Privacy Policy

1. Who We Are

StreamWizard is a Twitch stream management tool that helps streamers organise clips, manage overlays, and interact with their audience. The service is operated by J. van der Wit and can be contacted at [email protected]. Our servers are hosted at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.

2. What Data We Collect

Account & Authentication Data

When you sign in via Twitch OAuth we receive and store your Twitch user ID, display name, email address, profile picture URL, and OAuth access and refresh tokens (stored encrypted). We request only the Twitch scopes required to deliver the service.

App Content

We store the content you create inside StreamWizard: clip folders, overlay configurations, widget settings, and related metadata.

Discord Support Tickets

If you open a support ticket in the StreamWizard Discord server, we save the conversation as it happens: the messages, the Discord names and avatars of everyone who wrote in it, and images up to 500 KB. Other attachments are kept as file name and size only. A message you edit is updated; a message you delete is kept and marked as deleted, so our team can still follow what the ticket was about. When the ticket closes you get a copy of the conversation by Discord DM, unless the server has turned that off. That DM may ask you to rate the ticket; the rating and any comment you add are stored with the ticket. If you send the bot a direct message, it only answers with a button to open a ticket; the text of that message is not read or stored. Our team uses this history to follow up on your issue and to see how support is doing.

Discord Server Moderation Log

To keep the StreamWizard Discord server safe, our bot keeps a log for our moderators of what happens in the server: members joining, leaving, being kicked, banned or timed out, nickname and role changes, changes to roles and channels, and edited or deleted messages. For edited and deleted messages the log includes the author, the channel and the text of the message. It also records your Discord name, Discord user ID and avatar, and, if you linked Discord to StreamWizard, your Twitch username. The log is posted to staff-only channels in the server and stored with our other platform logs.

Analytics Data

We use PostHog (EU region) to collect page-view events and click interactions. Your IP address is discarded at ingestion and is never stored with analytics events. If you accept analytics and sign in, your PostHog analytics profile is linked to your StreamWizard account ID so we can understand how the product is used. If you decline, we count page views in cookieless mode instead: no cookies, no identifiers, no profile. Only anonymous, aggregated statistics that cannot be tied to you. Separately, our servers record what you do with your account (for example signing in, finishing onboarding, creating or saving an overlay, uploading a file, syncing clips, starting Cloud OBS, or one of your overlays loading in OBS), tied to your account ID under legitimate interest, whether or not you accepted analytics. Those server-side events carry your browser's user-agent string (so PostHog can tell them apart from automated traffic) but never your IP address or location, and never create an analytics profile on their own; one only exists if you accepted analytics. You can object to them at any time (see Your Rights below). If your browser sends the Global Privacy Control signal, we treat that as declining analytics and do not show the cookie banner. If you accept analytics, PostHog also records session replays: how the page looked and where you clicked, so we can see where people get stuck. Every piece of text and everything you type is masked in your browser before anything is sent, and images and video are left out. If you decline, or have not answered yet, nothing is recorded. When an automated crawler (a search engine or an AI assistant) reads one of our public pages, we record which page and the crawler's user-agent string, never an IP address. PostHog stores data on EU infrastructure.

Error & Performance Data

We use Sentry to capture application errors. Error reports may contain your account ID, browser type, operating system, and the URL where the error occurred. No passwords or payment data are included in error reports. If you accept analytics, Sentry may also record a session replay of a visit where an error occurs, so we can see what led up to a bug. Replays mask all text and block images and video. If you decline, no replay is recorded.

Server Logs

Our servers automatically log IP addresses, request timestamps, HTTP methods, and response status codes. These logs are used for security monitoring and are not shared with third parties.

3. Why We Process Your Data

4. Third-Party Processors

We share data with the following sub-processors, all of whom operate under GDPR-compliant data processing agreements:

• Supabase — authentication and database. Data is stored in the EU region. Privacy policy ↗
• PostHog Inc. — product analytics. We use PostHog's EU region (eu.i.posthog.com). PostHog may process data outside the EEA including in the US; this is covered by a signed Data Processing Agreement, Standard Contractual Clauses (EU Commission Decision 2021/914), and PostHog's participation in the EU-US Data Privacy Framework. Privacy policy ↗
• Sentry — error and performance monitoring. Privacy policy ↗
• Hetzner Online GmbH — server hosting in Germany. Privacy policy ↗
• Twitch Interactive, Inc. — OAuth authentication provider. Your use of Twitch is governed by Twitch's own privacy policy. Privacy policy ↗

5. Data Retention

• Account and app data: retained while your account is active. Upon account closure, your account and app data are explicitly purged from active systems and backups within 3 months.
• Analytics data (PostHog): data linked to your account is deleted 12 months after your last activity. Anonymous, aggregated statistics that cannot be tied to you may be kept for up to 7 years.
• Session replays (PostHog): deleted after 30 days.
• Discord support tickets: conversations, images and your feedback comment are deleted 12 months after the ticket closes; the rating itself stays as an anonymous number. If you delete your account while your Discord account is linked, your messages in tickets are anonymised, your feedback comment and images removed. Replies from our team stay.
• Discord server moderation log: the text of edited and deleted messages is removed from our database after 30 days, or right away if you delete your account while your Discord account is linked. The rest of the entry (who, where, when) is kept. Copies already posted in our staff channels stay until a moderator removes them.
• Error reports (Sentry): retained for 90 days.
• Server logs: retained for 30 days.

You can delete your account at any time from Settings → Account, or by emailing [email protected].

6. Your Rights Under GDPR

As a data subject under the GDPR you have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your personal data ("right to be forgotten").
• Restriction — request that we limit how we use your data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest.

To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with a supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens ↗.

7. Cookies & Browser Storage

We use the following browser storage:

• Authentication cookies (Supabase) — strictly necessary to keep you signed in. These cannot be disabled without breaking the service.
• Analytics storage (PostHog) — not a cookie: one entry in your browser's local storage holding a random device ID, only written if you accept analytics. It is how we recognise your browser on your next visit. It never leaves your browser as a cookie; analytics requests go to our own domain and carry the ID in the request body. If you decline, no analytics storage or identifier is written at all.
• Consent record (PostHog) — one entry in your browser's local storage that remembers whether you accepted or declined analytics, so we do not ask on every visit. Stored either way you answer; it contains no identifier.
• Preference cookie (StreamWizard) — sidebar_state remembers whether you collapsed the dashboard sidebar. Kept for 7 days, used for nothing else.

We do not use advertising, remarketing, or third-party tracking cookies, and PostHog sets no cookies of its own. We honour the Global Privacy Control browser signal as a decline. Changed your mind about analytics? Cookie settings in the footer clears your choice and asks again.

8. International Data Transfers

Most personal data is processed within the EU/EEA (Supabase EU region, Hetzner Germany, PostHog EU region). However, some data may be transferred outside the EEA:

• PostHog Inc. (US) — covered by a signed Data Processing Agreement, EU Standard Contractual Clauses (Module 2, Commission Decision 2021/914), and PostHog's self-certification under the EU-US Data Privacy Framework.
• Twitch Interactive, Inc. (US) — data shared as part of OAuth authentication is governed by Twitch's own Privacy Policy and their EU data transfer mechanisms.

We do not transfer personal data to any other countries outside the EEA without adequate safeguards in place.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically. Continued use of the service after changes constitutes acceptance of the updated policy.

10. Contact

For any privacy-related questions or to exercise your GDPR rights, contact us at [email protected].