Last updated: 2026-07-22
The controller responsible for the processing of personal data on this live streaming platform (the “Platform”) within the meaning of the General Data Protection Regulation (GDPR) is the operator of the Platform. Contact details for the controller are provided in the Legal Notice (Impressum).
This Privacy Policy explains what personal data we process when you use the Platform – whether you visit as a viewer, register a user account, transmit a stream, or take part in chat – the purposes and legal bases of that processing, how long we keep the data, and the rights available to you.
3.1 Server log & connection data. When you access the Platform, our servers automatically process technical connection data required to deliver the service and to keep it secure:
3.2 User account data. If you register an account, we process the username you choose, a securely hashed password, and – if provided – your email address and its verification status. Account settings you configure (such as feature flags granted by an operator, a chat display color, or notification preferences) are stored with your account.
3.3 Streaming data. If you transmit a stream, we process the media you send and technical telemetry needed to relay and monitor it, including stream keys (stored only as hashes), session start/end times, byte counts, resolution, frame rate, bitrate, codecs, and the source IP address of the encoder. Stream content is relayed live and is not retained by us as a recording unless a feature you explicitly enable does so.
3.4 Chat data. If you take part in chat, we process the messages you send and the identifier you appear under (your account username, or an automatically assigned guest name). Messages are transient and are not persisted to a database; a short in-memory buffer of recent message identifiers is kept only to support moderation actions such as deletion. Moderation records (bans, timeouts, moderator/VIP assignments) are stored for the affected channel and may include an account username and/or a truncated IP-based key.
3.5 Third-party integrations. If you connect a third-party account (for example a Twitch account) to use an optional feature, we process the identifiers and access/refresh tokens necessary for that integration; refresh tokens are stored encrypted. If a channel enables third-party emotes, your browser loads emote images directly from the relevant third-party emote provider, which will receive your IP address as part of that request.
3.6 Order & billing data (where applicable). If you place an order or receive an invoice through the Platform, we process the contact and transaction details necessary to fulfil and document that order in accordance with statutory retention obligations.
3.7 Audience measurement. We measure how the Platform is used without storing anything on your device and without any cross-site tracking. Instead of an identifier saved in your browser, we derive a pseudonymous value from your IP address using a keyed hash whose secret key changes every day. A second value uses a key that changes every calendar month. IPv6 addresses are truncated to their first 64 bits before hashing. The raw IP address is never written to these records and never appears in a log line for this purpose. Because the daily key rotates, records about the same visitor on two different days cannot be linked together; the monthly key allows counting how many distinct people visited within a single calendar month and supports no longer period than that. Alongside that value we record the date, which kind of page was opened (browse, channel, dashboard or other), the country and network type derived from the address, and a coarse device class (desktop, mobile, tablet, TV or bot) derived from your browser's user agent string. The country is derived from public internet registry data describing which country an address block is registered to, not from a commercial geolocation service, and it is accurate only at country level.
3.8 Viewing statistics. While a stream, clip or embedded player is playing and the page is visible, your browser periodically tells us which channel is being watched so that watch time and view counts can be measured. For signed-out viewers this is recorded only as an addition to daily per-channel totals broken down by country and player type; no record of an individual viewer is kept. For signed-in viewers, watch time per channel per day is additionally stored against the account, because it drives features such as achievements and channel points.
3.9 Date of birth and terms acceptance. When you register, and once for accounts created before this was introduced, we ask for your date of birth and for your acceptance of these terms. We store the date as given, the version of the terms accepted, the time of acceptance and the IP address it was accepted from. We ask for the full date rather than only the year because an age derived from a year alone is wrong by up to a year, which is not good enough at the thresholds that decide whether someone is 13 or 18. Your date of birth determines whether content marked as mature is shown to you and whether age-restricted advertising may be displayed. It is never shown publicly and is never shared. You must be at least 13 years old to hold an account.
3.10 Advertising. Advertising on the Platform is sold and served by us from our own servers. There is no third-party ad network, no advertising cookie, no cross-site tracking and no profiling. Advertisements are not selected on the basis of your personal characteristics or behaviour; the only inputs are which page or channel the advertisement appears on and, for an age-restricted advertisement, whether the account viewing it is old enough. We count when an advertisement actually became visible on screen, when one was clicked, and how many distinct people saw it in a calendar month using the monthly value described in 3.7.
3.11 Security and payment dispute records. Separately from everything above, and deliberately kept apart from it, we record an entry when an account is registered, signed in to, has its password changed, has its email address changed, or completes a purchase. That entry contains the full IP address, the country, the browser user agent, the time, and the account concerned. Unlike the measurement data described in 3.7, these records do contain your IP address in full. They exist to detect fraudulent use of accounts and payment methods and to allow us to answer a payment dispute or chargeback, and they are accessible only to our operators.
| Purpose | Legal basis (Art. 6(1) GDPR) |
|---|---|
| Delivering the Platform, relaying streams, and operating chat | (b) performance of a contract / pre-contractual steps; (f) legitimate interests in providing the service |
| Account creation, authentication, and session management | (b) performance of a contract |
| Security, abuse prevention, rate limiting, and moderation | (f) legitimate interests in a safe, functioning service |
| Server logs and error diagnostics | (f) legitimate interests in operating and securing the service |
| Email verification and service notifications | (b) performance of a contract; (f) legitimate interests |
| Optional third-party integrations you activate | (b) performance of a contract; (a) consent where required |
| Orders, invoicing, and statutory bookkeeping | (b) performance of a contract; (c) legal obligation |
| Measuring audience size and how the Platform is used (3.7, 3.8) | (f) legitimate interests in understanding and improving the service and in reporting audience figures to advertisers |
| Establishing age to protect minors from unsuitable content (3.9) | (c) legal obligation under youth protection law; (f) legitimate interests |
| Recording acceptance of the terms (3.9) | (b) performance of a contract; (f) legitimate interests in being able to evidence acceptance |
| Serving and measuring our own advertising (3.10) | (f) legitimate interests in funding the service |
| Preventing fraud and answering payment disputes (3.11) | (f) legitimate interests in preventing fraud and in establishing, exercising or defending legal claims |
| Marketing email, where you have separately opted in | (a) consent, withdrawable at any time |
We use strictly necessary cookies and browser local storage only, and we do not use advertising or cross-site tracking cookies. The cookies we set keep you signed in across the Platform (a session and authentication cookie scoped to our domain) and record that you have entered the password for a password-protected channel. Local storage is used to remember interface preferences such as a guest chat name or the side chat is displayed on.
Our audience measurement stores nothing on your device at all. It uses no cookie, no local storage and no device fingerprint, which is why the Platform does not ask you to accept or reject cookies for statistical purposes. If you confirm that you wish to view content marked as mature, that confirmation is held in memory for the current page only and is not written to your device.
The registration and sign-in pages load a bot-detection service (hCaptcha, operated by Intuition Machines, Inc.). That service is provided by a third party, receives your IP address, and may set its own storage on your device in order to distinguish automated abuse from real people. It is used solely to protect account creation and sign-in.
Personal data is processed on servers operated for us by our hosting provider(s) acting as processors under Art. 28 GDPR. We share data with third parties only where necessary to provide the service, where you have consented, or where we are legally required to do so. We do not sell personal data, and we do not share the measurement data described in section 3.7 with anyone: advertisers receive aggregate figures only, such as how many people visited in a month and the distribution of countries, never records about individuals.
The recipients we currently rely on are our hosting providers, our email delivery provider, our payment provider for purchases, the bot-detection service described in section 5, and, where a channel enables third-party emotes or you connect a third-party account yourself, the provider concerned.
Where a third-party integration you activate involves a provider outside the European Economic Area, the associated transfer is based on appropriate safeguards (such as the European Commission’s Standard Contractual Clauses) or on your consent. Our own infrastructure is operated within the EU/EEA where feasible.
We keep personal data only for as long as necessary for the purposes described above or as required by law:
Subject to the conditions of the GDPR, you have the right to:
To exercise these rights, contact us using the details in the Legal Notice. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77), in particular in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement.
Providing certain data is necessary to use the Platform: without connection data we cannot deliver content, and without account data we cannot create or authenticate an account. Providing an email address, connecting a third-party account, or enabling optional features is voluntary but may be required for the corresponding feature to work.
We do not use automated decision-making that produces legal or similarly significant effects concerning you within the meaning of Art. 22 GDPR. Automated measures such as rate limiting and abuse detection are used solely to keep the service secure and functioning.
We may update this Privacy Policy to reflect changes to the Platform or legal requirements. The “last updated” date above indicates the current version.