Privacy Policy

Last updated: September 6, 2026

1. Introduction

HexNode Group LLC DBA Apheliox ("we," "our," or "us") operates the Apheliox application (the "Service"). This Privacy Policy explains how we collect, use, and protect information when you use our Service.

Cookies and local storage

We use first-party session and security cookies to keep you signed in and protect requests. Browser storage also remembers preferences such as dismissed setup or installation prompts and overlay appearance. The desktop app stores settings and credentials locally and uses its own account connection.

When you acknowledge our storage notice while signed in, we record the notice version, the server time and whether you used the website or desktop app on your profile. For visitors who are not signed in, we remember acknowledgment in that browser for up to 180 days, without creating a visitor identifier or a separate anonymous profile. Clearing browser data removes this local record. Acknowledgment does not enable optional analytics or advertising tracking.

Platform pages opened by desktop collectors use their own cookies and privacy policies. The website also loads external font and billing resources. Review the relevant provider's information when using those features. You can revisit this notice using Cookies in the site footer or the desktop privacy controls.

2. Information We Collect

Account Information

When you create an account, we collect your name, email address, and password. Passwords are securely hashed and never stored in plain text. You may also upload a profile photo, which is stored on our servers.

Two-Factor Authentication

If you enable two-factor authentication (2FA), we store an encrypted TOTP secret key (for authenticator apps) or send one-time codes to your email. Recovery codes are hashed and stored securely. We do not have access to your authenticator app or its generated codes.

Social Sign-In

If you sign in using a third-party provider (Google, Discord, Twitch, or TikTok), we receive your name, email address, and profile identifier from that provider. We do not receive or store your password for those services.

Discord Integration

If you configure Discord notifications, we store your Discord user ID and notification preferences (DM, channel, or both). When you use our Discord bot integration, we access your Discord servers, channels, and roles via the Discord API to let you choose where notifications are sent. We store the selected server ID, channel ID, and role ID. For legacy webhook users, we store your Discord webhook URL.

Live Notifications

If you configure live notifications, we store the platform usernames you want to monitor for go-live status, along with your chosen Discord server, channel, role, and custom message template. We periodically check platform APIs to detect when these accounts start or stop streaming.

Team Data

If you create or join a team, we store team membership, roles, and any team-specific Discord webhook URLs. Team invitations include email addresses, which are stored until the invitation is accepted or expires.

Monitoring Data

The Service monitors publicly available live stream chat messages across supported platforms (TikTok, Twitch, YouTube, and Kick) for specified tracked accounts. We collect and store:

  • Chat messages from monitored live streams
  • Commenter usernames and display names
  • Stream metadata (platform, start time, end time, status)
  • Mention detection results based on your configured monitored words

Desktop App Local Collection

The optional Apheliox desktop app includes a "local platform collectors" feature, which is on by default and can be turned off in the app's settings. When enabled, the desktop app opens the public platform pages (TikTok, Kick, Twitch, and YouTube) for the channels configured on your overlays and processes the resulting publicly available chat and interaction events directly on your computer to render your overlay. Data captured this way is processed locally on your device and is not uploaded to or stored on Apheliox servers; it exists only in the running app and is discarded when the app closes. Platform pages loaded by the desktop app are governed by the respective platform's own terms and privacy policy, and any cookies or session data those pages set (for example, if you sign in to view an age-restricted stream) are stored only on your device; you can remove them by uninstalling the app or clearing its data.

Exported Data

When you export chat logs, mentions, or messages to Excel, those files are generated on-demand and delivered directly to your browser. We do not retain copies of exported files.

Usage Data

We may collect standard server logs including IP addresses, browser type, and access times for security and operational purposes.

3. How We Use Information

We use the collected information to:

  • Provide and maintain the Service
  • Authenticate your identity and manage your account
  • Send you alerts when monitored words are detected in chat
  • Deliver Discord notifications based on your preferences
  • Facilitate team collaboration and shared monitoring
  • Improve and optimize the Service
  • Ensure the security of your account

4. Data Sharing

We do not sell, trade, or otherwise transfer your personal information to third parties. Data is only shared with:

  • Discord — When you configure notifications, alert data is sent to Discord via our bot or your webhook. The bot accesses server, channel, and role information to deliver notifications
  • Platform APIs — We access publicly available live stream data from TikTok, Twitch, YouTube, and Kick
  • Social Sign-In Providers — Authentication data is exchanged with Google, Discord, Twitch, or TikTok when you use social sign-in
  • Your Team Members — If you belong to a team, other team members can see the team's tracked accounts, monitored words, and related mentions

5. Data Retention

Chat messages and monitoring data are retained for as long as needed to provide the Service. Team invitation tokens expire after 7 days. You may request deletion of your account and associated data at any time by contacting an administrator.

6. Data Security

We implement appropriate technical and organizational measures to protect your data, including encrypted connections (HTTPS), hashed passwords, role-based access controls, and encrypted database backups.

7. Your Rights

You have the right to:

  • Access your personal data through your profile settings
  • Update your name, email address, password, and profile photo
  • Configure or remove Discord notification settings and live notification channels
  • Enable, disable, or change your two-factor authentication method
  • Export your monitoring data to Excel
  • Leave teams you have joined
  • Request account deletion by contacting an administrator

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Last updated" date at the top of this page.

9. Contact Us

If you have any questions about this Privacy Policy, please contact us at [email protected].