How you're protected

What Vivoh.Earth can and cannot see when you broadcast — and the parts we can't protect you from, stated as plainly as the parts we can.

We cannot watch your broadcast. Not as a policy we promise to keep, but because the key doesn't exist on our side. Your browser encrypts every frame before it leaves, using a key derived from a secret that lives only in the part of your share link after the # — and browsers never send that part to a server.

So it never reaches our servers, our database, our logs, or the CDN that carries your video. If we were asked for your stream, by anyone, we would have nothing to give.

What each party sees

WhoSeesCannot see
Us That a broadcast happened, when, and how long Your video, your audio, your chat, your location
The CDN Encrypted bytes, your IP address, timing Anything inside those bytes
Your viewers The stream, if you gave them the link — and, when sign-in is required, if they are signed in Anything else
Everyone else Nothing at all Even encrypted bytes are out of reach without the link

Your broadcast is also not announced anywhere. There is no directory, no index, no public listing, and nothing published to any outside network that would reveal a stream exists or where it is being carried. The only way anyone learns about your broadcast is because you sent them the link.

You are not an account

There is no sign-up, no email address, no password, and no profile. Broadcasting needs a publish code, which you can request in a few seconds without telling us anything about yourself. We don't store the code, so there is no record connecting you to anything you broadcast — nothing for us to look up, and nothing for anyone to compel from us.

Each broadcast also identifies itself with a fresh cryptographic key that is created in your browser and never leaves it. That means your broadcasts are not linkable to each other, even by us.

We collect no location data

None — not country, not city, not coordinates, for broadcasters or viewers. Earlier versions of Vivoh.Earth did record broadcaster location. Those records were deleted, the columns that held them were removed from the database, and the backup taken beforehand was destroyed.

What we count

We do record that a broadcast had an audience: for each viewing session, which stream it was, when it began, and when it ended. That is how a broadcaster sees a viewer count, and how we know what our own bandwidth is being used for.

A session is a browser tab, not a person. Nothing attached to it identifies anyone — no IP address, no IP hash, no cookie, no fingerprint, no location. The practical consequence is the part worth checking: because there is no identifier, two sessions can never be shown to be the same human, whether on one stream or across different ones. One viewer who reloads the page is counted twice, and we cannot tell that they were the same person. We accept that inaccuracy deliberately — the only way to fix it is to keep something that identifies a viewer, and that is precisely what must not exist here.

An operator can read and export these counts per stream. What they get is how many sessions watched and for how long. What they cannot get, because it was never recorded, is who.

Controlling who watches

The link is the key

Anyone holding your complete share link can watch. Anyone without it cannot — not even someone who knows your stream's name, and not us. Treat the link the way you'd treat a door key, and send it through a channel you trust.

Requiring sign-in is the second lock, and it is on by default

The link carries the key, so anyone it reaches can decrypt the video. What decides whether they can receive it is Require sign-in, which is ticked for every new broadcast: we refuse to connect anyone who is not signed in to Vivoh.Earth, and the broadcaster can see exactly who is watching, by name.

Be exact about the difference between the two locks, because it matters more than it looks. The encryption does not depend on us and cannot be undone by us — the key never arrives here, so we could not decrypt your stream if we were compelled to. The sign-in requirement is the opposite: we enforce it, which means we are in a position to grant it, and in principle to be compelled to.

Wallflower.tv, which shares this code, makes the other trade: a passcode mixed into the key itself, so that nobody — including its operators — can let a viewer in. That is the right design for an anonymous audience and the wrong one here, where broadcasters need to know who is in the room. Vivoh.Earth does not have a passcode.

Turning a viewer's access off stops them joining immediately. Someone already watching stops within about five seconds: their browser is told the stream has ended and closes the connection.

Or start a new link

If the link itself has gone somewhere you didn't intend, New link is the blunt fix. It ends the current broadcast and starts another one with a new address and a new key, so nothing that was shared before still works. Your camera and microphone stay exactly as you had them — only the address changes — but everyone watching drops, so you'll need to send the new link to the people you still want there.

Chat is protected the same way

Messages and display names are encrypted in your browser under a key derived from the same link. Our chat server relays text it cannot read. That also means we cannot moderate chat — there is nothing there for us to read.

Moderation, and what it costs

Because we can't see what anyone broadcasts, we can't police content. What we can do is stop a stream: viewers can report one, and an operator can terminate it. Terminating takes effect for people already watching — it doesn't merely stop new ones — and it works whether or not the software they're using cooperates.

We still cannot say what a terminated stream contained, produce a recording of it, or tell a complainant what they were shown. Stopping is the whole of what we can do.

The limits

These are real. A page that only listed strengths wouldn't be worth reading.

A link can't be recalled. Once you've sent it, anyone who receives it — or is forwarded it — can watch. We can't revoke it for one person, because we can't decrypt it either. What you can do is cut off everyone: New link starts a fresh broadcast under a new address and a new key, so every copy of the old link stops working — including ours, if we had kept one. Requiring sign-in is the finer instrument: it cuts off anyone without an account, and lets you see who the rest are, without changing your link or interrupting the broadcast.

Anyone watching can record. A viewer's own device necessarily decodes your video to display it, so it can also save it. No system that shows people video can prevent this, and we don't claim to.

Your IP address is visible to the network. The CDN that carries your stream sees the address you connect from, and so does Cloudflare, which serves this site. We don't store it — but we can't hide it from them. If being located matters to you, use a VPN or Tor. That's the one protection we can't provide for you.

We can see that you broadcast, even if not what. Times, durations and how much data moved are visible to us and to the CDN. Encryption hides content, not the fact that something happened.

How to know this is true

None of the above is taken on trust internally either. Each claim is checked against the running service by automated tests, and the ones that matter most are the negative ones — tests that try to break a promise and must fail:

A fuller written assessment, including every known weakness and its severity, is kept as a dated security posture document. Ask and we'll send you the current one.

Last reviewed 15 August 2026. This describes Vivoh.Earth as it runs today; it will be rewritten when that changes rather than quietly left standing.