Privacy Policy

1. Controller

The controller within the meaning of the GDPR is:

ShishaWG, Inhaber Marvin Dutiné
Wiesenstr. 3
63110 Rodgau
Germany

Phone: +49 151 44555845
Email: info@shishawg.de

We are not required to appoint a data protection officer: fewer than 20 people are permanently engaged in the automated processing of personal data (§ 38(1) BDSG). For data protection matters please contact us directly at the address above.

2. Who processes what — overview

ChatGames serves two very different groups of people, so the information is split:

• Streamers sign in with their Twitch account and run the games. We receive that data from them directly (Art. 13 GDPR).
• Viewers take part by typing commands in Twitch chat. We do not receive their data from them, but through the Twitch interface (Art. 14 GDPR). Section 5 explains this in detail.
• Viewers can also sign in with Twitch to set their game picks on their private page /me. Section 3 covers that sign-in.

3. Sign-in and account (streamers and viewers)

When you sign in through Twitch, we receive your Twitch user ID, your username and display name and the email address stored at Twitch. We also record which version of the terms you accepted and when. Our processor Supabase stores this data for session management.

You grant Twitch the permissions the service needs: reading and writing chat. At sign-in we also offer further permissions for individual features, such as creating polls and predictions in your channel; each is listed with its purpose and you can untick it. Anything you untick is asked for only when you turn that feature on. One of them, off by default, is reading your followers (moderator:read:followers): Marbles uses it only to check, in a follower-only race, whether a viewer who types !join follows your channel; we keep the answer in memory for a few hours only. Your Twitch access token never reaches the browser in readable form: it is held in an httpOnly cookie and passed to our game engine server-to-server only. So that it does not expire during a long stream, we renew it server-side with Twitch's refresh token, which is also held in an httpOnly cookie.

Purpose: providing the service. Legal basis: Art. 6(1)(b) GDPR (contract or pre-contractual measures). This sign-in data is required to use the service: without it you cannot host games.

Usage statistics: so that we can see what gets played and what needs improving, we count per channel on which days the dashboard was open, which games were opened, started and finished, how long a game ran, how many chatters took part and how many chat messages came in (as numbers only). While the dashboard is open, we also ask Twitch every two minutes whether your channel is live, and store when it last was and the highest viewer count seen then (a public Twitch figure). Only the operator sees this overview; it is not published and not passed on. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding and improving the service). The entries are deleted with your account, otherwise 24 months after your last visit. You can object at any time by email to info@shishawg.de (Art. 21 GDPR).

Game settings: what you set in the dashboard for your games (for example mode, length, number of questions), which game tutorials you have already seen and a few dashboard switches are stored with your account, so that each of your devices opens the menus the way you left them. These are only your menu choices, no game or chat content. Purpose: providing the service. Legal basis: Art. 6(1)(b) GDPR. The data sits at Supabase in Frankfurt, can be read by your account only and is deleted with the account; it is included in the download at /account.

Retention: until you delete your account. You can delete it yourself at any time at /account; that also deletes your game statistics and removes the author name from the tracks you published. When you sign out or delete your account, we revoke your Twitch token at Twitch. After deletion your Twitch name sits on the block list from section 5 (as after !forgetme), so that no new statistics build up under it; !remember in chat takes it off again.

Viewer sign-in: on the page /me viewers can sign in with Twitch too. This sign-in asks for no chat permissions; we receive from Twitch only the account data named above (Twitch user ID, username, display name, email address) and record which version of the terms you accepted. Purpose: your private page /me, where you set your Marbles picks (see section 5, “Marbles picks”) and see your own game statistics. Only the signed-in person sees this page; there are no public profiles. Legal basis: Art. 6(1)(b) GDPR. Retention and deletion as above: until you delete the account at /account.

Mod panel: moderators can sign in with Twitch at /mod to steer the games of a channel they moderate. For that we ask for permission to read your moderated channels (user:read:moderated_channels) and ask Twitch which channels those are; we do not store that list. When you open the panel or trigger a command there, we record your Twitch name, the channel and the command in the server log (section 7); the answer in the channel's chat names you. Legal basis: Art. 6(1)(b) GDPR.

4. Cookies and local storage

We use strictly necessary cookies only and store on your device only what is absolutely necessary to provide the service you expressly requested (§ 25(2) no. 2 TDDDG). We therefore do not ask for consent and show no cookie banner.

• twitch_provider_token — httpOnly cookie holding your Twitch access token, 30 days, deleted when you sign out.
• twitch_refresh_token — httpOnly cookie holding Twitch's refresh token, used to renew the access token before it expires, 60 days, deleted when you sign out.
• sb-… (Supabase) — session cookies for the sign-in.
• cg_terms — remembers for ten minutes during sign-in which version of the terms you confirmed, then it is deleted.
• cg_viewer — httpOnly cookie after a viewer sign-in, so the start page takes you to /me instead of the streamer dashboard, 60 days, deleted when you sign out.
• chatgames_language — your language choice (browser local storage).
• golf_builder_draft, cg.* — your game settings, menu choices, audio and quality options, tutorials you have seen and drafts from the track editor (browser local or session storage). This data stays on your device; only when you start a game or publish a track do we send the settings chosen for it, or the track, to our server.

5. Viewers taking part (Art. 14 GDPR)

When a streamer starts a game, our engine reads the chat of that Twitch channel through Twitch's official EventSub interface. The source of the data is therefore Twitch, not you.

Categories processed: your Twitch display name, the text of your chat message and, derived from your chat badges, whether you are a moderator, a VIP, a subscriber (tier) or a Prime user. We use your Twitch user ID only so that your game statistics and the Marbles entries below stay with you when you rename; we do not evaluate your chat colour. If you type one of the channel's own emotes during a Marbles heat, it pops up over your marble for a moment; it is not stored.

Purposes: taking part in the game (your command makes a move, picks an answer, launches a marble), display in the game view of the live broadcast, and permanent leaderboards and statistics.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest, and the streamer's, is to carry out the move you expressly requested with your chat command and to present the results. You alone decide to take part by typing a command. If you type no command, we store nothing about you: your message only shows in the streamer's dashboard and is counted without your name (see below).

Retention: chat messages are processed transiently and not stored permanently. Game results (name, wins, times, records, ratings) are stored for the leaderboards and, once you have played, for the operator's internal usage statistics the number of your game commands and messages per name, in each case no longer than 24 months after you last took part; your profile is then deleted automatically. The exception is the per-track boards in Marbles (the track record with a recording of the record run, the best times, wins and ratings per track): your name stays there until you object with !forgetme. Nightly backup copies of this data are kept for at most 50 days (those of the last week and one each about 10, 15, 25 and 50 days old), so a deletion reaches them after 50 days at the latest.

Marbles regulars: per channel and Twitch user ID we store on how many stream nights you raced in Marbles there (for the “back for night N” and rookie tags on your name tag). The entries are deleted 24 months after you last took part in that channel, straight away with !forgetme; when the streamer deletes their account at /account, every entry of that channel goes too.

Marbles picks: when you pick a skin (!skin), a marble type (!marble), a colour (!color) or a trail (!trail) in Marbles, we store that pick under your Twitch user ID, together with the last freely available skin you picked and your Twitch name. The picks apply in every channel: at your next !join, whichever streamer runs the race, your marble rides like that again. Each channel checks for itself whether you may wear a subscriber skin there; otherwise you get your last free skin. A channel only sees your marble in the running race, not your stored picks. Signed in, you can also set and clear the picks on your private page /me. Legal basis: Art. 6(1)(f) GDPR (with the command you expressly ask for this marble; without storing it you would have to type it again in every stream), and Art. 6(1)(b) GDPR for picks set on /me. Retention: 24 months after you last took part or changed a pick; straight away with !forgetme, with “Clear my picks” on /me or when you delete your account.

We also count, without names, how many different chatters wrote on a given day and how many took part in a game. For this we keep only a one-way short value of your name in memory until the end of the day. These daily and per-game totals cannot be traced back to you.

Where the channel has turned the feature on, we also process: redemptions of a game's channel-point rewards (name and reward), the results of Twitch polls and predictions the channel starts through ChatGames (we only receive the totals per answer), and, in Marbles races with a minimum account age or for followers only, the creation date of your Twitch account and whether you follow the channel (both kept in memory for a few hours only). In a Twitch Shared Chat we also process messages from the connected channels. When two channels play each other ("Chat vs Chat"), your moves and your name also appear on the other channel's broadcast, whose streamer is then a recipient. Notices in chat may be posted by our bot account ChatGamesProBot instead of the channel.

Notice in chat: as soon as someone plays in a channel, our bot points to this privacy policy and to !forgetme, at most once an hour per channel; !privacy gives you the link at any time (Art. 14(3) GDPR). When a game ends, the bot posts the result and the Twitch names of up to three top players in chat.

The channel's moderation: when the moderators delete a chat message or ban someone (ban or timeout), we remove the message and the vote it cast, or the person, from the running game as well. For this we listen to the corresponding Twitch events and keep the IDs of recent messages briefly in memory; none of it is stored.

Objection with immediate effect: type !forgetme in chat. We then delete all statistics, records and ratings stored under your name and store nothing under your name from then on. To make that hold, your Twitch name is kept on a block list until you type !remember; you still count towards the nameless daily totals. An email to info@shishawg.de works just as well.

Joint controllership (Art. 26 GDPR): when a streamer starts a game in their channel, the channel and we jointly decide that chat commands are processed for the duration of that round. The essence of the arrangement: we provide the technology, process and store the data and are your single point of contact for all data subject rights; the channel decides whether and which game runs. You may exercise your rights against us and against the channel — contacting us is the simplest route. For user accounts and the permanent leaderboards we are the sole controller.

6. Publicly visible data

So that leaderboards can serve their purpose, the following is available without signing in:

• On /marbles/stats: Twitch names of successful players, their wins, times and track records, and the channel in which a record was set.
• A channel's mini golf leaderboard: Twitch name, wins, strokes, hole-in-ones.
• On /rankings (the ranking across all games) communities, i.e. channels, are compared with each other. Players appear only in the ranking of the channel they played in (/rankings/c/<channel>): Twitch name, stars, wins, rounds and placements there. There is no cross-channel ranking of individual players. For channels we also show when games are played there (weekday and hour) and which games; streamers can take their channel off the worldwide ranking.
• In the track library (/tracks, /courses): the Twitch name a track was published under. You can like tracks without signing in; so that nobody clicks twice, we keep your IP address per track in memory for one hour and do not store it.
• Result cards (/r/<id>): when a game ends we create a card with the channel name, the game, the result, the number of players and the Twitch names of up to three top players. The link is posted in the channel's chat and can be shared by the channel. The card can only be reached through that link, is not indexed by search engines and is deleted after 90 days; !forgetme also removes your name from every card.
• “Live now” on the home page: the name, open game and current viewer count (a public Twitch figure) of channels that are live on Twitch right now with a game open. Channels that took themselves off the worldwide ranking do not appear there.
• Boards between channels: the Size Up daily board, the Mini Golf weekly cup and the Backseat Apocalypse board show the channel name and its result. Channels that took themselves off the worldwide ranking are not named there.

This publication is based on Art. 6(1)(f) GDPR. You can object at any time with !forgetme or by email (Art. 21 GDPR).

7. Server logs and security

Our engine logs technical events (connections, errors, channel and Twitch user IDs). Names are logged in two cases only: who opens the mod panel and which command they trigger there, and the Twitch name when the lookup for a race with a minimum account age or for followers only fails at Twitch. We do not write chat messages or access tokens to logs. For debugging, the engine keeps the last 50 chat lines (name and text) in memory; only the operator can view them and they are not stored. We do not store IP addresses in our own logs; we hold them briefly in memory only, to limit too many requests from one address. They also occur briefly at our hosting providers while the servers run. Log files rotate automatically and are overwritten after 30 MB per service at the latest.

Where visits come from: when a public page is opened from outside, we count which website the visit came from (its domain only) or which tag the link carried (?ref=), and whether a new account came out of that visit. Only a daily total per source is stored: no IP address, no identifier and no link to a person or an account. We set no cookies for this and store nothing in your browser. The daily totals are kept permanently.

Legal basis: Art. 6(1)(f) GDPR (secure and error-free operation; for where visits come from, our interest in understanding how the service is found).

8. Bug reports and feedback

Every page carries a small bug button on the left edge of the screen. Use it to report a bug, ask for a feature or write to us about anything else. We store: the category you picked (bug, feature request, general), your text, the page you sent it from, the interface language and the time. If you are signed in, we also store your Twitch name and user ID so we know whom to ask if we have a question. Without a sign-in the report is anonymous.

Please do not put credentials or special categories of personal data under Art. 9 GDPR into the text field. We do not need them for a bug report. Please do not use this button to report illegal content — use the procedure in § 6 of our Terms of Service instead (form at /legal/notice).

To prevent abuse we accept at most five reports per IP address per minute. The IP address is held in memory only for that check, for at most one minute, and is neither stored permanently nor logged.

Reporting courses: when signed in you can report a mini golf course in the library. We store the reason you picked, the course with the name it was published under, and your Twitch name and user ID. When three different accounts report the same course, it is hidden automatically until the operator has checked it.

Reports live in our database at Supabase (Frankfurt) and can be read by the operator only. We delete them once they are handled and no longer needed for traceability, at the latest after 24 months. Reports sent from a signed-in account are deleted together with that account and are included in the copy of your data under Art. 15 GDPR.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in fixing bugs and improving the service); for signed-in streamers also Art. 6(1)(b) GDPR.

9. Service providers

The following service providers process data on our behalf:

• Vercel Inc., USA — website and server route hosting. Delivery runs through the Frankfurt location; the server functions currently run in the Washington, D.C. region (USA).
• Supabase, Inc. — authentication, database and the game engine's nightly backups. Everything is stored in the Frankfurt region (AWS eu-central-1).
• DigitalOcean LLC, USA — game engine server. The server is located in Frankfurt.

Independent controllers, not our processors:

• Twitch Interactive, Inc. (Amazon) — sign-in, chat, polls and predictions. Privacy notice: https://www.twitch.tv/p/legal/privacy-notice/

Images from Twitch, imgflip and flagcdn are not embedded directly but loaded through our own server, so your IP address is not transmitted to those providers.

The typefaces (Inter, Fredoka, Pacifico) are bundled at build time and served from our own server; there is no connection to Google Fonts.

10. Transfers to third countries

The game engine, the database and the backups are located in Frankfurt. The website's server functions currently run at Vercel in Washington, D.C. (USA). Sign-in and the account (including export and deletion), the leaderboard and result pages, bug reports and the image proxy run through them, so the data they handle, including the Twitch names of players, is processed in the USA.

Vercel Inc. and DigitalOcean LLC are certified under the EU-US Data Privacy Framework; transfers rely on the European Commission's adequacy decision (EU) 2023/1795 (Art. 45 GDPR).

Standard contractual clauses are in place with Supabase, Inc. (Art. 46(2)(c) GDPR); processing takes place in the EU.

Twitch Interactive, Inc. (USA) is an independent controller and is not certified under the Data Privacy Framework. Transfers to Twitch take place where they are necessary to provide the service you requested (Art. 49(1)(b) GDPR) and concern data the platform already holds.

A copy of the standard contractual clauses is available on request at info@shishawg.de. Despite these safeguards, access by US authorities cannot be entirely ruled out.

11. Your rights

You have the following rights against us:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Lodging a complaint with a supervisory authority (Art. 77 GDPR)

Signed-in streamers can exercise access and erasure immediately themselves: at /account you can download a copy of your account, track and game data and delete your account together with its data. Further data, such as your channel's usage statistics, is available on informal request. Viewers taking part use !forgetme in chat. For anything else, an informal message to info@shishawg.de is enough.

Right to object (Art. 21 GDPR): where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. As a viewer, typing !forgetme in chat is enough and takes effect immediately; otherwise send an email to info@shishawg.de.

Competent supervisory authority:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Wilhelmstraße 7
65185 Wiesbaden, Germany
https://datenschutz.hessen.de

12. No automated decision-making, no advertising

We use no third-party analytics, tracking or advertising services and embed no third-party scripts. What we count ourselves is set out in sections 3 (usage statistics per channel), 5 (nameless daily totals) and 7 (where visits come from). We build no profiles for advertising purposes and make no automated decisions producing legal or similarly significant effects within the meaning of Art. 22 GDPR. We do not sell data.

13. Children

The service is not directed at children. Hosting games requires a Twitch account; Twitch requires a minimum age of 13 and, for minors, the consent of a parent or guardian. If we learn that we process data of a child under 16 without the necessary consent, we delete it.

14. Changes to this policy

We adapt this policy when the service or the legal situation changes. The current version is always available on this page.