Avalanche Privacy Policy

Last updated: November 5, 2026

Avalanche is a browser extension for Chrome and Firefox that lets people watch YouTube videos together in synchronized rooms. This policy explains what data Avalanche processes, why, and with whom it is shared. It applies to the extension and the default Avalanche server at avalanche.watch. If you configure a self-hosted Avalanche server, that server's operator may have separate practices.

Data Avalanche processes

• Profile information: the display name you choose and a stable random client ID stored in the browser. The client ID identifies your profile as the room host across tabs and reconnections.
• Room information: the room code, YouTube video ID, playback position, paused/playing state, member list, and connection timestamps needed to synchronize playback.
• Persistent room data: when the server operator creates a persistent room, its code, video, playback position, permissions, queue, and administrator names are stored in the server's SQLite database. Persistent rooms remain available until the operator deletes them.
• Account and settings data: the Avalanche server URL, an optional individual account token, and your follow-host preference. Account tokens are personal and nominative credentials; every token belongs to one account and must not be shared between users. Account display names are stored in the server's SQLite database so the operator can manage accounts. Account tokens are stored only as SHA-256 hashes: the plaintext token is shown once when it is created or regenerated and cannot be recovered by the operator. Friendships, pending friend requests, and room invitations (sender/recipient names, room code, timestamps) are stored in the same SQLite database. Local settings stay in browser local storage.
• Technical data: the configured Avalanche server receives standard network information such as IP address, timestamps, and request/WebSocket metadata. Server logs may also contain the display name, stable client ID, room code, YouTube video ID, and join/leave or video-change actions for security and troubleshooting. The operator may also keep an activity history file (`AVALANCHE_ACTIVITY_LOG`) with the same action data. These logs are retained according to the server operator's policy.

How data is collected

Display name, server URL, token, and preferences are provided by you in the extension's settings. Room information is read from the YouTube page when you create or join a room, and is sent to the configured Avalanche server. Technical data is generated automatically by the network connection to that server.

How data is used

Avalanche uses this data only to provide synchronized watch rooms: creating and joining rooms, syncing play/pause/seek actions, changing the room video, showing connected members, assigning the host role, authenticating accounts and locking account display names, reconnecting after network changes, and protecting the service from abuse. Avalanche does not use the data for advertising, profiling, creditworthiness, or any purpose unrelated to these features.

Sharing

• Other room members: your display name and the room's video and playback state are visible to people in the same room. Your stable client ID is not exposed to other members.
• The configured Avalanche server: room state and the information above are sent to the Avalanche server you use (the default server or a self-hosted one). That server operator controls its own logs and retention.
• No sale or advertising: Avalanche does not sell, rent, or trade user data, and does not share it with advertisers or data brokers.

Storage and retention

Settings and the client ID remain in your browser's local storage until you change them, clear the extension's storage, or uninstall the extension. Rooms created from the extension are kept in server memory, expire after 30 minutes of inactivity by default, and are lost when the server restarts. Persistent rooms created by the server operator are stored in SQLite and survive server restarts until the operator deletes them. Account records remain in the server's SQLite database until the server operator removes them. Server logs are retained according to the configured server's policy.

Security

Avalanche is designed to use HTTPS/WSS when the configured server supports it. The optional account token is stored locally and sent to the server in the WebSocket join message or the REST authorization header, not in URLs. Account tokens are personal and must not be shared; only their SHA-256 hashes are stored in SQLite, so access to the database must still be protected. No system is completely secure; avoid using sensitive personal information as your display name.

Your choices

• Change or clear your display name, server URL, and account token in Settings.
• Leave a room at any time; this stops sharing the room state.
• Clear the extension's local storage or uninstall it to remove locally stored settings and the client ID.
• Use a self-hosted Avalanche server if you do not want to use the default one.

Children

Avalanche is not directed to children under 13, and we do not knowingly collect personal information from children.

Changes

We may update this policy when Avalanche's data practices change. The updated date at the top of this page reflects the latest revision.

Contact

Questions about this policy or Avalanche's data practices: neverrdev@gmail.com