Sign-in & your data.
This page explains the authentication integration being introduced for IRLegend. Availability depends on each sign-in provider being configured.
What your account contains
Your account can contain your email address, creator name, connected Twitch identity and the provider used to sign in. If you choose to save them, it also contains your birthday, billing address and mailing address. Date of birth and billing street address, city and country are required for new registrations. Google/Twitch users complete them after sign-in. These details are stored with your authenticated Supabase user profile and may be present in your browser session. You can edit these values in My Profile. New accounts must keep their required registration details complete to use streaming. Billing addresses do not enable payments or store card details. Profile details are not displayed in a public member directory.
Who handles authentication
IRLegend uses Supabase Auth for account identity and sessions. Email/password credentials are sent directly over HTTPS to the configured Supabase authentication service. When signing in with Google or Twitch, you authorize access through that provider; IRLegend does not ask for your Google or Twitch password.
What permission is requested
Social sign-in requests basic account identity and email information. Twitch sign-in does not request your stream key or broadcasting control. Broadcasting uses a separate Twitch stream key that you explicitly save in the studio.
Your browser session
The authentication client stores a session in your browser to keep you signed in. Sign out when using a shared device. Password fields are not copied into analytics, logs, URLs or public website files.
Access and development status
Supabase verifies authentication for profile requests. A website sign-in does not grant access to the private OBS studio, cameras or video receiver. Device access and public streaming features are still in development.
Cloud devices and video
If you connect a PC, IRLegend stores its name and account ownership on the OVHcloud prototype server. Device credentials remain on that PC. The companion reads the local OBS WebSocket settings; its OBS password is not sent to the cloud. Starting the cloud camera sends live audio and video through that server. This prototype does not record the feed. An OBS camera-source link grants read-only access to that account’s phone feed for up to 30 days; keep it private. Removing the PC revokes its device and camera-source access.
OBS stream keys
The OBS ingest connection uses RTMPS encryption. Each account can generate its own publishing key; the server stores a hash, and the full key is shown only when generated. Keep it private. The website player uses a separate read-only playback ticket scoped to your feed. The OBS and phone receivers have separate publishing keys. This prototype does not record their streams. When you save a Twitch key, it is stored encrypted on the OVHcloud server, separately from your Supabase profile. Pressing Live on Twitch sends the selected program video and audio to Twitch; Stop live ends that output. A broadcast continues if you close the browser. Preview sessions without a Twitch broadcast expire after ten minutes without dashboard activity.
Sharing an ingest
A sharing URL grants signed-in recipients read-only access to one selected OBS or phone feed, including the ability to use that feed in their own broadcast. Anyone holding the link can add it until its owner revokes it. Sharing does not reveal publishing keys, Twitch keys or account controls. The server stores a hash of the sharing token and each recipient’s feed connection. The full URL is shown only when created. Owners can revoke individual links in the dashboard; recipients can remove their connections. Revocation blocks further playback and switches an active shared scene to No signal. Video already buffered or independently recorded by a recipient cannot be recalled.
Your account display name is used in ingest sharing: owners can see recipients’ display names, and recipients can see the owner’s display name. The cloud server keeps the most recent display name observed when that account uses sharing controls. Names are only returned for that account’s own sharing connections. Revoked receivers disappear from the recipient’s shared feed list.
Account sharing codes
You can create a sharing code in Your profile for one chosen OBS or phone receiver. The code is stored encrypted so your authenticated account can display it again, with a separate hash for checking recipients’ entries. Anyone with the code and an IRLegend account may add that receiver. Regenerating or disabling the code revokes access granted through the previous code; separately created sharing URLs keep their own revocation controls. Shared receiver previews remain closed until you choose Preview. Take Live changes the selected program source.
Subscriptions and payments
Stripe hosts checkout and subscription management. IRLegend stores customer and subscription identifiers, the plan, provider status and paid-period expiry. Card details are entered on Stripe. The server verifies subscription status before enabling Go Live and applies the plan’s output quality. Admin-granted test access is labelled separately, expires automatically and is not a payment.
Admin and Editor access
Admins can manage service roles and test access, see account names/emails and subscription status, configure integrations and update supported public website content. Admin changes are logged. Integration credentials are encrypted on the cloud server and are not returned by settings pages. Editor invitations grant access to one owner’s scene text/colors and program-source selection; they do not grant that owner’s billing, Twitch key, or broadcast start/stop controls. Scene designs and rendered assets are stored on the cloud server.
Email invitations
Invitations are sent through Resend to the address an owner enters. They expire after seven days unless accepted, and acceptance requires the same verified account email. Owners can revoke Editor or ingest-sharing access. Accepted grants are checked on future actions and playback requests; already buffered or recorded video cannot be recalled.
Future account controls
Self-service export and deletion controls are not available yet. They must be implemented before a broader public launch. This page is a technical description of the current integration, not a complete service policy.
Friends, avatars and conversations
Friend lookup uses an exact connected Twitch name or friend code. Accepted friends can see your chosen avatar and exchange private messages. Your sign-in email, birth date and address are not exposed to friends. Messaging requires mutual acceptance and stops when a friendship is removed or blocked. Existing Editor/ingest permissions have separate revoke controls. Friend collaboration invitations stay in IRLegend and do not expose the recipient’s email.
Support conversations
Support tickets and chats are visible to their owner and authorised Admin/Support staff. Staff do not gain access to private friend conversations. Support replies depend on staff availability. Conversations retain the latest 200 messages per thread on the IRLegend server; messages are not end-to-end encrypted. Avatar uploads are converted to a metadata-free 256-pixel PNG. Removing an avatar removes its stored image.