Skip to main content

Privacy Policy

Last updated: August 12, 2026.

1. Controller​

The entity responsible for your personal data ("Controller") is StreaLay. Contact details are available in the app under Settings → Help & Support.

2. Data We Process​

2.1 Account Data​

  • Email address - used for login and account identification.
  • Password - stored as an Argon2id hash; never stored in plain text.
  • OAuth accounts - linked Twitch/Discord providers for login.
  • Display name - optional, user-chosen.
  • Avatar image - optional, stored as base64 in the database.

2.2 Cloud Sync Data (only when you opt in)​

  • Overlay project files - JSON documents describing your overlays.
  • Audio files - binary audio data (mp3, wav, etc.) you upload for sync.
  • Asset files - images and other assets referenced by overlays.
  • Application settings - a selective subset (theme, playback preferences). Device-specific settings are not synced.
  • Alert history - recent played alerts (optional, for cross-device history).
  • Device identifiers - a random UUID generated per app installation.

2.3 Platform Connections​

When you connect a Twitch (or other platform) account, we store OAuth access and refresh tokens, broadcaster IDs, and granted scopes. These are used solely to deliver platform events to your client.

2.4 Feature Tracking (optional, opt-in)​

If you consent to feature tracking, the app collects anonymous usage metrics (which features are used). Admin features are excluded. Consent can be withdrawn at any time via Settings → Privacy.

  • Contract (Art. 6(1)(b)) - account data and platform connections are processed to deliver the service.
  • Consent (Art. 6(1)(a)) - cloud sync data and feature tracking are processed only after explicit consent. Consent can be withdrawn at any time.
  • Legitimate interest (Art. 6(1)(f)) - server logs, security hashes, and aggregate metrics are processed to operate and protect the service.

4. Hashing & Deduplication​

Files you upload are fingerprinted with SHA-256. Within your account, files with identical content share storage space. We do not compare hashes across different user accounts.

5. Storage Location​

Synced files are stored on the StreaLay server's filesystem (Docker volume). Data is not transferred to third countries without appropriate safeguards.

6. Data Retention​

  • Account data - retained until you delete your account.
  • Synced files - retained until you delete them individually, delete all via the Sync tab, or withdraw consent.
  • Alert history - 1000 entries locally (ring buffer); cloud-synced until deleted.
  • Feature tracking events - 90 days (metric_events), 30 days (metric_snapshots).
  • Device identifiers - retained until you sign out the device or withdraw consent.

7. Your Rights (GDPR)​

  • Access (Art. 15) - request a copy of your data.
  • Rectification (Art. 16) - correct inaccurate data.
  • Erasure (Art. 17) - delete all your synced data via the Sync tab, or withdraw consent.
  • Portability (Art. 20) - download your data as a backup ZIP via the Sync tab.
  • Objection (Art. 21) - object to processing based on legitimate interest.

8. Security​

  • Passwords hashed with Argon2id.
  • JWT-based authentication for all API routes.
  • OAuth tokens encrypted at rest.
  • Per-user storage isolation - no user can access another user's files.
  • Path-escape protection on all storage operations.
  • Quota enforcement prevents runaway storage growth.

9. Children's Privacy​

The Service is not directed at children under 16.

10. Changes to This Policy​

We may update this Privacy Policy from time to time. Material changes will be announced via the app.