Privacy Policy

This policy explains what personal data Cozy Stream Bot ("we", "the service") processes, why, and the rights you have. We collect as little as we need to run the widgets and the chat bot, we never sell data and we don't use advertising trackers.

1. Who is responsible for your data

The data controller is:

• Owner: Christian De La Fuente Barrio
• Tax ID (NIF): 47532439-H
• Address: Calle Vizconde de los Asilos 3, 28027 Madrid, Spain
• Email: cozystreambot@gmail.com
• Website: cozystreambot.com

For any privacy question or request, write to the email above.

2. What data we process and why

Data	Purpose	Legal basis (GDPR)	How long
Twitch account of the streamer: user ID, login name, display name, email address, login tokens	Create your account, log you in with Twitch, contact you about your account or subscription	Contract (art. 6.1.b)	While your account exists
Your configuration: widget settings, palettes, chat messages, timer state, completed focus sessions	Provide the widgets, overlays and the bot	Contract (art. 6.1.b)	While your account exists
Viewers' chat data in the streamer's channel: Twitch username, task text and time of the bot commands they use (e.g. !add, !done)	Show viewers' tasks on stream and answer their commands	Legitimate interest (art. 6.1.f) — viewers send these commands publicly to take part in the stream	Until the task is removed by the viewer (!remove), by the streamer (!cleardone, !reset) or the streamer's account is deleted
Subscription data: Stripe customer and subscription IDs, plan, status and billing dates	Manage your trial and subscription	Contract (art. 6.1.b)	While your account exists; accounting records for the period required by Spanish tax and commercial law (up to 6 years)
Technical logs: IP address, browser, requested pages, errors	Security, abuse prevention and troubleshooting	Legitimate interest (art. 6.1.f)	About 30 days
Usage statistics of the website: pages visited, country (from the request, no IP is stored), referring website and campaign, device type, browser language, and an anonymous visitor code that changes every day. For streamers: the funnel steps of their account (sign-up, bot enabled, trial, subscription changes) and daily activity totals (live time of the overlays, widgets used, number of commands, tasks and distinct chatters)	Understand how the site and the service are used, improve them and measure the business (aggregated statistics)	Legitimate interest (art. 6.1.f)	Page visits: 13 months. Account statistics: while your account exists

Payments: subscriptions are sold through Link (Stripe), which acts as merchant of record. Your name, email, billing address and payment details are collected by Link at checkout and processed under Link's privacy policy; card details never reach our servers.
Analytics: we count visits ourselves without cookies and without storing IP addresses. The anonymous visitor code is calculated from your IP address and browser with a random key that is deleted every day, so visits can't be linked from one day to the next and the code can't be traced back to you. Chatters are counted with a one-way code of their login, never their name. We also use Simple Analytics, which counts page views without cookies and without collecting personal data.

3. Cookies

We only use cookies that are strictly necessary for the site to work: sessionid keeps you logged in and csrftoken protects forms against forgery. They are not used for tracking or advertising, so no consent banner is needed. Stripe sets its own cookies on its payment pages to prevent fraud.

4. Who we share data with

We only share data with the providers we need to run the service, under data processing agreements:

• Google Cloud (Google Cloud EMEA Ltd.) — hosting and database, located in the EU (Belgium).
• Stripe and Link (Stripe Payments Europe Ltd. and Link Payments, Ireland) — Link is the merchant of record for subscriptions: payments, taxes, invoices and payment support, as an independent controller for that data. Stripe also hosts the subscription portal.
• Simple Analytics (Simple Analytics B.V., Netherlands) — anonymous page view statistics.
• Twitch (Twitch Interactive, Inc.) — login and chat. Twitch processes your data as an independent controller under its own privacy notice.

Some of these providers may process data outside the European Economic Area (for example in the United States). In those cases transfers are covered by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

We do not sell personal data and we do not make automated decisions with legal effects about you.

5. Your rights

You can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format. Write to the email in section 1; we answer within one month. Deleting your account removes your profile, configuration and the tasks shown on your widgets; invoices are kept only as long as the law requires.

Viewers can remove their own tasks at any time with !remove, or write to us to have their data deleted.

If you think we have not handled your data properly, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es) or the authority of your country.

6. Age

To use the service you must meet Twitch's minimum age. Paid plans require being at least 18 years old or having the consent of a parent or legal guardian. We do not knowingly collect data from children under 14.

7. Security

Data travels encrypted (HTTPS), the database is not publicly accessible and access to production systems is restricted. Overlay URLs contain a private token — if one is leaked, contact us and we will rotate it.

8. Changes to this policy

If we change this policy in a meaningful way we will notify you by email or in the dashboard before the change applies. The date at the top always shows the current version.