Archive Watch

Privacy Policy

Last updated: October 1, 2026

Archive Watch is a free app for Apple TV, iPhone, iPad, Mac, Android, Fire TV, Roku and the web for browsing and watching public-domain films and television from the Internet Archive. It is built to respect your privacy completely: there is no advertising, no tracking, and nothing about you is ever sold or shared. The apps have no analytics. Three small server features exist, all described below: the website’s aggregate counter, Watch Together rooms, and the feeds for other players and AI assistants. None of them stores anything about who you are.

Archive Watch is made and operated by Learning is Change, Inc. This policy covers every Archive Watch app and archivewatch.org, including Watch Together Studio, the part of the apps that uses YouTube API Services (described in its own sections below).

What we collect

The apps have no analytics of any kind. Archive Watch’s Apple TV, iPhone, iPad, Mac, Android, Fire TV and Roku apps never send us information about you or how you use them. The only thing an app ever sends our server is a Watch Together room’s playback position, and only if you open or join a room (see below).

The website keeps one counter, described immediately below. It is written so that it cannot hold anything about a person even if we wanted it to.

The website counter

archivewatch.org counts how often each part of the site is opened, and which public-domain films are opened and played. It stores rows of exactly this shape and nothing else:

• 2026‑09‑14  |  /browse  |  412 — a date, a part of the site, a count.
• 2026‑09‑14  |  the‑grapes‑of‑wrath‑1940  |  played  |  7 — a date, a film, whether it was opened or played, a count.

What it never stores, deliberately and permanently: your IP address, any cookie, any session or visitor identifier, your browser or device, the page you came from, your country, or the time of day. Nothing in it can be joined to a person, to another row, or to a second visit — including by us. We cannot tell whether two rows are the same person, and we cannot tell whether you have ever visited.

Playlists you share are never counted. A shared playlist travels inside its own web address, so that address is discarded in your browser before the counter is contacted at all.

The counter runs on Cloudflare Workers, alongside Watch Together rooms; those two are the only server-side things this project operates. There is no advertising, no third‑party analytics service, and nothing is ever sold or shared. The counts exist so we know which films people are finding useful.

Information stored on your device

To make the app useful, some information is stored locally on your device and never leaves it except as described under sync below:

• Your Continue Watching progress (where you stopped in a title).
• Your Favorites and any playlists you create.
• Your preferences, such as the mature-content filter and autoplay settings.
• If you use Watch Together Studio: your Studio setup (scenes, chosen camera and microphone, output settings) and, on a Mac, the YouTube shows you scheduled — described under the YouTube information Archive Watch accesses, stores and uses.

Cookies, local storage and similar technologies

• Cookies. Neither archivewatch.org nor any Archive Watch app sets a cookie, and Archive Watch does not allow any third party to place or read cookies, web beacons or similar tracking technology on your device or browser.
• The website keeps your favorites, playlists, playback progress and preferences in your browser’s own local storage, and keeps a copy of the site itself in a service-worker cache so it opens quickly and works offline. These stay in your browser; clearing the site’s data in your browser deletes them.
• The apps keep the information listed above in the app’s own preferences on the device, and keep sign-in tokens for YouTube or Twitch in the device’s secure storage (the Apple Keychain; Keystore-encrypted storage on Android). Deleting the app deletes its preferences.
• Signing in to YouTube or Twitch happens on Google’s or Twitch’s own sign-in page, in a system sign-in window. Those pages may set their own cookies under their own privacy policies; Archive Watch cannot read them.

Optional Sign in with Apple & iCloud sync

Signing in is entirely optional. Browsing and playback work fully without an account. If you choose to Sign in with Apple, it is used only to sync your own Favorites, playlists, and watch progress across the Apple TVs in your household, using your personal iCloud private database. That data lives in your own iCloud account — we have no access to it. The name and email associated with your Apple ID are handled by Apple and are never sent to us.

You can remove this synced data at any time from Settings → Account → Delete Account in the app, which deletes your records from your iCloud private database and signs you out.

Watch Together Studio: connecting a YouTube or Twitch account

Archive Watch can broadcast a public-domain film, with your camera and microphone, to your own YouTube or Twitch channel. This is entirely optional and off by default: nothing in the rest of the app requires it, and if you never open Watch Together Studio, no account is ever connected and none of this section applies to you.

Watch Together Studio: what the YouTube permission is used for

To start a broadcast, Archive Watch asks for one Google permission, https://www.googleapis.com/auth/youtube. It is used for exactly these operations on your own channel, and nothing else:

• Read your channel to show you which channel you are about to broadcast to, and to check that live streaming is enabled on it before you press Go Live. That check asks YouTube for a list of your broadcasts’ ids; only whether the request succeeds is used, and the list is discarded.
• Create a live stream and a live broadcast with the title and privacy setting you chose in the app.
• Bind them together, so that YouTube starts the broadcast by itself when the video arrives. That is what puts you on air.
• Set the broadcast’s thumbnail to a still of the show itself, a few seconds after it starts.
• Read how many people are watching that broadcast, so the number can be shown to you while you present.
• Read the live chat of that broadcast, so your audience’s messages can be shown on screen while you present.
• Post one message in that chat naming the film and linking to it on the Internet Archive, only when you press Share the film in chat. Archive Watch never posts on its own.
• End the broadcast when you stop the show — or, if the show stopped before the broadcast ever went live, delete that broadcast, so it is not left behind in your channel’s Upcoming list.

There is no narrower Google permission that allows an application to create and start a live broadcast. youtube.readonly cannot write, and youtube.upload covers uploaded videos rather than live events, so it cannot start one either. Everything above acts only on the broadcast Archive Watch created for that show, apart from the discarded list of ids above. It never reads your other videos, never uploads a video, never edits or deletes anything else on your channel, never touches your subscriptions, playlists or comments, and never acts on any channel other than the one you choose at sign-in.

Watch Together Studio: how that access is protected

• The sign-in never passes through us. You sign in to Google directly, in a system browser window the app cannot read (ASWebAuthenticationSession), using OAuth 2.0 authorization code flow with PKCE. Archive Watch never sees your Google password, and there is no Archive Watch account, password or profile of any kind.
• The token stays on your device. The access and refresh tokens are stored in the Apple Keychain with the protection class kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly — so they are encrypted at rest, unavailable until the device has been unlocked after a restart, never synchronized to iCloud and never copied to another device.
• No server of ours ever receives it. The only server-side things this project runs are the anonymous counter and Watch Together rooms described on this page; neither receives or stores any token or account. Your token is sent to googleapis.com and to nowhere else, over HTTPS.
• Your stream key is never stored and never displayed. It is fetched from YouTube at the moment you go live — or, if you choose to paste your own stream key instead of signing in, taken from what you pasted — held in memory for that session only, and discarded when the app quits. It is never written to disk, never shown on screen, and never written to a log — a test in our build checks every error path for it before each release.
• Nothing is logged about you. Archive Watch has no analytics, no crash reporting service and no telemetry, on any platform. Your channel name, your token and your viewers’ chat messages are never recorded anywhere outside your device.
• The video itself goes straight to the platform. Your camera, your microphone and the film are encoded on your own device and published directly to YouTube over RTMPS (TLS). No Archive Watch server, and no third party, sits in the path.

Watch Together Studio: the YouTube information Archive Watch accesses, stores and uses

This is every piece of information Archive Watch obtains through YouTube API Services, what it is used for, where it is kept and for how long. None of it is ever sent to Archive Watch or to anyone else; it goes only between your device and Google.

• Your sign-in tokens (OAuth access and refresh tokens) — to make the calls below on your behalf. Kept in the Apple Keychain on your device until you sign out or revoke access.
• Your channel’s id and name, and whether live streaming is enabled on it — to show you which channel you will broadcast to. Held in memory while the Studio is open; never written to disk.
• The live stream and broadcast Archive Watch creates (their ids, title, description, scheduled time and privacy setting, and the stream’s ingest address) — to go live. For a show you start now, held in memory for the show only. For a show you schedule ahead on a Mac, the broadcast and stream ids, title, description, scheduled time and privacy setting are kept in the app’s preferences so you can go live on it later; that copy is refreshed from YouTube whenever the Studio opens if it is more than a week old, removed when the broadcast is gone from YouTube, and deleted 12 hours after its scheduled time, when you cancel the show, when you sign out, when Google reports the access revoked, or after 30 days without a successful refresh — whichever comes first.
• Your stream key — to send the video. Held in memory for that show only; never written to disk, displayed or logged.
• The number of people watching your broadcast and your broadcast’s live chat messages — to show them to you, and on screen if you choose, while you present. Held in memory during the show and discarded when it ends; never written to disk by Archive Watch. (If you choose to record your show on a Mac, the recording is the picture you broadcast, so it includes any chat messages you chose to show on screen.)

Archive Watch does not share any of this with anyone, does not use it for advertising or analytics, and does not combine it with any other information.

Watch Together Studio: keeping it only as long as you want it

Sign out in Watch Together Studio revokes Archive Watch’s access at Google and deletes the token from your device immediately, together with any scheduled shows the Mac remembers; nothing of it remains. You can also revoke access at any time from your Google account’s security settings at security.google.com/settings/security/permissions. If you broadcast as a YouTube Brand Account, Google does not list that account’s access there, so use Sign out in the app. Because we hold no copy on any server, there is nothing else to delete and no request to make of us. On iPhone, iPad and Mac the Keychain can keep an item after an app is deleted, so sign out before deleting the app if you want the access gone at once.

Watch Together Studio: YouTube API Services

Watch Together Studio uses YouTube API Services. By connecting a YouTube account you agree to be bound by the YouTube Terms of Service, and Google’s handling of your information is governed by the Google Privacy Policy.

Watch Together Studio: Limited Use of Google user data

Archive Watch’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: data obtained through these permissions is used only to provide the broadcasting feature you asked for; it is never transferred to anyone else except as necessary to provide that feature, to comply with applicable law, or as part of a merger or acquisition with your consent; it is never used for advertising of any kind; it is never sold; it is never used to develop, improve or train any generalized or non-personalized artificial intelligence or machine learning model; and no human ever reads it, because it never leaves your device.

Feeds for other players and AI assistants

The playlists, program guide, Xtream source and assistant server listed on the Feeds & Integrations page answer requests from the player or assistant you point at them, and send each film to the Internet Archive to play. The server keeps a count for each day of how many times a player signed in, started a film, tuned a channel, or an assistant asked a question — a date and four numbers, with no address, film, username or question — so we know whether they are being used.

Watch Together rooms

When a host opens a room, Archive Watch’s server keeps one record for it: which film is playing (and which copy of it), where it is, and whether it is paused — so friends who enter the room’s code can watch in step. While a friend is in a room, their device sends a random token every 30 seconds that is made fresh each time they join and tied to nothing else; the host sees only how many such tokens arrived in the last minute. No account, name or IP address is stored; to stop abuse, Cloudflare counts each network address’s requests to the rooms for up to one minute and writes nothing down. The room and its tokens are deleted when the host ends it, and a room nobody ends is deleted within an hour of reaching six hours without activity. Separately, the server keeps a count for each day of how many rooms were opened and how many devices joined one — a date and two numbers, with no room code, film, token or address — so we know whether the feature is being used.

Watch Together Studio: Twitch

Connecting Twitch works the same way and is protected the same way: an OAuth device-code sign-in you complete on twitch.tv, and a token held only on your device (the Keychain on Apple devices; Keystore-encrypted storage on Android). It is used only on your own channel: to fetch your stream key and ingest server so the app can publish, to set the stream’s title and category to the ones you chose, to place a stream marker when you change scene or card, and to read how many people are watching. Chat is read from Twitch’s public chat without your token. You can revoke it at twitch.tv/settings/connections.

Network requests to public services

To show artwork, descriptions, cast, and to stream video, the app makes requests directly from your device to these public services:

• The Internet Archive (video and metadata)
• The Movie Database (TMDb) (posters, cast, synopses)
• Wikidata and Wikimedia Commons (fallback metadata and images)
• The Library of Congress (fallback imagery)

These requests carry only what any internet request carries (such as your IP address) and are handled by those services under their own privacy policies. Archive Watch sends them no information that identifies you.

Children

Archive Watch does not collect personal information from anyone, including children. A mature-content filter is on by default.

Changes to this policy

If this policy changes, the updated version will be posted on this page with a new date.

Contact

Questions about privacy? Email ben@learningischange.com.