> Privacy Policy for Watch Peak Party, including Chrome extension permissions, account data, party rooms, chat, voice and camera handling. Legal # Privacy Policy Watch Peak Party keeps watch parties, friends, invites, chat, microphone, and camera features working. This page explains what is stored, why we need it, which Chrome permissions the extension requests, and what we deliberately do not collect. - Effective 12 August 2026 - Last updated 14 August 2026 ## The short version Watch Peak Party collects the minimum needed to run a two-person watch party service: your Google sign-in profile if you sign in, your friend list and party invitations, temporary room metadata, chat messages during a party, Chrome push notification tokens, local extension preferences, and limited usage metering for voice/video features. We do not sell or rent personal data. We do not run advertising or third-party analytics in the extension. We do not record the streaming video you watch. We do not record your microphone or camera. Microphone and camera streams are started only after you press the relevant control, and they are sent to the other participant through WebRTC. ## Who we are Watch Peak Party is a Chrome extension and website for watching supported streaming services together in sync. For this policy, "Watch Peak Party", "we", "us", and "our" mean Rana Aazan Mujahid, trading as Watch Peak Party, Y Block, DHA Phase 7, Lahore, Pakistan 54930. Privacy questions: [privacy@watchpeakparty.fun](mailto:privacy@watchpeakparty.fun). General and account questions: [help@watchpeakparty.fun](mailto:help@watchpeakparty.fun). ## What we collect and why ### Google sign-in profile If you choose to sign in, Firebase Authentication gives us your Firebase user ID, Google account identifier, display name, email address, and profile picture URL. We use this to create your Watch Peak account, show your profile in the extension, keep friends and invitations attached to the right account, and refresh your signed-in session. We do not receive your Google password, Gmail, contacts, Drive, calendar, or any other Google account content. ### Local party identity The extension creates a local random user ID and display name such as "Watcher 1234" so a party can show who is in the room even before social sign-in is used. This is stored in Chrome extension storage on your device. ### Friends, friend codes, and invitations We store your friend code, accepted friends, incoming and sent friend requests, party invitations, invite status, sender/recipient names, profile picture URLs, video title, platform, invite URL, creation time, expiry time, and response time. This is the social layer that lets you add friends and send direct party invitations. ### Temporary watch party room data When you start or join a party, the server handles a room ID, secure join secret, supported platform, video URL, video key, host user ID, display names, participant roles, socket tickets, and room expiry time. The room exists so both browsers can find each other, exchange playback state, and recover when one person changes videos. ### Playback, chat, microphone, and camera state During a party, the extension exchanges playback events such as play, pause, seek, rate, buffering, media-change, presence, and participant media state. Party chat messages are sent to the other participant while the party is active. Microphone and camera streams are captured only when you turn them on, and are sent through WebRTC. We do not record those streams. ### Voice/video usage metering When free-plan voice/video limits are active, the extension sends periodic heartbeat messages while microphone or camera features are in use. The server stores weekly usage counters, such as week start time, used milliseconds, and last heartbeat time. During the current unlimited launch promotion, the code treats voice/video as unlimited and skips the extra metering work where possible. ### Chrome push notification tokens If Chrome push notifications are available, the extension registers with Chrome/Firebase Cloud Messaging and sends us a registration token and extension ID. We store it so we can notify you about friend requests, accepted requests, removed friendships, party invites, and invite responses. If you sign out or a token stops working, the extension asks us to remove or replace it. ### Local extension and website storage The extension stores your sign-in session tokens, social state cache, theme, selected microphone device, push-to-talk setting, diagnostics logs, notification payloads needed for button actions, active-room handoff state, and temporary invite/navigation state in Chrome storage. The website stores a small local account cache after sign-in so the account panel can open without unnecessary repeated reads. ### Security and operational data Cloudflare and Firebase necessarily process request metadata such as IP address, user agent, requested URL, timing, and error information in logs and security systems. The Worker also uses IP addresses in a short-lived in-memory rate limiter for some unauthenticated endpoints. ## Chrome permissions and host access Every permission Watch Peak Party requests is listed below, with what it is used for. The extension requests nothing beyond this list. - `tabs` — Needed — Used to find supported video tabs, open or reuse invite tabs, move an existing party tab to a new video URL, and send extension messages to the correct tab/frame during party navigation. - `storage` — Needed — Used for local identity, sign-in session tokens, theme, microphone selection, push-to-talk settings, social cache, notification action data, diagnostics logs, temporary room state, and navigation handoff state. - `offscreen` — Needed — Used for a hidden extension document that keeps the party transport and Firebase auth bridge alive when the visible video page reloads or changes videos. - `notifications` — Needed — Used to show friend request and party invite notifications, including action buttons such as accept, decline, and join party. - `gcm` — Needed for push — Used to register this Chrome extension with Chrome/Firebase Cloud Messaging and receive push events for social updates. Core playback sync can work without push, but real-time friend/invite notifications need it. - `alarms` — Needed — Used for periodic social refresh and retry work, including notification registration recovery and invite acknowledgement retries. - `YouTube, Netflix, Crunchyroll, Prime Video, JioHotstar, Max/HBO Max, Hulu, Disney+` — Needed — Host access lets the content script show the Watch Peak Party panel, detect the current video, read playback state, and apply play, pause, seek, rate, and video-navigation changes on supported streaming pages only. - `watchpeakparty.fun` — Needed — Used for the Watch Peak Party API, WebSocket signalling, account website, and extension Google sign-in bridge. - `identitytoolkit.googleapis.com securetoken.googleapis.com` — Needed — Used by Firebase Authentication to sign in with Google and refresh the extension's Firebase session. Microphone and camera are not listed as extension manifest permissions. Chrome asks for them at the supported video site when you press the microphone, push-to-talk, or camera control. If you do not turn those controls on, the extension does not capture those devices. ## What we deliberately do not collect - No sale or rental of personal data. - No advertising profile, ad identifiers, ad SDKs, or behavioral advertising. - No Google Analytics, Meta pixel, session replay, or third-party product analytics in the extension. - No recording of streaming video, microphone audio, or camera video. - No access to your streaming-service account password, billing details, private watch history outside the supported party page, or messages on those services. - No access to Gmail, Google Drive, Google Contacts, Google Calendar, or your Google password. - No location permission, contacts permission, downloads permission, cookies permission, webRequest permission, or all-sites browsing permission in the extension manifest. ## Chrome Web Store Limited Use Watch Peak Party's use of information received from Google APIs will adhere to the [Chrome Web Store User Data Policy](https://developer.chrome.com/docs/webstore/program-policies/limited-use), including the Limited Use requirements. In practice this means the data described above is used only to provide and improve the watch party, friends, invitations, chat, and voice/video features that are the extension's single purpose. We do not transfer it for advertising, sell it to data brokers or information resellers, use it for credit or lending decisions, or allow humans to read it except with your explicit consent, for security investigations, or where the law requires it. ## Who else sees data We do not sell your data. The service providers involved are: - **Cloudflare** hosts the Worker, Durable Objects, WebSocket signalling, and TURN/STUN relay services. Cloudflare processes requests, IP addresses, operational logs, room metadata, and relay traffic needed to connect parties. - **Firebase / Google Cloud** provides Google sign-in, token refresh, Firestore storage for social/account data, and Firebase Cloud Messaging for Chrome push notifications. - **Brevo** may send you a one-time welcome email when you first sign in. It receives your email address, your name if available, and the email content. - **Streaming services** such as YouTube, Netflix, Crunchyroll, Prime Video, JioHotstar, Max/HBO Max, Hulu, and Disney+ receive your normal use of their own websites. Watch Peak Party does not replace their terms, privacy policies, logins, or subscriptions. We may also disclose information if required by law, to protect users or the service from abuse, or as part of a sale, merger, or reorganisation of Watch Peak Party. If that happens, the new owner must keep protecting your data unless you are given notice of a change. ## How long we keep it - Party rooms are temporary and expire after approximately six hours. - Direct party invitations expire after no more than six hours. - Chrome storage data remains on your device until you clear it, uninstall the extension, or sign out where the code removes the relevant session/social data. - Account profile, friend, device, and invite history stays while your account exists or until it is removed through the product or by request. - Cloudflare, Firebase, Google, and Brevo may keep operational logs and backups under their own retention schedules. ## Your rights and controls You can sign out from the extension or website, remove friends, decline invitations, turn off microphone/camera controls, clear site permissions in Chrome, disable notifications in Chrome, clear extension storage, or uninstall the extension at any time. Depending on where you live, you may also have rights to access, correct, delete, export, object to, or restrict use of your personal data. Email [privacy@watchpeakparty.fun](mailto:privacy@watchpeakparty.fun) and we will respond within 30 days unless a different legal deadline applies. ## How we protect it - Extension pages use Manifest V3 with a content security policy that allows extension code from the extension package. - API traffic uses HTTPS, and party signalling uses secure WebSocket (wss) connections. - Firebase ID tokens are verified by the Worker before social account data is read or changed. - Browser Firestore access is denied by rules; the Worker uses a service account after checking the signed-in user. - Party join secrets and socket tickets are time-limited. - TURN credentials are generated with limited lifetimes. - Friend-code and invite operations are written atomically where paired records must stay in sync. No system is perfectly secure. If we discover a breach affecting your personal data, we will notify you and any required authority without undue delay. ## Children Watch Peak Party is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact us and we will delete it where required. ## Changes to this policy We will update this page when what we do changes. If a change materially affects how we use your data, we will give reasonable notice by email, in the product, or on the website before it takes effect. ## Contact us Privacy questions: [privacy@watchpeakparty.fun](mailto:privacy@watchpeakparty.fun). General and account questions: [help@watchpeakparty.fun](mailto:help@watchpeakparty.fun).