Privacy Policy - Watch Peak Party

The short version

Watch Peak Party collects the minimum needed to run a two-person watch party service: your Google sign-in profile if you sign in, your friend list and party invitations, temporary room metadata, chat messages during a party, Chrome push notification tokens, local extension preferences, and limited usage metering for voice/video features.

We do not sell or rent personal data. We do not run advertising or third-party analytics in the extension. We do not record the streaming video you watch. We do not record your microphone or camera. Microphone and camera streams are started only after you press the relevant control, and they are sent to the other participant through WebRTC.

Who we are

Watch Peak Party is a Chrome extension and website for watching supported streaming services together in sync. For this policy, "Watch Peak Party", "we", "us", and "our" mean Rana Aazan Mujahid, trading as Watch Peak Party, Y Block, DHA Phase 7, Lahore, Pakistan 54930.

Privacy questions: privacy@watchpeakparty.fun. General and account questions: help@watchpeakparty.fun.

What we collect and why

Google sign-in profile

If you choose to sign in, Firebase Authentication gives us your Firebase user ID, Google account identifier, display name, email address, and profile picture URL. We use this to create your Watch Peak account, show your profile in the extension, keep friends and invitations attached to the right account, and refresh your signed-in session. We do not receive your Google password, Gmail, contacts, Drive, calendar, or any other Google account content.

Local party identity

The extension creates a local random user ID and display name such as "Watcher 1234" so a party can show who is in the room even before social sign-in is used. This is stored in Chrome extension storage on your device.

Friends, friend codes, and invitations

We store your friend code, accepted friends, incoming and sent friend requests, party invitations, invite status, sender/recipient names, profile picture URLs, video title, platform, invite URL, creation time, expiry time, and response time. This is the social layer that lets you add friends and send direct party invitations.

Temporary watch party room data

When you start or join a party, the server handles a room ID, secure join secret, supported platform, video URL, video key, host user ID, display names, participant roles, socket tickets, and room expiry time. The room exists so both browsers can find each other, exchange playback state, and recover when one person changes videos.

Playback, chat, microphone, and camera state

During a party, the extension exchanges playback events such as play, pause, seek, rate, buffering, media-change, presence, and participant media state. Party chat messages are sent to the other participant while the party is active. Microphone and camera streams are captured only when you turn them on, and are sent through WebRTC. We do not record those streams.

Voice/video usage metering

When free-plan voice/video limits are active, the extension sends periodic heartbeat messages while microphone or camera features are in use. The server stores weekly usage counters, such as week start time, used milliseconds, and last heartbeat time. During the current unlimited launch promotion, the code treats voice/video as unlimited and skips the extra metering work where possible.

Chrome push notification tokens

If Chrome push notifications are available, the extension registers with Chrome/Firebase Cloud Messaging and sends us a registration token and extension ID. We store it so we can notify you about friend requests, accepted requests, removed friendships, party invites, and invite responses. If you sign out or a token stops working, the extension asks us to remove or replace it.

Local extension and website storage

The extension stores your sign-in session tokens, social state cache, theme, selected microphone device, push-to-talk setting, diagnostics logs, notification payloads needed for button actions, active-room handoff state, and temporary invite/navigation state in Chrome storage. The website stores a small local account cache after sign-in so the account panel can open without unnecessary repeated reads.

Security and operational data

Cloudflare and Firebase necessarily process request metadata such as IP address, user agent, requested URL, timing, and error information in logs and security systems. The Worker also uses IP addresses in a short-lived in-memory rate limiter for some unauthenticated endpoints.

Chrome permissions and host access

Every permission Watch Peak Party requests is listed below, with what it is used for. The extension requests nothing beyond this list.

tabs Needed

Used to find supported video tabs, open or reuse invite tabs, move an existing party tab to a new video URL, and send extension messages to the correct tab/frame during party navigation.

storage Needed

Used for local identity, sign-in session tokens, theme, microphone selection, push-to-talk settings, social cache, notification action data, diagnostics logs, temporary room state, and navigation handoff state.

offscreen Needed

Used for a hidden extension document that keeps the party transport and Firebase auth bridge alive when the visible video page reloads or changes videos.

notifications Needed

Used to show friend request and party invite notifications, including action buttons such as accept, decline, and join party.

gcm Needed for push

Used to register this Chrome extension with Chrome/Firebase Cloud Messaging and receive push events for social updates. Core playback sync can work without push, but real-time friend/invite notifications need it.

alarms Needed

Used for periodic social refresh and retry work, including notification registration recovery and invite acknowledgement retries.

YouTube, Netflix, Crunchyroll, Prime Video, JioHotstar, Max/HBO Max, Hulu, Disney+ Needed

Host access lets the content script show the Watch Peak Party panel, detect the current video, read playback state, and apply play, pause, seek, rate, and video-navigation changes on supported streaming pages only.

watchpeakparty.fun Needed

Used for the Watch Peak Party API, WebSocket signalling, account website, and extension Google sign-in bridge.

identitytoolkit.googleapis.com securetoken.googleapis.com Needed

Used by Firebase Authentication to sign in with Google and refresh the extension's Firebase session.

Microphone and camera are not listed as extension manifest permissions. Chrome asks for them at the supported video site when you press the microphone, push-to-talk, or camera control. If you do not turn those controls on, the extension does not capture those devices.

What we deliberately do not collect

No sale or rental of personal data.
No advertising profile, ad identifiers, ad SDKs, or behavioral advertising.
No Google Analytics, Meta pixel, session replay, or third-party product analytics in the extension.
No recording of streaming video, microphone audio, or camera video.
No access to your streaming-service account password, billing details, private watch history outside the supported party page, or messages on those services.
No access to Gmail, Google Drive, Google Contacts, Google Calendar, or your Google password.
No location permission, contacts permission, downloads permission, cookies permission, webRequest permission, or all-sites browsing permission in the extension manifest.

Chrome Web Store Limited Use

Watch Peak Party's use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

In practice this means the data described above is used only to provide and improve the watch party, friends, invitations, chat, and voice/video features that are the extension's single purpose. We do not transfer it for advertising, sell it to data brokers or information resellers, use it for credit or lending decisions, or allow humans to read it except with your explicit consent, for security investigations, or where the law requires it.

Who else sees data

We do not sell your data. The service providers involved are:

Cloudflare hosts the Worker, Durable Objects, WebSocket signalling, and TURN/STUN relay services. Cloudflare processes requests, IP addresses, operational logs, room metadata, and relay traffic needed to connect parties.
Firebase / Google Cloud provides Google sign-in, token refresh, Firestore storage for social/account data, and Firebase Cloud Messaging for Chrome push notifications.
Brevo may send you a one-time welcome email when you first sign in. It receives your email address, your name if available, and the email content.
Streaming services such as YouTube, Netflix, Crunchyroll, Prime Video, JioHotstar, Max/HBO Max, Hulu, and Disney+ receive your normal use of their own websites. Watch Peak Party does not replace their terms, privacy policies, logins, or subscriptions.

We may also disclose information if required by law, to protect users or the service from abuse, or as part of a sale, merger, or reorganisation of Watch Peak Party. If that happens, the new owner must keep protecting your data unless you are given notice of a change.

How long we keep it

Party rooms are temporary and expire after approximately six hours.
Direct party invitations expire after no more than six hours.
Chrome storage data remains on your device until you clear it, uninstall the extension, or sign out where the code removes the relevant session/social data.
Account profile, friend, device, and invite history stays while your account exists or until it is removed through the product or by request.
Cloudflare, Firebase, Google, and Brevo may keep operational logs and backups under their own retention schedules.

Your rights and controls

You can sign out from the extension or website, remove friends, decline invitations, turn off microphone/camera controls, clear site permissions in Chrome, disable notifications in Chrome, clear extension storage, or uninstall the extension at any time.

Depending on where you live, you may also have rights to access, correct, delete, export, object to, or restrict use of your personal data. Email privacy@watchpeakparty.fun and we will respond within 30 days unless a different legal deadline applies.

How we protect it

Extension pages use Manifest V3 with a content security policy that allows extension code from the extension package.
API traffic uses HTTPS, and party signalling uses secure WebSocket (wss) connections.
Firebase ID tokens are verified by the Worker before social account data is read or changed.
Browser Firestore access is denied by rules; the Worker uses a service account after checking the signed-in user.
Party join secrets and socket tickets are time-limited.
TURN credentials are generated with limited lifetimes.
Friend-code and invite operations are written atomically where paired records must stay in sync.

No system is perfectly secure. If we discover a breach affecting your personal data, we will notify you and any required authority without undue delay.

Children

Watch Peak Party is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact us and we will delete it where required.

Changes to this policy

We will update this page when what we do changes. If a change materially affects how we use your data, we will give reasonable notice by email, in the product, or on the website before it takes effect.

Contact us

Privacy questions: privacy@watchpeakparty.fun. General and account questions: help@watchpeakparty.fun.