Escape fromScreenSecurity & access
Exactly what EscapeFromScreen receives from Twitch and DonationAlerts when you sign in, what it cannot do with your account, and how to revoke access at any time.
Updated: 16 October 2026
Signing in with Twitch
Sign-in goes through OAuth on Twitch’s own site: you type your password on id.twitch.tv and it never reaches us in any form. The list of permissions we request is empty — that’s why the Twitch sign-in window shows no permission list: there is nothing to list.
After sign-in we read your public profile once: id, login, display name and avatar. That’s all. The Twitch token is not stored afterwards — the dashboard runs on our own session cookie, and signing out revokes it.
| What | Why | Access |
|---|---|---|
| Login, name, avatar | To show you in the dashboard and to viewers on your world page | Yes, read-only |
| Email address | — | No, not requested |
| Posting in chat, banning, adding moderators | — | No |
| Stream title, category, channel settings | — | No |
| Subscriptions, bits, payouts, ads | — | No |
Whether you are live we learn from Twitch’s public API with an app token that is not tied to your account. Chat commands are read anonymously, the same way any viewer sees chat without signing in. Neither needs a permission from you.
DonationAlerts
Linking is for streamers only and only for donation events; viewers are not involved. It is OAuth as well: the password goes to the DonationAlerts site. We request three scopes, all of them read-only:
| Scope | What it gives | Why we need it |
|---|---|---|
| oauth-user-show | Account name and id | To show in the dashboard which account is linked |
| oauth-donation-index | Donation history | To catch up on donations missed during a disconnect |
| oauth-donation-subscribe | New donations in real time | To trigger map events and award coins to the donor |
There is no access to balance, payouts, widget or alert settings, goals, or creating alerts. We cannot change or withdraw anything — only learn that a donation arrived, from whom, how much and with what message.
The “Disconnect” button in the dashboard deletes the tokens from our server. On the DonationAlerts side, access is revoked in your account settings.
How to revoke access yourself
- Twitch: Settings → Connections → “Other connections” → EscapeFromScreen → Disconnect. The next sign-in on our site will ask for authorization again.
- DonationAlerts: the “Disconnect” button in the streamer dashboard — or your account settings on the DonationAlerts site, authorized applications section.
- Site session: “Sign out” in the dashboard header deletes it on the server. Your world, characters and viewers’ stashes stay intact.
How to tell it from phishing
Channel hijacks almost always go through fake “apps” that ask for channel-management permissions at sign-in: editing the stream, posting as you, banning, adding moderators. If the Twitch sign-in window shows a list like that — close it, whatever the site calls itself.
EscapeFromScreen’s permission list is empty, and sign-in always starts on id.twitch.tv and returns to escapefromscreen.ru. If you see a different address or a list of permissions, it is not us.
What we store
Your Twitch profile (id, login, name, avatar), the session, world data — characters, stash, raids, coins — the donation log, and DonationAlerts tokens for those who linked it. Tokens live on our server, which only the team can access. What, why and for how long is in the privacy policy.
Found a vulnerability or have a doubt?
Use the “Found a bug?” form in the footer of any page — messages reach the team immediately. Questions about access get honest answers with links to the code.