Privacy Policy
Last updated: 29 June 2026
1. Who we are
Hayven ("we", "us") is a Twitch bot and viewer-engagement platform. The data controller is the platform operator. You can reach us at [email protected].
2. What data we collect
We collect only what is necessary to run the service. The table below describes each category.
| Category | Examples | Source |
|---|---|---|
| Twitch account data | Twitch user ID, login / display name, profile picture URL | Twitch OAuth login |
| Discord account data | Discord user ID, username | Discord OAuth login (optional) |
| Google / YouTube data | Google email, YouTube channel ID and name | Google OAuth login (optional) |
| OAuth tokens | Access and refresh tokens for Twitch, Discord, and YouTube | OAuth flows - encrypted at rest using AES-256-GCM |
| Profile data | An optional nickname you set, your per-channel display name, and avatar URL | You / Twitch |
| Viewer activity data | Streaks, watch time and time present on stream, loyalty points, channel-point redemptions, gifted subscriptions, clip counts, and raid history, for channels you watch where the bot is active | Twitch EventSub / chat / Helix while the bot is active in a channel |
| Community chat | Messages you send in a channel's on-platform community chat rooms | You |
| Moderation notes | Notes or labels a channel's broadcaster or moderators may record about a viewer, visible only to that channel's staff | Channel staff |
| Analytics data | Aggregate stream statistics (viewer-count samples, session length, ad-break timing) and privacy-safe acquisition metadata (referral source / medium / campaign and referrer host) when you arrive via a channel's share link - no IP, user-agent, or cookie is stored for acquisition | Derived while the bot is active / when you visit a channel link |
| Technical data | Your IP address, processed transiently for security, rate-limiting, and bot filtering; it is not stored against your account | Your requests / Cloudflare |
| Session data | Functional cookies that keep you signed in (see Section 4) | Set when you log in |
We do not collect payment information, precise location data, or any data from minors knowingly. Some viewer data - your channel-scoped profile, leaderboard standings, and watch-time statistics - may be displayed publicly on a channel's public page, its leaderboards, or the public channel directory. Viewers can opt out of data collection and public display, or have their data removed, at any time (see Section 7).
3. How we use your data (Art. 13 / 14 GDPR)
- To provide the service - powering chat commands, streak tracking, leaderboards, and goal progress. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- To connect to Twitch, Discord, and YouTube on your behalf - using OAuth tokens to call their APIs. Legal basis: performance of a contract.
- To keep you signed in - the session cookie. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).
- To improve the platform - reviewing aggregated, non-personal usage patterns. Legal basis: legitimate interests.
We do not sell your data, share it with advertisers, or use it for automated decision-making.
4. Cookies
We use only strictly functional cookies, set so the Service works:
session- keeps you signed in.invite_code- short-lived (about one hour); temporarily holds a channel invite code during channel registration.operator_session- signs platform staff in to the operator console (not set for regular users).- A short-lived cookie used only during Discord server setup.
None of these are used for tracking or advertising, and no third-party tracking scripts are loaded. Because we use only strictly necessary cookies, no consent banner is legally required under GDPR or the ePrivacy Directive; this notice fulfils our transparency obligation.
5. Data retention
Your account data is kept for as long as your account exists on the platform. Viewer activity data is kept for as long as the associated channel is active on the platform; some detailed analytics (for example per-viewer presence and ad-break correlation) is automatically pruned or aggregated after roughly 90 days. You can request deletion at any time (see Section 7), and viewers can remove their data or opt out using the bot's in-chat privacy and data-removal commands.
6. Data sharing
We use the following processors:
- Hetzner Cloud - server hosting (Germany/EU). Your data is stored on servers in an EU data centre.
- Cloudflare - DNS and DDoS protection (US). Cloudflare processes request metadata but does not have access to your stored account data.
No other third parties receive your personal data. If we are ever required to disclose data by law, we will notify you to the extent legally permitted.
7. Your rights
Under GDPR you have the right to:
- Access - request a copy of the data we hold about you.
- Rectification - ask us to correct inaccurate data.
- Erasure - request deletion of your account and associated data ("right to be forgotten").
- Restriction - ask us to pause processing while a dispute is resolved.
- Portability - receive your data in a machine-readable format.
- Objection - object to processing based on legitimate interests.
To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your national supervisory authority (e.g., ICO in the UK, BfDI in Germany).
Viewers who interact with a channel without their own Hayven account can also opt out of data collection and request removal of their data directly through the bot's in-chat privacy and data-removal commands, in addition to contacting us by email.
8. Security
OAuth access and refresh tokens are encrypted at rest using AES-256-GCM before being stored in the database. Connections to the server are encrypted via TLS (HTTPS). We follow the principle of least privilege for database access.
9. Changes to this policy
If we make material changes we will update the "Last updated" date at the top of this page. For significant changes, we will notify active streamers via Discord or email.
10. Contact
Questions about this policy: [email protected]