Callum Willetts

Privacy Policy

Last updated: 23 August 2026

This privacy policy applies to callumwilletts.co.uk and the CW Vault app, both operated by Callum Willetts ("we", "us"). It covers the website, the live stream and chat, channel points and subscriptions, the Minecraft server pages, and the Vault.

Information We Collect

When you create an account or log in, we collect:

  • Your username and password (the password is stored only as a secure one-way hash — we cannot read it)
  • Your email address, if you provide one. It is used to sign you in and to send a password-reset link, and for nothing else — we do not send marketing email
  • A device token for push notifications (if you grant permission)

If you use one of the optional features, we also store:

  • Your Twitch username, if you choose to link your Twitch account, so subscriber perks can carry across
  • Your subscription tier and start date, if you subscribe, so your perks and subscriber badge work
  • Channel points and redemption history, so balances survive between visits
  • How far through a title you watched, if you have access to the Vault, so playback can resume where you left off

How We Use Your Information

We use the information we collect to:

  • Authenticate you and keep your account secure
  • Send you push notifications about live streams and community updates (only if you have granted notification permission)
  • Allow you to participate in stream chat

User Generated Content

Messages sent in the stream chat are transmitted to our server and visible to other users during a live stream. We do not permanently store chat messages beyond the active session.

Website Analytics

We count visits to the public pages of this website so we can see which pages are worth keeping. This is done with our own software on our own server — no third-party analytics service is used, and nothing is shared with anyone.

We do not use cookies for analytics, and we do not store your IP address, build a profile of you, or follow you between websites. To count how many people visited rather than how many pages were loaded, our server combines your IP address and browser with a secret value that is replaced every day, turns the result into an irreversible code, and stores only that code. Because the secret is regenerated daily and the old one is deleted, the same visitor produces a different code tomorrow and cannot be recognised or followed over time.

We record only the page address visited (without anything after the ?), the website that linked you here (its domain only), and the date. Pages behind a login — including the Vault, watch rooms and admin pages — are excluded entirely.

If your browser sends a "Do Not Track" or "Global Privacy Control" signal, we record nothing at all.

Third Parties

We do not sell your personal data, and we do not share it for advertising or profiling. Two services process a small amount of it on our behalf, because the site cannot take payments or send email on its own:

  • Stripe handles subscription payments. Your card details go directly to Stripe and never reach our server — we never see or store them. We pass Stripe your account ID and username so a payment can be matched to the right account, and we store the customer reference Stripe gives back.
  • Resend delivers the password-reset email. It receives the email address the reset was requested for, and the message.

The site also links out to third-party services such as Twitch and Discord. Following those links takes you to them under their own privacy policies, which we encourage you to review.

Your Rights

You can see and change your username, colour and avatar from your profile at any time, and link or unlink Twitch whenever you like. You can delete your account and everything attached to it yourself from the delete account page — that removes your account, subscription record, points, redemptions, watch progress and any pending requests immediately and permanently. If you would like a copy of what we hold about you, or want something corrected, contact us using the address below.

Push Notifications

If you grant notification permission, your device token is sent to our server and used solely to deliver stream notifications. You can withdraw this permission at any time in your device settings.

Data Retention

Your account data is retained for as long as your account is active. You can request deletion of your data at any time by contacting us.

Anonymous analytics records are kept for one year and then deleted automatically. The daily secret used to count visitors is deleted after two days.

Children's Privacy

This app is not directed at children under 13. We do not knowingly collect personal information from children under 13.

Contact

If you have any questions about this privacy policy, please contact us at [email protected].