Privacy Policy

1. Who We Are

StreamWizard is a Twitch stream management tool that helps streamers organise clips, manage overlays, and interact with their audience. The service is operated by J. van der Wit and can be contacted at [email protected]. Our servers are hosted at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.

2. What Data We Collect

Account & Authentication Data

When you sign in via Twitch OAuth we receive and store your Twitch user ID, display name, email address, profile picture URL, and OAuth access and refresh tokens (stored encrypted). We request only the Twitch scopes required to deliver the service.

App Content

We store the content you create inside StreamWizard: clip folders, overlay configurations, widget settings, and related metadata.

Analytics Data

We use PostHog (EU region) to collect anonymised page-view events, click interactions, and session recordings. Once you sign in, your PostHog analytics profile is linked to your StreamWizard account ID so we can understand how the product is used. PostHog stores data on EU infrastructure.

Error & Performance Data

We use Sentry to capture application errors. Error reports may contain your account ID, browser type, operating system, and the URL where the error occurred. No passwords or payment data are included in error reports.

Server Logs

Our servers automatically log IP addresses, request timestamps, HTTP methods, and response status codes. These logs are used for security monitoring and are not shared with third parties.

3. Why We Process Your Data

4. Third-Party Processors

We share data with the following sub-processors, all of whom operate under GDPR-compliant data processing agreements:

• Supabase — authentication and database. Data is stored in the EU region. Privacy policy ↗
• PostHog Inc. — product analytics and session replay. We use PostHog's EU region (eu.i.posthog.com). PostHog may process data outside the EEA including in the US; this is covered by a signed Data Processing Agreement, Standard Contractual Clauses (EU Commission Decision 2021/914), and PostHog's participation in the EU-US Data Privacy Framework. Privacy policy ↗
• Sentry — error and performance monitoring. Privacy policy ↗
• Hetzner Online GmbH — server hosting in Germany. Privacy policy ↗
• Twitch Interactive, Inc. — OAuth authentication provider. Your use of Twitch is governed by Twitch's own privacy policy. Privacy policy ↗

5. Data Retention

• Account and app data: retained while your account is active. Upon account closure, your account and app data are explicitly purged from active systems and backups within 3 months.
• Analytics data (PostHog): retained for 12 months.
• Error reports (Sentry): retained for 90 days.
• Server logs: retained for 30 days.

You can delete your account at any time from Settings → Account, or by emailing [email protected].

6. Your Rights Under GDPR

As a data subject under the GDPR you have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your personal data ("right to be forgotten").
• Restriction — request that we limit how we use your data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest.

To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with a supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens ↗.

7. Cookies & Browser Storage

We use the following browser storage:

• Authentication cookies (Supabase) — strictly necessary to keep you signed in. These cannot be disabled without breaking the service.
• Analytics cookies (PostHog) — used to recognise your browser across sessions and power session replay. Stored under our own domain via a reverse proxy to prevent ad-blocker interference.

We do not use advertising, remarketing, or third-party tracking cookies.

8. International Data Transfers

Most personal data is processed within the EU/EEA (Supabase EU region, Hetzner Germany, PostHog EU region). However, some data may be transferred outside the EEA:

• PostHog Inc. (US) — covered by a signed Data Processing Agreement, EU Standard Contractual Clauses (Module 2, Commission Decision 2021/914), and PostHog's self-certification under the EU-US Data Privacy Framework.
• Twitch Interactive, Inc. (US) — data shared as part of OAuth authentication is governed by Twitch's own Privacy Policy and their EU data transfer mechanisms.

We do not transfer personal data to any other countries outside the EEA without adequate safeguards in place.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically. Continued use of the service after changes constitutes acceptance of the updated policy.

10. Contact

For any privacy-related questions or to exercise your GDPR rights, contact us at [email protected].