Privacy Policy

1. Who this policy covers

This Privacy Policy explains how StreamPixie (“StreamPixie,” “we,” “us,” or “our”) handles personal information when you use the StreamPixie website, widgets, message tools, API, Twitch bot, Discord bot, and related integrations.

StreamPixie is the controller of information used to operate the platform. A creator may separately control how they use messages submitted to their inbox or shown in their stream. Privacy questions can be sent using the contact details below.

2. Information we collect

Account and profile information

We store your name, email address, password hash, verification status, roles, account settings, pending email changes, invitations, and Terms-acceptance version and time. We never store your plaintext password.

Things you create and submit

We store widget instances and settings, inbox names and prompts, messages, optional sender names, message status and queue history, and the timestamps needed to operate those features. A submitted message may include a random signed-browser fingerprint used to enforce an inbox’s cooldown; StreamPixie does not use a stored IP address for that cooldown.

Twitch and Discord data

When you link an account, we store the platform, stable user ID, login name, display name, verification timestamps, approved OAuth scopes, and authorization status. For configured integrations we may also look up and store the stable user ID, login name, and display name of public Twitch channels you ask us to monitor, whether or not those channels belong to a linked account. We may store Twitch channel settings, custom reward IDs, titles, prompts, costs, availability, inbox mappings, and Discord server IDs, names, icons, permissions, visible channel and role names and IDs, effective bot permissions, and the identity that authorized management. Twitch or Discord events can include platform user, stream, conversation, message, reward, redemption, channel, role, and delivery IDs; usernames and display names; event and mention types; Bits or Channel Points amount; viewer-entered or creator-authored text; timestamps; delivery attempts; and failure details.

OAuth authorization codes and user access tokens used for Twitch identity and reward setup, Discord identity linking, or Discord server verification are transient and are not retained by StreamPixie after the flow completes. Twitch sends signed reward, redemption, and go-live events to StreamPixie, which uses an application credential to manage those webhook subscriptions. The separately operated StreamPixie bot uses its own service credentials and sends configured notifications to Discord.

API and technical information

API key secrets are stored as non-recoverable hashes along with their name, suffix, creation, revocation, replacement, last-use time, and use count. Sessions, security controls, and infrastructure may process request information such as browser type, timestamps, network address, requested URL, and error details in short-lived operational or security logs. Sensitive credentials, message bodies, and private tracking tokens should not be written to application logs.

3. How we use information

• Provide accounts, widgets, message queues, APIs, and requested Twitch or Discord features.
• Authenticate users, enforce permissions and cooldowns, secure credentials, prevent abuse, and investigate incidents.
• Send verification, password reset, invitation, email-change, security, and service messages.
• Provide support, respond to privacy requests, debug failures, and improve reliability.
• Comply with law, enforce our Terms, and follow applicable Twitch and Discord platform rules.

We do not sell personal information, use it for targeted advertising, or use Discord or Twitch message content to train artificial-intelligence or machine-learning models.

4. How information is shared

At your direction. Widget output and submitted messages may be displayed publicly in streams, signage, dashboards, or browser sources chosen by an account owner. Inbox owners can see and moderate messages sent to their inboxes.

Connected platforms. We exchange the minimum requested data with Twitch or Discord when you link an identity, authorize a server, enable a bot, or trigger an integration. Their own privacy policies apply to information they process.

Service providers. Hosting, database, backup, security, and transactional-email providers may process information on our behalf under appropriate confidentiality and data-protection obligations.

Legal, safety, and business needs. We may disclose information when reasonably necessary to comply with law, protect people or the service, investigate abuse, establish legal claims, or complete a merger, financing, acquisition, or transfer with appropriate safeguards and notice where required.

We do not disclose Twitch or Discord API data to data brokers, advertising networks, or unrelated monetization services.

5. Cookies and local storage

StreamPixie uses essential first-party cookies for sessions, sign-in persistence, CSRF protection, OAuth state, and anonymous message cooldowns. The browser stores your light or dark theme preference locally. These technologies make requested features work; they are not advertising or cross-site tracking cookies.

6. Retention and deletion

We keep account information and creator content while the account or feature remains active and as needed to provide the service. Reset requests, invitations, sessions, operational logs, and security records are retained only as long as reasonably necessary for their function, troubleshooting, fraud prevention, or legal obligations.

Disconnecting a Twitch or Discord identity removes its StreamPixie connection and dependent configuration as described in the interface. We delete platform API data when it is no longer needed for approved functionality, when the platform or user requests deletion, when we stop operating the integration, or when law requires it. Deleted information may remain temporarily in restricted backups until those backups rotate, unless law requires longer retention.

7. Your choices and rights

You can update your profile and email, disconnect linked accounts, revoke API keys, delete widget instances or inboxes, close submissions, and remove integrations through StreamPixie. Depending on where you live, you may also have rights to access, correct, delete, restrict, object to, or receive a copy of personal information, and to appeal a denied request.

Use the contact details below to make a privacy request or ask us to delete your account, Twitch or Discord API data, or other personal information. Tell us which StreamPixie and linked-platform accounts are involved. We may verify your identity before acting and may retain limited information where required for security, legal obligations, or dispute resolution.

8. Security

We use administrative, technical, and organizational safeguards designed to protect information, including access controls, hashed passwords and API secrets, limited OAuth scopes, transient provider tokens, CSRF protection, and encrypted production transport and storage where applicable. No online service can guarantee absolute security, so please protect your credentials and report suspected incidents promptly.

9. International processing

StreamPixie and its providers may process information in the United States and other countries where protections differ from those in your home country. Where required, we use appropriate safeguards for international transfers.

10. Children

StreamPixie is not directed to children under 13 or below the minimum digital-consent age in their country. We do not knowingly collect personal information from someone who cannot lawfully use the service. Use the contact details below if you believe a child provided information improperly.

11. Changes to this policy

We may update this policy as StreamPixie, its integrations, or applicable law changes. We will revise the effective date and provide additional notice when a change is material.