Privacy Policy

1. Controller

The data controller is the operator of moonst3ad.com, a private individual based in the Czech Republic. Contact: maksim@zaytsev.cz.

2. What data we process

When you sign in with Twitch, we receive and store:

• your numeric Twitch user ID (permanent account identifier);
• your Twitch login and display name;
• your Twitch avatar URL;
• your site role (viewer / moderator / admin), including whether you moderate the moonst3ad Twitch channel;
• the version of the legal documents you agreed to and the time of consent;
• account timestamps (created, updated, last sign-in).

2a. What we do NOT receive

We deliberately request no additional Twitch scopes at sign-in: we do not receive your e-mail address or any private Twitch account data. Your Twitch access token is used once to read your public profile and is never stored.

Our hosting provider processes technical server logs (such as IP addresses) for security and operations; we do not use them to identify you.

The panel extension gives us no further reach into your Twitch account either: no e-mail address, no chat messages, no viewing, subscription or payment history — the token claims and public profile described in section 2b. We also check channel bans/timeouts and submit proposed lot text to Twitch AutoMod for moderation. Site bans and Twitch bans/timeouts prevent participation on both the site and extension. Viewing, privacy settings and existing balances remain available.

2b. Twitch extension panel

The moonst3ad panel extension on Twitch runs on the same account data. It never asks you to sign in again and sets no cookies: Twitch issues it a signed token for each viewer, and we read only what that token contains — the channel, an identifier for you, and the role Twitch asserts for you on that channel.

For viewers who have not shared their identity, that identifier is an opaque, channel-specific string we cannot link to a Twitch account; we use it only to serve the panel and store nothing against it. Sharing your identity is a separate step that Twitch asks you about explicitly and that you can revoke at any time in the extension's permissions. Once shared, the token also carries your numeric Twitch user ID, which we use to find your community account, offer in-panel profile setup if needed, and show your balance and community activity.

After you explicitly accept the documents in the panel, we fetch your public Twitch profile and create your community account, or record renewed agreement for an existing account. We store the document version and agreement timestamp. New accounts start at zero S3C; existing balances are preserved. Viewing the panel or sharing your identity alone does not create an account.

3. Purposes and legal bases

We process this data for the following purposes:

• creating and operating your account and signing you in — performance of a contract, Art. 6(1)(b) GDPR;
• serving the panel extension on Twitch and, once you have shared your identity there, showing your own balance, alerts and community activity in it — performance of a contract, Art. 6(1)(b) GDPR;
• syncing the moderator role with the Twitch channel's moderator list — legitimate interest in consistent community moderation, Art. 6(1)(f) GDPR;
• recording your consent to the legal documents — legal obligation / legitimate interest, Art. 6(1)(c) and (f) GDPR;
• optional anonymous usage analytics — only with your consent via the cookie banner, Art. 6(1)(a) GDPR.

4. Cookies

The panel extension sets no cookies and stores nothing in your browser: it authenticates with the per-viewer token described in section 2b, which is why it works inside Twitch without a session of its own.

The Site itself uses these cookies:

• ms_session — keeps you signed in (strictly necessary; 7 days);
• ms_oauth_state — protects the sign-in redirect against forgery (strictly necessary; 10 minutes);
• ms_pending_consent — holds your Twitch profile (ID, login, display name, avatar) during sign-in until you accept these documents; your account is created or updated only after that (strictly necessary; 10 minutes);
• Vercel Analytics — anonymous usage statistics, set only if you accept the cookie notice.

5. Recipients and processors

Your data is processed by the following service providers:

• Twitch Interactive, Inc. — identity provider and host of the panel extension: Twitch serves the panel's files, issues its per-viewer tokens and relays our “data changed” pings to open panels (the pings carry no personal data); your Twitch profile and your use of Twitch are governed by Twitch's own privacy policy;
• Vercel Inc. — website hosting (may process data in the USA under EU standard contractual clauses);
• Neon (database) — account storage, hosted in the EU (Frankfurt).

6. Retention

Site-ban records contain the Twitch ID, reason, expiry and administering account. We retain these moderation records independently of account deletion to prevent ban evasion; contact us to request review or removal. We keep your account data for as long as your account exists. You can request deletion of your account at any time by e-mail; we will delete your data without undue delay unless we must keep specific records to comply with the law.

The panel extension adds nothing to that: its token is verified on each request and then discarded, and the identifiers of viewers who have not shared their identity never reach our database. Deleting your account therefore also removes everything the panel could show.

7. Your rights

Under the GDPR you have the right to:

• access the data we hold about you;
• have inaccurate data corrected;
• have your data erased (“right to be forgotten”);
• restrict or object to processing based on legitimate interest;
• receive your data in a portable format;
• revoke the panel extension's access to your Twitch identity at any time, in the extension's permissions on Twitch — the panel then falls back to its anonymous, read-only view;
• withdraw consent at any time (for processing based on consent).

7a. Complaints

To exercise your rights, write to maksim@zaytsev.cz. You also have the right to lodge a complaint with the Czech Data Protection Authority (Úřad pro ochranu osobních údajů, uoou.gov.cz) or your local supervisory authority.

8. Changes to this policy

We may update this policy. Each version is identified by the version date at the top; the current version is presented for consent every time you sign in.