Safety and trust
ModScrim puts realistic attacks on screen during a live stream, so it is built so that practice can never leak into the real thing.
Nothing reaches your real chat
Attacks stay in the practice chat
Nothing the attack engine writes is ever sent to Twitch chat. The only message ModScrim can ever post is an optional one-line notice that a drill is starting, and it never contains attack text.
Links that can’t open
Every generated link ends in
.invalid, a domain reserved so that it can never resolve.No real slurs
The hate-raid tactic uses placeholder tokens drawn as solid blocks. No real slur list exists anywhere in ModScrim’s code. The tactic is off by default and shows a content warning.
Banter is curated
The harmless lines mixed into a drill come from a fixed pool, never from real viewers’ messages.
Viewers see a safe overlay
No readable attack text
The overlay page never receives attack text. The server sends only the length of each line, which is drawn as a blurred bar next to the username and the outcome.
No evasion lists
Reports, exports and share links carry counts of tactics and tricks, never the attack lines themselves.
Practice is always labelled
The overlay’s alarm and every mod screen say practice, so nobody mistakes a drill for a real raid.
You approve every change
Approve, then push
No blocked term reaches Twitch until you press Approve and push. Every push has Undo this push.
Zero real-chat matches
Push stays disabled unless the proposed terms match none of your real chat from the last 7 days.
AutoMod is read-only
Twitch’s AutoMod update call overwrites every setting at once, so ModScrim never calls it. It only reads your levels.
Everything is logged
Pushes, undos, sign-ins, sign-outs, chat-log deletions and overlay key changes are written to your audit log.
Your data, kept short
7-day chat log
Your channel’s chat is kept for 7 days only to check that new rules won’t ban regulars. It is never shown on stream, appears in the console blurred until you hover it, and can be deleted or paused at any time.
Tokens never reach a browser
Your Twitch tokens are encrypted at rest with AES-256-GCM and used only on the server.
Leaving deletes everything
Sign out and delete my data removes your tokens, chat log, drills, reports and chat subscription. If you remove ModScrim from your Twitch connections instead, ModScrim deletes the same data once Twitch tells it about the change.
Found a way around one of these rules? Please tell us privately through the security contact in the source repository before sharing it anywhere else. For how data is stored and deleted, read the privacy policy.
