Privacy
Controller: "Replace GbR", "replace@di-o.de".
What is stored, and why
- Your Twitch id, login and display name, read once when you sign in,
to identify your account. We ask for no Twitch permissions and keep no Twitch token: the
access token is used once to read your identity and then revoked.
- Your overlay settings — goals, colours, layout — so the browser
source can load them.
- Provider credentials (Streamlabs socket token, TipeeeStream API key),
encrypted at rest, used solely to open the event connection on your behalf.
- Event totals and a recent event log, to count your goals. The free
tier keeps six hours of log; paid accounts 90 days.
- Your email address, taken from your order, only to warn you before a
licence expires.
- Feedback you send from the panel, with your browser's user-agent and
panel language so a problem can be reproduced. It is emailed to the operator and deleted with
your account.
- Who referred you, if you signed up through another streamer's link,
so their account can be credited when you buy. They see how many people joined and paid
through their link, never who.
- A keyed fingerprint of each event source you connect (a one-way hash of
your Streamlabs token or TipeeeStream username, useless without our server key), so a free
trial can be had once per event source rather than once per Twitch account. It is kept after
you delete your account, for that purpose only. When you sign up through a link we also check
your Twitch account's creation date; it is not stored.
Who else sees it
Twitch (sign-in), Streamlabs and/or TipeeeStream (your events, at your instruction),
Stripe (payment processing, including the card details this service never sees), and the
hosting provider running this server. No advertising, no analytics that identify you, no
sale of data.
How long
Until you delete your account, which you can do at any moment from the panel. It is
switched off at once — no sign-in, overlay or event connection — and kept for one month,
so the free tier cannot be reset by deleting and re-joining, and a mistaken deletion can be
undone by signing in again. After that month it is permanently deleted with your profiles,
credentials, progress and event log. Payment records are kept as long as tax law requires.
Your rights
Access, rectification, erasure, restriction, portability and objection under the GDPR,
and a right to complain to a supervisory authority.
Write to "replace@di-o.de".
Cookies
One cookie, holding your signed-in session. It is strictly necessary for the service to
work and is not used for anything else.