Privacy Policy

1. Information We Collect

1.1 Information from Twitch OAuth

When you sign in with your Twitch account, we collect:

• Your Twitch username and user ID
• Your email address
• Your profile picture
• OAuth access and refresh tokens

1.2 Usage Data

I collect information about your use of the service:

• Timer configuration settings
• Subscription goals
• Event logs (subscriptions, bits donations, manual adjustments)
• Timestamps of events and actions

1.3 Technical Data

I automatically collect certain technical information:

• IP addresses (for security and fraud prevention)
• Browser type and version
• Device information
• Log data (timestamps, request URLs, response times)

1.4 Anonymous Analytics Data

I use Umami Analytics, a self-hosted, privacy-focused analytics tool, to understand how the service is used. Umami does not use cookies and does not collect personally identifiable information. The data collected is strictly anonymous and processed entirely on my own server — it is never sent to third parties. This includes:

• Page views and navigation paths
• Referrer source (e.g., which site linked here)
• Browser type and operating system
• Device type (desktop, mobile, tablet)
• Country (derived from anonymized IP — IP itself is not stored)

2. How I Use Your Information

I use the collected information for the following purposes:

• Provide the Service: To operate the subathon timer, track events, and display timer overlays
• Authenticate Users: To verify your identity through Twitch OAuth
• Communicate: To send service-related notifications
• Improve Service: To analyze usage patterns and improve functionality
• Security: To detect and prevent fraud, abuse, and security incidents

3. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), our legal basis for processing your personal data includes:

• Consent: You consent when you sign in with Twitch OAuth
• Contract: Processing is necessary to provide the service you requested
• Legitimate Interests: For fraud prevention and service improvement

4. Data Sharing and Disclosure

I do not sell your personal information. Your data may be shared in the following circumstances:

• Twitch: I interact with Twitch's API to validate your OAuth tokens and receive event notifications (EventSub) about subscriptions and bits
• Hosting Provider: Your data is hosted on a VPS server provided by GalaxyGate.net. The server stores your timer configuration, event logs, and subscription data
• Legal Requirements: If required by law or court order

5. Cookies and Tracking

I use cookies only to maintain your session and provide authentication:

• Session Cookies: Essential for authentication (Next-Auth)
• Analytics (cookieless): I use Umami Analytics, self-hosted on my own server, which collects anonymous usage data without cookies and without storing personal information. No data leaves my infrastructure
• No Third-Party Trackers: I do not use Google Analytics or any other third-party tracking service

You can control cookies through your browser settings, but disabling cookies may affect service functionality.

6. Data Retention

I retain your personal data for as long as your account is active or as needed to provide the service. When you delete your account, I permanently delete your data immediately from the database, except where required by law to retain it for legal purposes.

7. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your account and data
• Data Portability: Receive your data in a structured format
• Withdraw Consent: Revoke consent at any time by deleting your account

To exercise these rights, please contact us or use the account deletion feature in your dashboard settings.

8. Data Security

I implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (HTTPS/TLS)
• Access controls and authentication
• Regular security assessments
• Secure token storage

However, no method of transmission over the internet is 100% secure. As a personal project, I cannot guarantee absolute security. Please review the security measures before trusting sensitive data to this service.

9. International Data Transfers

Your data is stored on a VPS server provided by GalaxyGate.net. The server location may differ from your country. By using this service, you acknowledge and consent to your data being processed in accordance with this Privacy Policy, regardless of server location.

10. Children's Privacy

This service is not directed to individuals under 13 years of age (or under 16 in the EEA). I do not knowingly collect personal data from children. If you believe I have collected data from a child, please contact me immediately.

11. Changes to This Policy

I may update this Privacy Policy from time to time. Changes will be reflected on this page with an updated date. Your continued use of the service after changes take effect constitutes acceptance of the new Policy.

12. Contact Me

If you have questions about this Privacy Policy or wish to exercise your rights, please contact me at:

Email: [email protected]

Developer: Davi Coelho

For GDPR-related inquiries, you also have the right to lodge a complaint with your local data protection authority.