Streamsteady Privacy Policy

Last updated: 27 October 2026

Streamsteady is a browser extension that helps you find, listen to and record live X Spaces. This policy explains exactly what the extension does with your information. It is short because the extension does very little with it.

The short version

Streamsteady runs on your computer. Unless you turn on cloud backup or Grok voice, it does not send your X data, your recordings or your activity to us or to anyone else, and everything it stores stays in your browser, on your machine, until you delete it. The one exception is a small anonymous diagnostic sent when you press “Stop Streamsteady audio”; it carries nothing about who you are. Cloud backup is off until you switch it on, and even then it uploads the recording's audio, its captions and the Space's visible roster — the people X shows in the Space, on stage and listening, with their profile pictures — never video. Sign in with X is optional too: it lets you reach your cloud recordings from any computer, and it tells us your X user ID, @handle, name and profile picture.

What Streamsteady reads

Your X and Periscope login cookies

Streamsteady reads the authentication cookies your browser already holds for x.com (auth_token and the ct0 cross-site-request token) and for pscp.tv, the Periscope service that X Spaces runs on. It reads them for one reason: so it can call the same X Spaces endpoints your browser already calls when you use Spaces — listing live Spaces, loading a Space's details, joining, requesting captions, and controlling your own microphone. These cookies are attached only to requests going back to x.com and *.pscp.tv. They are never sent to Streamsteady, never sent to any third party, and never stored anywhere outside your browser's own cookie store.

Content on the X pages you have open

While you are on x.com or twitter.com, Streamsteady reads the parts of the page it needs to do its job: Space titles, the Space's roster as X shows it (host, co-host, speaker and listener names, handles, profile pictures and roles), listener counts, captions, reactions, and the state of X's own microphone and join controls. It does not read your timeline, your direct messages, your notifications, or any page outside x.com and twitter.com.

A fixed list of network requests, read-only

Streamsteady observes a specific, unchanging list of X and Periscope requests your browser makes — the Spaces metadata queries, the caption-enable request, the profile lookups and Periscope sign-in X uses for Spaces, the raise-hand / lower-hand requests, and the join / leave / mute / unmute / speaker-join / Space-ended calls. It reads these to know what is happening in the Space you are in. For other responses from x.com it reads only the status code and X's rate-limit reset time — never the contents — so it can slow down rather than overload X. It does not block, redirect, or alter any request, and it does not observe requests to any other site.

What Streamsteady stores, and where

Everything Streamsteady saves is stored locally in your browser using the browser's own storage. Nothing is synced to a cloud account unless you turn on cloud backup, which is off until you switch it on — see Cloud backup below. This includes:

You can erase all of it at any time by removing the extension, or by deleting individual recordings and settings from within the extension.

Cloud backup

Cloud backup is off unless you turn it on. Your free trial includes up to five cloud-backed recordings; after that, cloud backup is part of the paid plan. With it off, nothing described in this section happens, and your recordings never leave your computer.

When it is on, a recording you have finished is uploaded to storage we operate, so you can get to it from another device and after the live Space has ended. We use Cloudflare R2 to hold it. Your browser uploads the file straight to that storage using a short-lived, single-use link our server signs for you; the file itself does not pass through our server.

What gets uploaded is more than the audio. A backed-up recording is a single archive containing the Space's audio; a details file (the Space's title and ID, the host's @handle, and how long it ran); the captions, each attributed to the speaker who said it, with a readable transcript of them; and a timeline of the stage. The timeline holds the Space's visible roster as X shows it — the names, @handles, profile pictures and roles of the hosts, co-hosts, speakers and listeners (very large rooms are capped: the first listeners in X's order, plus anyone who reacted) — who was speaking and muted when, the reactions sent in the Space with who sent each one, and how loud the room was. That timeline is what lets a recording be played back as a video of the Space; the video itself is drawn on your computer from it.

Video never leaves your computer. Cloud backup never uploads video — not of your screen, not of your camera, and not X's stage video.

That audio, those captions and that timeline include other people. A Space recording captures the other people in the Space — hosts, speakers and listeners — not only you. Turning on cloud backup means a copy of other participants' voices, names, profile pictures and words is stored on our infrastructure. You are responsible for having the right to record and store the Spaces you capture, and for complying with the law where you and the other participants are.

Recordings are stored privately, under your account, and are not public, indexed, or shared by us with anyone. We do not listen to them, and we do not use them to train anything. We do not add our own encryption — the storage provider encrypts data at rest, but a backed-up recording is not end-to-end encrypted, which means we are technically able to access it and could be compelled to produce it by valid legal process.

There is no automatic expiry. A backed-up recording stays until it is deleted.

Storage limits. Each account can keep about 20 GB of cloud backups in total and upload about 2 GB in any 24 hours, and a single recording can be at most about 500 MB. A recording over the total or the single-recording limit is not uploaded and stays on your computer; one over the daily limit waits and uploads the next day. Either way the extension tells you which.

Deleting a cloud backup. Deleting a recording on the Recordings page removes the copy on your computer; the cloud backup is deleted separately. The cloud backups list on the same page has a Delete control for each backup, which removes the stored file from our storage and its record from our server. Removing the extension does not delete cloud backups, so delete them first — or email privacy@streamsteady.io and we will delete them and confirm.

Signing in with X

Sign in with X is optional. You can use Streamsteady, and record, without it. It exists so you can open your cloud recordings on streamsteady.io from any computer, and so the extension's "Connect Streamsteady" button can link a computer's cloud backups to your X account.

How it works. You approve it on X's own sign-in page (X's OAuth 2.0), for read-only access to your basic profile. We use that access once, to read your X user ID, @handle, name and profile picture, and then we revoke it straight away: we never see your X password and we do not keep any X access token.

What we keep. Your numeric X user ID and your @handle are stored on our server, so we know which cloud recordings are yours and which computers you connected. Your X user ID, name and profile picture are kept in a signed cookie in your browser for up to 30 days, so the page can show who is signed in. Signing out removes that cookie. To remove your account and unlink your computers from our server, email privacy@streamsteady.io; your recordings on your own computer are not affected.

Signing in never lets Streamsteady post, follow, read your direct messages, or act on your X account.

Private beta testers

If you join the private beta, you sign the beta agreement on streamsteady.io/beta after signing in with X, so the agreement is signed by your verified X account rather than a handle anyone could type. We keep a record of that acceptance as evidence of the agreement: your numeric X user ID and @handle, the agreement version and a fingerprint of its exact text, when you accepted, and the IP address and browser description your acceptance came from. Your install link is tied to your X account and expires after 30 days; each download is logged with your X user ID and @handle. Email privacy@streamsteady.io with questions about this record.

The beta waitlist

If you join the waitlist on streamsteady.io/waitlist, we keep what you gave us so we can send you an invite: either your numeric X user ID and @handle (when you join with Sign in with X) or the email address you typed, or both, plus when you joined and, if you arrived from a link that carries one, a short tag for where that link was posted. We use it only to invite you to the beta and never sell it or share it. The waitlist lives on this website only; the Streamsteady extension never reads or sends it. Email privacy@streamsteady.io to be removed from it.

Microphone and audio capture

Streamsteady can use your microphone in two situations, and only with your browser's own permission prompt:

Streamsteady can also capture tab or desktop audio for its Audio Hub, so you can balance a Space against other audio playing on your machine. That capture always goes through Chrome's own sharing dialog, where you choose what to share, and it only starts when you start it.

Microphone audio you send as a speaker goes to X, over X's own connection — the same path as speaking in a Space without this extension. Captured tab or desktop audio is mixed locally and is not recorded or transmitted by Streamsteady.

Voice Search and Google

Voice Search uses your browser's built-in speech recognition. In Chrome, that feature sends the audio you dictate to Google for transcription. That transcription is handled by Google under Google's own privacy policy, not by Streamsteady. If you would rather not use it, do not use Voice Search; nothing else in the extension dictates.

Streamsteady does not record your screen or your camera. (If you host a video Space, the Stream Studio can add graphics or clips to the video you send — only when you turn it on — but it records nothing.) In a Space that has video, it can keep X's own stage video on your computer, next to the recording (see Cloud backup: that video is never uploaded). You can export a recording as a video file to share it; that file is made on your computer and goes only where you put it.

Stream Studio (hosting a video Space)

The Stream Studio only changes what you yourself broadcast, and only when you tell it to. When you host a Space with video, the Studio can put things on your broadcast: a timed message, a scrolling ticker, a watermark, a “Please stand by” card, a countdown, or a video clip you choose from your own computer. It does this in your browser, by replacing the video your browser is about to send to X with a version that has those things drawn on it; a clip’s sound is mixed into the audio you send to the Space the same way.

Nothing starts until you press Play or Transition in the Studio, and it never touches anyone else’s video or audio. Clips you add stay on your computer: they are read by your browser to play them into your broadcast and are not uploaded to us. What you broadcast goes to X over X’s own connection, exactly as if you had shared it with X directly, and everyone in your Space sees and hears it.

Captions

Live captions in a Space are generated by X and by the speakers' own devices. Streamsteady displays them and can save them alongside a recording on your computer. If you turn on cloud backup, those captions — including the speaker each line is attributed to — are uploaded as part of the recording. Streamsteady does not transcribe audio itself.

Reactions

When you tap a reaction, Streamsteady sends it into the Space over the same chat connection X's own reaction picker uses, from your X account, visible to everyone in the Space and attributed to you. An optional setting lets you send emoji that X's own picker does not offer. That setting is off until you turn it on, and turning it on requires reading a notice that explains those reactions come from your account and are more distinctive than the built-in ones. You can turn it off at any time.

What Streamsteady sends to us

Streamsteady has no analytics, no advertising and no tracking of any kind. Unless you turn on cloud backup or sign in with X, no server of ours receives your data; the only exception is the anonymous diagnostic described below, which carries nothing about who you are.

When it starts, the extension makes one request to a Streamsteady-operated address: it asks relay.streamsted.io for its feature-configuration file. That request carries no account, no identifier and no information about you or the Spaces you use — only the fact that the request came from the browser extension. Like any web request, it necessarily reveals your IP address to that server. We do not use it to build a profile of you, and if the server is unreachable the extension simply uses its built-in defaults.

Anonymous Stop diagnostic

When you press “Stop Streamsteady audio”, the extension sends one diagnostic report to help us fix doubled audio. It contains only time offsets of what led up to the press: when you pressed Request to speak in the player, when two audio players were heard at once (and which kinds of player they were, such as X’s own player or Streamsteady’s player), when that cleared, and the Stop press itself, plus the extension’s version. It contains no account, no X user ID or @handle, no name, no Space title or ID, no URL, no audio and no identifier for your browser or installation. Nothing is sent unless you press Stop. The report is stored by Sentry on our behalf; storing IP addresses is turned off for it, and the report is used only to find and fix audio problems.

If you turn on cloud backup, the extension additionally contacts relay.streamsted.io to arrange each upload. Those requests carry a per-installation identifier, the Space's ID and title, and the recording's size and length — and, unlike the configuration request, they identify your account so the recording is stored under it and reachable only by you. The recording itself goes directly to storage, not to that server.

What Streamsteady never does

Streamsteady does not post to your timeline, does not follow or unfollow anyone, does not read or send direct messages, does not create a Space unless you press Go live, does not upload your recordings unless you turn on cloud backup, and does not sell or share your information with anyone.

Limited Use

Streamsteady's use of information obtained through Chrome extension APIs — including your X and Periscope authentication cookies and the content of X pages — adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Specifically:

  1. We use this data only to provide and improve the single, user-facing feature set described in the extension's store listing: finding, listening to, recording and participating in X Spaces.
  2. We do not transfer this data to any third party, except as necessary to provide that feature set (that is: back to X and Periscope, the services the data belongs to; and, if you turn on cloud backup, to Cloudflare, which stores the backup on our behalf; and, if you turn on Grok voice, to xAI, which receives the Space's audio so Grok can hear and reply; and, when you press Stop Streamsteady audio, to Sentry, which stores the anonymous Stop diagnostic on our behalf), to comply with applicable law, or to protect against fraud or abuse.
  3. We do not use or transfer this data for serving advertising, for retargeting, or for personalised or interest-based advertising.
  4. We do not use or transfer this data to determine creditworthiness or for lending purposes.
  5. We do not allow humans to read this data, except with your explicit consent for a specific issue you have reported to us, where necessary for security purposes or to comply with applicable law, or where the data has been aggregated and anonymised.

Children

Streamsteady is not directed at children under 13, and requires an X account, which X itself restricts by age.

Grok voice (xAI)

Some beta builds include an optional AI co-host voice powered by Grok, from xAI. It is off until you press Start Grok. While it is on, the audio of the Space you are in, including other participants' voices, is sent from your browser to xAI so Grok can hear the room and reply, and Grok's replies are played into the Space, so everyone in it hears them. Your X session is used to connect to Grok the same way X's own Grok voice does. None of this audio passes through our servers, and we do not store it. Turn Grok off and the audio stops. If you use it, tell the people in your Space that an AI co-host is listening.

Third parties

Streamsteady interacts with X (including Periscope, its Spaces backend) on your behalf and using your existing session. Your relationship with X is governed by X's own privacy policy and terms of service. If you sign in with X, that sign-in happens on X and is governed by X's policies. Chrome's built-in speech recognition, used only by Voice Search, is governed by Google's privacy policy. If you turn on cloud backup, your recordings are stored by Cloudflare, which holds them on our behalf and does not use them for its own purposes. If you turn on Grok voice, the Space's audio is sent to xAI, and xAI's handling of it is governed by xAI's privacy policy. The anonymous Stop diagnostic is stored by Sentry, which holds it on our behalf and does not use it for its own purposes.

Changes to this policy

If this policy changes in a way that affects what Streamsteady does with your information, we will update the date at the top and note the change in the extension's release notes before the change ships.

Contact

Questions about this policy, or a request about your data: privacy@streamsteady.io