Privacy Policy

1. What we collect

From Creators and their staff: an email address, given at sign-up or in a staff invitation; an optional display name; and a password, of which only an Argon2id hash is stored. If two-factor sign-in is turned on, its secret, the recovery codes and a record of codes already used. If you link a Twitch account to sign in with, its Twitch user id, and nothing else from that sign-in: Twitch's access token is not kept. A record of each signed-in session, which lasts at most 12 hours, and an audit log of admin actions naming the account that took them. A record that you accepted the Terms when your account was made: which version, when, and whether at sign-up or from a staff invitation. It is kept for as long as the account, and your data export includes it.

Everything a Creator puts on their site through the admin: lore, schedule, links, gallery, support tiers, Discord settings and a business email. If a Creator connects Twitch, Google or Discord, the access tokens, encrypted with AES-256-GCM and never shown again. If a Creator connects Twitch, up to 60 of their channel's public clips, refreshed every 6 hours: Twitch's id for each clip, and its link, title, view count, game and date, never the name of whoever made it; they are deleted when Twitch is disconnected from the site. If a Creator connects Google, the public videos among the latest 50 uploaded to their YouTube channel, refreshed every 6 hours: YouTube's id for each video, and its title, view count and date, with a link to it; they are deleted when Google is disconnected from the site. If a Creator subscribes, the Stripe customer and subscription ids, a VAT number if one is given for invoices, and the messages Stripe sends us about the subscription, stored as Stripe sent them for 90 days after they are acted on, which can include the billing name, email address and postal address given to Stripe, and after that only their ids, kinds and dates, for 6 years, with a record of each change we asked Stripe to make to the subscription; card details go to Stripe and never reach our servers.

When a Creator changes their sign-in address, the new address while it is being confirmed and the previous one while the change can still be undone. At sign-up, the address being proved. If an account is being deleted, the date the request was made.

From fans who submit fan art: the image, re-encoded from its pixels so that EXIF, location, copyright and artist fields do not survive, and a fingerprint of it used to spot duplicates; an artist handle, which is required so the piece can be credited; and, only if they choose to give them, a link and an email address. A Creator may keep a list of handles they have blocked from submitting.

From visitors: daily view counts per site and per source, which hold no identifier of any kind; a referral handle, only if they agree to it when they arrive through a ?ref= link, with a record of that choice which does not identify them; and, on a site marked mature, a date of birth typed into the age check, which is turned into a yes or no and never written to the database, a cookie or a log. To refuse repeated attempts at signing in, signing up and similar actions, we keep rate-limit counters keyed by the IP address or email address an attempt came from.

3. Integrations and third parties

When you connect a platform, we ask it for read-only access and nothing that would let us post as you: on Twitch, only who you are, which tells us which channel is yours, then your channel's public clips, and, if you import your schedule from Twitch, that schedule; on Google, your calendar and your YouTube account, read-only, from which we read your channel's latest public uploads; on Discord, your identity and the list of your servers. Signing in with Twitch asks Twitch only who you are, and gives us no access to your channel. You can revoke access from that platform at any time. Processors we rely on: Cloudflare (edge, DNS, tunnels, storage), Stripe (payments), an email delivery provider, and the platforms you choose to connect. Each is bound by a data-processing agreement and, where data leaves the UK/EEA, by Standard Contractual Clauses or an adequacy decision.

4. Fan-art submissions

Submissions go to the Creator's moderation queue, and a piece stays invisible until the Creator approves it. Your image is held in storage that no public address can reach until it has been processed, and it cannot be approved before that has happened. We re-encode every submission from its raw pixels and keep none of the original file's metadata — EXIF, XMP, IPTC and colour profiles are all discarded, including GPS coordinates and the embedded thumbnail that can still hold the uncropped version of a cropped photograph. The image the Creator sees is the rebuilt one; the file you sent is deleted once it has been processed. The optional artist account is how we reach you about a piece — we record an approval, a pin or an endorsement against it, and we do not have anything else to do with your address. Hidden and rejected pieces are kept until the Creator deletes them or the site is deleted.

5. Retention

While your account is open, we keep what Section 1 lists for as long as you keep it. Deleting your account starts a 30-day window: your sites come down immediately, your export stays available, and at the end of it the account and the files you uploaded are deleted. Deleting a single site removes that site and its images straight away, with no window. A site's record that you joined its team names your account and your role, not your address; its record that an owner reset your second factor names your account and the address you had then, for that record's 12 months. If you were on someone else's team, deleting your account removes you from it; that site keeps its record of what its staff did for that record's own period, but with your account removed from it, and your address wherever the record ties it to you. Fan art you sent stays with the site, as Section 4 says. A record of a referral stays, with you removed from it, because it can be what someone else's credit came from.

Some things now expire on their own, on an hourly job, whether or not anybody asks. Records of what staff did — permission changes, team changes, sign-in security events — are kept for 12 months. A record of security events on your own account — copies of your data, password changes and resets, signing other sessions out, sign-in address changes, two-factor changes, linking or removing a Twitch account for signing in, and attempts at any of them that were refused or stopped by a limit — is kept for 12 months. It also notes when you signed in, with your password or with Twitch, at most once a minute, and how many sign-ins to your account were refused for a wrong password or code, counted in 15-minute periods, and keeps those for the same 12 months. It notes what happened and when, never a password, a code or where you were. Your Security page shows the last 30 days, and your data export includes all of it. Records of moderation decisions about fan art are kept for 24 months, because a decision about somebody else's work is the one most likely to be questioned later, and by the person least able to keep their own copy. Ordinary product records, such as a theme edit or a calendar sync, are kept for 90 days. A report somebody files about a picture is kept for 90 days; what was decided about it is kept as a moderation record instead of the reporter's own words. An expired connection to Twitch, Discord or Google is deleted, along with its stored credential, 7 days after it expires. A record of a signed-in session is deleted 7 days after it ends, whether it expired or was signed out. A password-reset link is deleted on the first hourly run after it is used or expires. A code we send you to set up a second factor is deleted a day after it is used or expires. An invitation to join a site's team, with the address it was sent to, is deleted 7 days after it is accepted or expires; the note that it was sent or withdrawn is one of the records of what staff did, kept for 12 months, and names that address only until the last invitation to it on that site is deleted. A count of recent attempts — kept against the IP address or e-mail address that made them, which is how we stop somebody guessing a password or flooding a form — is deleted on the first hourly run after it is an hour old. A count of wrong sign-in codes for an account, kept against the account's address, and a note of whether we have warned that account today, kept against the account itself, are each deleted on the first hourly run after they are a day old, because a limit on guessing a second factor has to see a whole day; a new password clears the count. A record of a referral choice — a Creator's handle, whether a visitor agreed to the referral cookie, the version of the question and the hour, with nothing that identifies the visitor — is kept for 12 months. The messages Stripe sends us about a Creator's subscription are blanked 90 days after they are acted on. One we could not act on is kept, and our operators are alerted, until it is applied or deliberately set aside, and is blanked 90 days after that. A blanked message keeps only Stripe's id for it, its kind, when Stripe created it, when it reached us, when we acted on it and how many tries that took, and — if one of our operators set it aside rather than applying it — who did, and, if we could not apply it, why and when that was put right; that is deleted 6 years after it was acted on. Until it is put right, it also keeps which site and which subscription it was about, and is not deleted. A record that we asked Stripe to cancel or change a Creator's subscription keeps which subscription, what we asked and when, and who finished it if it was finished by hand; 90 days after it is finished, any error text and note are removed, and it is deleted 6 years after it was finished. One still in progress is kept until it is finished. A fan-art file whose scan failed or was flagged is deleted 7 days after that verdict, and the record that something was sent stays with the Creator.

If you sent us fan art, your e-mail address is not kept. We ask for it so we can tell you what happened to your piece. Once the Creator has decided and that message has been sent — or 7 days have passed since you sent the piece, whichever comes first — the address is deleted, from the piece and from our sending queue, automatically. If the Creator has not decided within 7 days of your sending it, the address is deleted then, and you will not hear what they decide. The artwork stays, with the handle and link you gave and the record that you agreed, for as long as the Creator keeps it. You do not have an account with us and could never have deleted the address yourself, which is why it goes without you asking.

The visitor counts are not on a timer, and that is deliberate. They are totals — how many people saw a page on a day — with nothing in them that identifies anyone, so there is nothing there to expire. They go when the site or the account goes. We would rather tell you why a period is absent than invent one.

Two honest limits. A period above is enforced in our live systems; a copy of the database taken before something was deleted can still contain it for up to 28 days, exactly as the next paragraph describes for accounts — so read every figure above as “that, plus up to 28 days in encrypted backups”. And if we ever had to restore from a backup, the periods re-apply themselves on the next hourly run, because they are rules about how old something is rather than notes about what we already deleted. A specific request from someone to erase something is kept separately, because it is not a rule about age: when we carry one out, we first record it on our own storage outside the database, and after a restore we re-apply every such request the copy predates. If you have made one and want to know it was re-applied, write to us at compliance@dpa-cloud.co.uk.

Backups need saying plainly and we would rather you heard it from us. We take a nightly encrypted copy of our database and keep it on our own hardware; the files you upload are not in it. Each copy is deleted automatically before it is 28 days old, whether or not newer copies have arrived since. A copy taken while your account still existed can therefore still contain it for up to 28 days after the account itself is gone — so the outside figure, if you want one, is the 30-day window plus 28 days. That window is deliberately no longer than the 30 days above, which is what lets us promise the next sentence: a copy is only ever restored to bring the whole Service back after a failure, never to reinstate one account, and a restore re-applies every account deletion, site deletion and erasure you asked for that had already taken effect. A site you delete goes offline at once and is deleted only once that deletion is recorded outside the database, usually within seconds; if a failure struck in that moment the site could reappear, and we would tell you and delete it again. If where you stand matters to you, ask us at compliance@dpa-cloud.co.uk.

6. Your rights

Wherever you are, you can ask us to access, correct, export or delete your data, and to object to or restrict processing — email compliance@dpa-cloud.co.uk. Creators can also delete their account, and download a structured copy of their account and site information, from the Account tab without asking. That copy covers what the tool selects, including references to stored images; it leaves out credentials, sign-in secrets, some internal fields and other people's personal details, and it is not a complete response to a data protection request — for access to everything we hold about you, write to compliance@dpa-cloud.co.uk. Under GDPR / UK GDPR you can also complain to your supervisory authority (the ICO in the UK). Under the CCPA/CPRA, California residents have the right to know, delete and opt out of “sale” or “sharing” — we do neither — and we will not discriminate for exercising those rights. Residents of other US states, Brazil (LGPD), Canada (PIPEDA), Australia and Japan have equivalent rights and can use the same address.

Correcting things is two different routes, and which one you use depends on whether you have an account. A Creator can change the e-mail address on their own account from the Account tab: we send a code to the new address, nothing changes until you type it back, and when it does change we sign out everyone signed in to the account and tell the old address — with a link that undoes it for 72 hours. Everything else a Creator can correct by editing it in the admin.

If you sent fan art to a Creator's site, you do not have an account, so correcting or removing the address you gave is a manual route. Email compliance@dpa-cloud.co.uk from the address you gave, or — if you can no longer use that mailbox, which is the commonest reason to be asking — tell us which site and which piece. We reply within five working days, and we will not write a new address anywhere until we have sent a message to it and had an answer. We would rather say plainly that this one is done by a person than build a form that quietly answers "does this address have fan art on this site?" for anybody who asks.

7. Children

The Service is not for children under 13 (or 16 where that is the local age of digital consent). We do not knowingly collect their data and will delete it on notice.

8. Cookies

Five cookies are strictly necessary, and each is set only when you do the thing it is for. vts_session keeps a Creator or a member of their staff signed in to the admin panel, for 12 hours. vts_reg and vts_emc tie a confirmation code to the browser it was asked for in, for 20 minutes, while signing up or changing a sign-in address. vts_oauth guards a connection to Twitch, Discord or Google, or a sign-in with Twitch, while it is being made, for 10 minutes. vts_age records a visitor's answer to a Creator's age check, on that Creator's site only, for 30 days, as yes or no and never as a date of birth.

One cookie is set only if you agree. If you arrive through a Creator's referral link, we ask whether to remember who sent you, so they can be credited if you start a site. If you agree, a cookie called vts_ref holds that Creator's handle, and nothing else, for 30 days. If you say no, nothing is stored on your device. You can forget it at any time on the Cookies page at vtstreamer.com/cookies, or by clearing your cookies. We keep a record of each choice for 12 months: the Creator's handle, what was chosen, the version of the question and the hour, and nothing that identifies you.

9. Changes

We will email Creators 30 days before a material change.

This prototype text is a starting point for counsel, not legal advice.