then deleted automatically |
| Short chat quotes in a report | 30 days, then removed automatically; the report keeps numbers only |
| Viewer-count history and the figures calculated from it for a report | For as long as that event's report remains in Pulse |
| Raw YouTube API response items stored as peak proof | 30 days, then deleted automatically; the measured values and verification metadata remain with the report |
| Other aggregates (mood and topic totals when chat is on, issue counts) | For the life of the event record |
| Organiser contact email addresses entered for an event | For the life of the event record |
| Share links | Access ends when the link expires (90 days) or is revoked. The share record remains with the event as an audit trail. |
| Invite links | Access ends after one use or 48 hours. An unused expired invite remains on the invited account record until the invite is reset or accepted. |
| Sign-in sessions | Access ends after 12 hours without activity, after 7 days at most, or on revocation. Expired session records are removed when Pulse later processes sign-in or session activity. |
| Account details (name, email, password hash, encrypted authenticator secret) | While your account exists. An admin can turn an account off at any time, and you can ask us to delete it (see Your rights) |
| Crew reports, account activity and technical logs | Only as long as needed for the event, its report and security, then deleted |
Today, Pulse keeps each event's viewer-count history and the figures calculated from it with that event's report. Raw YouTube API response items stored for peak proof are deleted after 30 days; the measured figures and verification metadata remain. Live chat monitoring is switched off, so Pulse is not collecting chat messages today. You can ask us to delete data at any time (see Your rights).
SKWAD has asked YouTube for its additional analytics and storage permission. We will change these retention periods to match YouTube's decision.
Who we share it with
We share data only with the organiser of the event a report is about, and with service providers that process it for us under contract:
- Amazon Web Services — hosting, backups and enquiry email (Mumbai region, India)
- Cloudflare — network and security
- Google / YouTube — the source of public YouTube data, through YouTube API Services
- Slack and Meta (WhatsApp Business) — only if crew reporting is turned on for an event
- Microsoft (Microsoft 365) — sends report emails from pulse-noreply@skwad.gg, once email delivery is switched on
- An AI text-classification provider — only if switched on for an event
We may disclose data where the law requires it.
Security
Data is encrypted in transit (HTTPS) and at rest. Every account signs in with its own password and an authenticator code, and sign-in attempts are rate-limited. Secrets are kept in a managed secret store, server access is restricted and logged, and chat authors and WhatsApp numbers are stored only as hashes.
Your rights
SKWAD voluntarily honours requests to access, correct or delete personal data we hold about you, and lets you nominate someone to act for you. Statutory rights under India's Digital Personal Data Protection Act, 2023 apply as the relevant provisions come into force.
Because chat authors are stored only as a hash, we usually cannot link a chat message back to a specific person. If you believe a message of yours is in our records and want it removed, contact us with the stream and approximate time and we will delete matching messages.
Send a deletion request to the Grievance Officer at the email address below. SKWAD will verify and act on the request as soon as possible, and will delete the YouTube API data Pulse holds about that person or channel no later than seven calendar days after receiving it. Verification happens within that period. Encrypted backups made before a deletion are deleted automatically, normally within 60 days, and SKWAD never restores deleted data from them. Pulse holds no YouTube account data, and deleting data held by Pulse does not delete a channel, video, comment or anything else on YouTube.
Contact and grievances
Grievance Officer: Gowtham Reddy
Email: hello@skwad.ai
Company: SKWAD GG LLP, India
For requests other than the YouTube-data deletion described above, we aim to reply within 30 days. As the relevant complaint provisions of the Digital Personal Data Protection Act, 2023 come into force, the statutory route to the Data Protection Board of India will apply.
Changes
We will post any changes on this page and update the "Last updated" date. For significant changes we will tell the staff and organisers who use Pulse.