Privacy Policy

Who we are

Bloopbot is a chat bot and stream-automation product for Twitch, operated as a sole trader in the United Kingdom. For the personal data described in this policy, the controller is:

[TO CONFIRM: whether the trader is registered with the UK Information Commissioner’s Office as a data controller, or is exempt, and if registered, the registration number.]

This policy explains what personal data Bloopbot holds, why it holds it, how long it keeps it and what you can ask us to do with it.

This policy is written for the service at https://bloopbot.com. If you reached Bloopbot on a different address, a different organisation may be the controller: [TO CONFIRM: how a visitor of another installation finds its controller].

The personal data we collect

Bloopbot only works after you link a Twitch account, so most of what it holds starts with that link. The categories below are the ones the running code stores.

We do not ask for your real name, your postal address or your payment details. If you choose to add a backup sign-in email, we store that address from the moment you save it, and use it only to send you the link that confirms it, sign-in links, and notices about changes to it. Only a confirmed address can sign you in. It is deleted when you remove it under Account, or when you unlink your channel’s Twitch account, together with the records of the links sent to it.

Why we use it, and the lawful basis

Where we rely on legitimate interests we have weighed our interest against your rights and expectations: the data involved is what Bloopbot needs to run one Twitch channel, it is not used to profile you, and it is never sold or rented.

We do not use your data for automated decisions that have a legal or similarly significant effect on you. AI steps in a flow do make judgments about chat messages, but the consequences are moderation actions inside one Twitch channel and are always under a human streamer’s control — see “AI features” in our Terms. [TO CONFIRM: whether any AI moderation outcome needs a UK GDPR Article 22 statement.]

[TO CONFIRM: the lawful basis for any purpose added after this draft, for example billing or marketing email.]

Viewers, streamers and who is responsible

Bloopbot is used by a streamer, but it also processes data about that streamer’s viewers: chat messages, loyalty points, watch time, giveaway entries, quotes, song requests and moderation history.

The streamer decides how their channel is configured — which features are on, which filters run, what the loyalty and giveaway rules are, and what the AI is asked to judge. For that viewer data Bloopbot processes information on the streamer’s behalf: the streamer is the controller and Bloopbot is their processor, except where we act as an independent controller for our own security, abuse prevention and service operation. [TO CONFIRM: the processor/controller split and the data-processing terms offered to streamers.]

If you are a viewer and you want to know why a message was moderated, what points you have, or to have your viewer data removed, the streamer of that channel is the fastest route — they can see and change their channel’s data. You can also contact us, and we will pass the request on and help the streamer answer it.

If you are a streamer, you are responsible for the notices you give your own viewers about your channel, and for making sure you have a lawful reason to run the features you switch on.

Who else processes it

We do not sell personal data, and we do not share it for advertising. We use the following services, each under its own terms, and each only for the purpose listed:

The hosting, database, cache and message-broker infrastructure that runs the service is operated for us on infrastructure we choose. [TO CONFIRM: the hosting provider(s), their role, their region and their data-processing agreement.]

We also disclose personal data where the law requires it, or where we must protect the rights, safety or security of a person or of the service.

[TO CONFIRM: whether any service above is a sub-processor, the data-processing agreement in place for each, and any others (for example error tracking or payments) that a live deployment uses.]

Where your data goes

[TO CONFIRM: whether any of the services in “Who else processes it” store personal data outside the UK or the European Economic Area, and in which countries. The services are global platforms, so a transfer outside the UK/EEA is likely, but this policy does not assert one until it is confirmed.]

[TO CONFIRM: the transfer safeguard relied on for each provider that does process data outside the UK/EEA — for example the UK International Data Transfer Agreement or Addendum, the EU standard contractual clauses, or a UK/EU adequacy decision — and where that safeguard is recorded.]

You can ask for more detail about the safeguard used for a particular service by contacting us.

How long we keep it

Bloopbot deletes data through the paths below, each of which is enforced by the code that stores it:

Everything else in the table under “The personal data we collect” is kept while the channel is linked, because that is the data the features read and edit. Unlinking a channel deletes the channel’s rows, and the rest of the data follows it. Retention windows for the categories below are not enforced by the service today, so instead of stating a period we are asking for legal review:

• Loyalty balances and watch time, giveaway history, quotes and the song queue: [TO CONFIRM: the retention period or age-out rule, or a decision that these are kept for as long as the channel is linked].
• AI usage records: [TO CONFIRM: the retention period for the per-day AI request counters].
• Revoked overlay and widget tokens, and old invite rows: [TO CONFIRM: whether these need a stated retention window].
• Operational logs and any backups: [TO CONFIRM: the hosting provider’s log and backup retention, and what is copied to them].

Cookies and measurement

The public website — the homepage, the guides, these legal pages — sets no cookie of its own and stores nothing in your browser that identifies you.

It does keep two small notes in your browser’s local storage, neither of which identifies you. One remembers your analytics choice, so the notice does not reappear on every page. The other remembers the outcome markers already reported for the current browsing session, so a “channel linked” result is counted once rather than twice. Both stay in your browser and are never sent to us on their own.

The dashboard does use one cookie: a session cookie that keeps you signed in to your own channel. It is strictly necessary for the dashboard to work, it is not used for advertising or measurement, and it is not set on the public pages.

Measurement is off unless the site has been configured to count visits, and even then nothing loads until you accept it:

• The first time you open a page that can be measured — the homepage, the guides, or the “Account linked” page — we show a cookie bar with two equally available choices: Accept all and Reject all. Nothing is sent to Google until Accept all is chosen. These legal pages are not measured at all, so they show no cookie bar.
• If you Reject, or simply carry on reading, no measurement script is loaded, no measurement cookie is set, and nothing about your visit is sent anywhere.
• If you accept, we load Google Analytics 4 and it sets its own cookies to tell one visit from another.
• We honour Global Privacy Control and Do Not Track: if your browser sends either signal, measurement stays off whatever you choose.
• We remove sign-in and channel parameters (such as a link code, a state value or a channel id) before anything is measured, so those values are never reported.
• You can change your mind at any time: press Cookie settings at the bottom of the page, answer again, and measurement starts or stops with the new answer. That button sits on the pages that can be measured. These legal pages carry no measurement and so no button, so change your answer from a measured page — it holds everywhere.

What we count, when you accept, is: page views and the page address, which buttons were pressed (sign-in, opening the dashboard, starting a demo), a yes/no answer to “was this guide helpful?”, and the words you type into the guide search. We do not measure the dashboard, your widgets or your OBS overlays, and we never measure your chat or your channel’s viewer data.

[TO CONFIRM: the exact cookie names and lifetimes set by the measurement tag, and whether we need a cookie banner that offers granular opt-in as well as a single Accept/Reject choice.]

Your rights

If you are in the UK or the EEA you have the right to:

• Access the personal data we hold about you, and get a copy of it.
• Rectify data that is wrong or incomplete.
• Erase your data (the “right to be forgotten”).
• Restrict how we use it while a concern is looked into.
• Port data you gave us to another provider, in a machine-readable form.
• Object to processing based on our legitimate interests, and to any direct marketing.
• Withdraw consent at any time where we relied on consent — accepting or rejecting measurement is the everyday example, and withdrawing it never affects the rest of your account.

To exercise any of these rights, email [TO CONFIRM: a support and privacy contact email address] with enough detail for us to find your data (your Twitch login, and the channel if you are asking about a channel you do not own). If you are a viewer, we may need to involve the streamer of that channel, because the data sits inside their channel.

We answer within one month. If a request is complex we will tell you why and take a further two months. Asking us to use your rights is free, and we will not treat you differently for doing it.

[TO CONFIRM: the internal procedure and identity checks for answering access, objection and erasure requests, and the lawful reasons we may rely on to refuse a request.]

Complaints

If you are unhappy with how we have handled your data, please contact us first so we can put it right.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection, at ico.org.uk or on 0303 123 1113. If you live in the EEA you can complain to your own national regulator instead.

Children

Bloopbot is for people aged 13 or over. We do not knowingly collect data from anyone under 13, and we will delete any account we find that belongs to a child below that age.

Linking a channel needs a Twitch account, and Twitch applies its own minimum age, which is 13. Because viewer data belongs to a streamer’s channel, a streamer must not knowingly use Bloopbot on a channel whose viewers include children below 13.

[TO CONFIRM: whether any feature needs an age assurance step, and the deletion procedure for a discovered under-13 account.]

Security

Tokens, Spotify client secrets and integration credentials are encrypted in the application before they are stored, and the keys that decrypt them are held in the service’s configuration rather than in the database.

The audit log deliberately never records tokens, secrets, overlay token values, CSRF tokens or session identifiers. Tokens can be revoked by unlinking an account, rotating a widget or overlay token, or moving a flow to the Trash, and revoked overlay tokens stop working.

No service can promise perfect security. If we ever become aware of a breach that puts your rights at risk, we will tell the ICO and the people affected without undue delay, as the law requires. If you think you have found a security problem, email [TO CONFIRM: a support and privacy contact email address].

We do not sell your data

We never sell, rent or trade personal data, and we do not share it for advertising. We do not build advertising profiles, and we do not sell data to data brokers.

[TO CONFIRM: whether any future monetisation (for example a paid plan with a payment provider) needs to be disclosed here.]

Changes to this policy

This policy takes effect on 26 September 2026. When we change it, we update that date and list what changed. If a change is material — for example a new category of data or a new service that processes your data — we will tell you in the dashboard before it takes effect.

Older versions are available on request.

How to contact us

For anything in this policy — a question, a request or a complaint — contact:

Our Terms & Conditions at https://bloopbot.com/terms explain the rules for using Bloopbot.