Privacy policy

Version 2026-10-28 · linuxstreamer · Terms of service

Who is responsible

linuxstreamer is a private, non-commercial service for people I have invited. I run it, so I decide what is collected and why, and I am responsible for it (the "controller" in data protection law). My name is Johnny, and you can reach me at contact@noodlebyte.org.

What the service is

You get your own virtual machine running Steam, and your browser shows its screen and sends it your input. Everything you do in that machine happens on the server, not on your device.

What is stored about you, and why

• Your account: your username; your password, stored only as a one-way scrypt hash, so nobody can read it back; whether you are an administrator; and which version of these documents you accepted, and when. Why: to let you sign in and to know you accepted the terms.
• Your sign-in: a cookie in your browser (as_session) that keeps you signed in for up to 30 days. The server keeps only a hashed copy of it, with when it was created and when it expires. Why: so you stay signed in.
• Your machine: its virtual disk, which holds everything you do on it -- your Steam login, games, saves, settings, downloads and any other files. Why: it is the service.
• Logs: the server's log records each sign-in (your username and the time), each failed sign-in attempt (the username typed, the IP address it came from, and the time), each action taken on your machine from the admin panel (what, when, and from which IP address), and technical events such as your machine starting and stopping or a viewer connecting. Your machine's own technical logs record how its virtual graphics card behaved, including the names of programs that used it (for example a game's name). Why: logs are used only for debugging -- to find out why something broke and fix it, which includes noticing and stopping someone trying to break into an account. They are not used to watch what you do, for statistics, or for anything else.
• On your own device: your settings for this page (bitrate, controls and similar) are saved in your browser's local storage and never sent anywhere.

What is never collected or done

• Your screen, sound and input are streamed live to you and are never recorded. What you type is never logged; only the fact that input arrived is handled.
• No advertising, no analytics, no tracking, no third-party cookies, and no selling, renting or sharing of your data.
• The only cookie is the sign-in cookie above. It is strictly necessary for the service, so no cookie consent is needed for it.

Your Steam account and your machine

I will never sign in to, use or play on your Steam account, change its password, security or contact details, buy, sell, trade or gift anything on it, read your messages or friends list, or copy your login.

• You sign in to Steam yourself, inside your own machine. Steam keeps its own "remember me" login on your machine's disk, as on any computer.
• The admin panel cannot see your screen, take screenshots of it, control it, or run commands inside your machine; the server refuses these even if asked directly. It can only manage the machine from the outside: see that it is running and how much of the server it uses, limit its CPU, restart it or switch it off.
• I will only look inside your machine (its screen or its disk) with your permission -- for example when you ask me for help with a problem.
• The service's own software inside your machine does a few things automatically so that it works: it installs updates to itself and to the operating system, adds the shared game library to Steam and makes it the default install location, starts some games at your screen's size, and, when your machine is about to be switched off for being idle, checks whether Steam is in the middle of a download (from Steam's download status and the amount of network traffic) so the download is not cut off. None of this touches your Steam account itself.
• It also installs Decky Loader, a plugin system for Steam's interface, with a plugin of mine that hides your machine's own drive, and games in the shared library that your Steam account doesn't own, from Steam's screens. To know which games those are, it reads the list of games you own from the Steam app in your machine; that list never leaves your machine. It only hides things on screen and doesn't use Steam's "Hide game", so nothing in your Steam account changes. You can also install other Decky plugins yourself; those are your choice and not run by me.
• While you play, your machine tells the server which game is in front, and the server passes that on to your own browser tab so it can show on-screen controls that fit the game (for example keyboard-and-mouse controls for Counter-Strike). It is used for nothing else: it is not logged, not stored and not shown to anyone else.

Who else has access

• The server's administrator. The service runs on a computer that is administered by someone other than me, who has full technical (root) access to it. That access makes it technically possible for them to reach everything stored on it, including the logs and the machines' disks. They also run the web server in front of the site, which may keep its own access logs (IP addresses, times and pages requested) under their own retention.
• The shared game library. Games installed to the shared library are visible to the other users whose Steam accounts own them. Your saves, settings and Windows-game data stay on your own machine's disk.
• Services you use from your machine. When you use Steam, games, websites or other apps inside your machine, they get what they always get, under their own privacy policies -- with one difference: they see the server's IP address, not yours. Your machine also downloads its own updates from the operating system's update servers.
• Nobody else, unless the law requires it.

Legal basis

Where data protection law such as the GDPR applies: your account, your sign-in and your machine are processed to provide the service you asked for under the terms of service; the logs are processed in the legitimate interest of keeping the service working and secure, limited to debugging as described above.

How long things are kept

• Logs: 90 days, then deleted automatically.
• Sign-ins: expire after 30 days, or when you sign out.
• Your account: until it is deleted.
• Your machine's disk: while your account exists. If your account is deleted, the disk is kept until you ask for it to be deleted too, so that you can get your files back; ask and it is deleted.

Security

Passwords and sign-in tokens are stored only as hashes; the sign-in cookie cannot be read by scripts on the page; the site is only reachable over an encrypted connection; the account file can only be read by the server itself; and each machine is cut off from the server and from the other machines on the network.

Your rights

You can ask me at any time to tell you what is stored about you, to correct it, to delete it (including your account, your machine's disk and your entries in the logs), to restrict or object to its use, or to give you a copy of your data, including your machine's disk. Write to contact@noodlebyte.org and I will answer within one month. You can also complain to the data protection authority where you live.

Children

The service is for people aged 13 or over. If you are under 16, or under the age of digital consent where you live if that is higher, you may only use it with the permission of a parent or guardian.

Changes

If I change this policy, the new version gets a new date and you are asked to accept it before you can use your machine again.

Back