How the site keeps you safe

Security

The safest data is data that doesn't exist. Wisdom of the Chat stores nothing, and the few moving parts are locked down.

Encrypted, every time

• Every connection to wotc.stream is encrypted with HTTPS (TLS 1.2 or newer).
• The site tells browsers to only ever use HTTPS (HSTS), so a plain, unencrypted connection isn't possible.
• Certificates are issued and renewed automatically by Cloudflare.

Protected by Cloudflare

The site is served from Cloudflare's global network, which filters attacks and absorbs traffic floods (DDoS) before they reach the game.

A locked-down page

• A strict Content Security Policy means the page can only run code from wotc.stream, and can only talk to Twitch and load fonts from Google.
• The game can't be embedded inside other websites, which blocks click-jacking tricks.
• Only the game and these info pages can be opened. There are no folders to browse and no forms that send your data anywhere.

Twitch sign-in, done the official way

• Sign-in uses Twitch's own login page (OAuth). We never see or handle your password.
• We request no permissions. The sign-in can't read your email or messages, post in chat, or change your account. It only confirms your public username and lets the page fetch public profile pictures.
• The sign-in token stays in your browser and is only sent to Twitch. Sign out of Twitch in the Sign in & settings menu cancels it with Twitch straight away.
• Reading chat needs no sign-in at all. The page joins as an anonymous, read-only viewer.

Nothing to leak

There are no user accounts, no database and no stored chat logs. Every round lives only in the browser running it.

Found a problem?

If you spot a security issue, please email hello@wotc.stream with “Security” in the subject. Thank you. We'll get back to you quickly.