Your privacy matters. This policy describes how we collect, use and protect your data when you use TriBathon.
We comply with applicable data protection regulations, including GDPR for EU users.
2. Data we collect
2.1 Account data
Email address
Username and encrypted password
Account creation date
2.2 Streaming platforms (OAuth)
Twitch: user ID, username, channel info, subscriptions/bits/follows events
Kick: user ID, username, channel info, subscriptions/follows events
YouTube: channel ID and name, live chat events needed to detect memberships and Super Chats, and your live broadcasts (see 4.5 YouTube data and permissions)
StreamElements / Streamlabs: donation/tip events linked with your account via the token or JWT you provide
OAuth access tokens (stored encrypted)
Authorization and last update timestamps
2.3 Events and stats
Event type (subscription, bits, follows)
Date and time of the event
Subscription tier (1, 2, 3, Prime)
Bits amount
Super Chat and membership amount, currency and level (YouTube)
Donor username (public per platform)
2.4 Technical data
IP address
Browser and device type
Operating system
Visited pages and session duration
Error logs for diagnostics. When a page fails in your browser we record, regardless of your cookie choice and based on legitimate interest, only the error message (with email addresses, tokens and URL parameters removed), the file and line where it happened, the page path without parameters, your summarised browser and operating system, and the website version, to find and fix bugs
Payment checkout diagnostics: when you open the payment window we record, regardless of your cookie choice and based on legitimate interest, only technical data (checkout step reached, Paddle error code and transaction ID, language, plan, and summarised browser and operating system), with no payment or contact details, to detect when the payment window fails to load
3. How we use your data
Service operation: manage accounts, process platform events and keep the timer running
OAuth authentication: connect securely to Twitch/Kick
Stats and dashboard: show performance metrics
Service improvement: fix errors and enhance features
Communications: account and support notifications
Security: detect abuse and fraud
3.1 Legal basis (GDPR)
Contract performance: provide the service and manage your account
Consent: non-essential cookies (GA4, Hotjar, AdSense) and marketing when applicable
Legitimate interest: security, fraud prevention and technical improvements
Legal obligation: compliance when required
Transactional emails are sent via Resend. Marketing emails may be sent via Sender and open/click tracking is only used when you consent.
4. Storage and security
4.1 Data protection
SSL/TLS encryption for all communications
Passwords stored with secure hashing (bcrypt)
OAuth tokens encrypted in the database
Restricted access to personal data
4.2 Data location
Data is stored in secure servers where TriBathon operates. We comply with international transfer rules when applicable.
4.3 Data retention
We keep data while your account is active or as needed to provide the service. Some security data is retained for reasonable audit periods. You can request deletion at any time.
4.4 Retention of donation messages
The text of donation, tip, Super Chat and membership messages (Twitch, Kick, YouTube, StreamElements, Streamlabs) is automatically deleted 30 days after we receive it. We keep showing who supported you and the amount, but the message they wrote is removed once that period passes. This applies only to the message text — usernames stay visible so you can still see who supported you. For YouTube this is required by the YouTube API Services Developer Policies; for the rest it's our own choice, to avoid keeping content that no longer serves any purpose.
4.5 YouTube data and permissions
Permissions we request: read-only access to your YouTube account (youtube.readonly), to your channel memberships (youtube.channel-memberships.creator) and your basic profile and email (userinfo.profile, userinfo.email). Optional and coming soon: we will ask separately for read-only access to YouTube Analytics (yt-analytics.readonly), only if you turn on the audience figures (peak concurrent viewers and viewers per minute) that YouTube reports for your own live streams, and you will be able to decline it. You can revoke any permission at any time.
What we store: from your own Google/YouTube account, your email, display name and profile picture (to show the connection in your account) and the membership levels of your channel with the name, time and price you set for each; from your Super Chats and memberships, the amount, currency, level, date and message ID, the name of the channel that sent each one (kept for as long as you keep YouTube connected), and the IDs and on/off times of your live broadcasts. We do not store profile pictures of the people who support you or the text of normal chat messages. The text of Super Chat messages is deleted after 30 days, and live titles are cleared when the stream ends and never kept beyond 30 days.
Re-validation: we check that your authorization is still valid whenever you use TriBathon and whenever we sync your YouTube data. If you revoke TriBathon from your Google account, we delete your YouTube stream data within 30 days of detecting it (we wait 25 days and send you an email reminder from day 15 so you can reconnect).
Disconnecting: if you disconnect YouTube from TriBathon we revoke the token with Google, delete the statistics and records of your YouTube live streams and anonymise the events we received (our target is within 7 days; it normally happens right away). The anonymised event records keep the amount, currency and date, but no names or messages. Recaps you generated remain available to you until you delete them and may include the names of the people who supported you, also on YouTube; the public recap page never shows YouTube names.
Sharing: we do not sell YouTube data or share it with other companies. You see it in your account; the only places where it can be seen by others are those you choose to show, such as your stream widgets or a recap you share (the public recap page shows totals but not the names of your YouTube supporters).
To ask for deletion of your YouTube data, contact us at the address in section 11.
Analytics/experience services (GA4, Hotjar) with consent
Advertising (AdSense) with consent
Transactional email (Resend) and marketing (Sender)
Security and fraud prevention services
These providers are contractually required to protect your data and may not use it for other purposes. Hotjar never runs on sign-in, sign-up, password reset, email verification, account security or OBS widget pages, so those pages are never recorded.
5.3 Legal obligations
We may disclose data when required by law or to protect our legal rights and user safety.
5.4 We do not sell your data
TriBathon does not sell, rent or share personal data for third-party marketing.
6. Cookies and tracking
Authentication cookies: keep you signed in
Functionality cookies: remember preferences
Analytics cookies: understand usage (anonymized)
Non-essential cookies only run with your consent. You can change this anytime.
Some blog posts include Amazon Associates affiliate links to products we mention. If you buy through one of those links, we may earn a small commission at no extra cost to you. We only recommend products for the reasons stated in each post — we do not accept payment to feature a specific product.
9. Minors
Users must be at least 18 years old. We do not knowingly collect data from minors.
10. Changes
We may update this policy. Significant changes will be notified by email or a prominent notice.
11. Contact
If you have questions about this policy or want to exercise your rights, contact us: