Privacy Policy

This Privacy Policy explains how we process personal data when you use this website and, when you use Custom Bots accounts, managed bots, connected services and tournament registrations.

Personal data means any information relating to an identified or identifiable natural person. This can include, for example, usernames, Discord names, availability information and technical access data such as IP addresses.

1. Controller

The controller responsible for data processing on this website is:

Theodor König
c/o Online-Impressum #8369
Europaring 90
53757 St Augustin
Germany

Email: [email protected]

2. General use of the website

When you visit this website, technical data may be processed automatically by the server. This may include:

• IP address
• Date and time of access
• Requested URL or file
• Browser type and version
• Operating system
• Referrer URL, if transmitted by your browser

This data is processed to provide the website, ensure technical stability, detect errors and protect the website against misuse or attacks.

The legal basis for this processing is our legitimate interest in operating a secure and stable website according to Article 6(1)(f) GDPR.

Server log files are stored only for as long as necessary for the purposes described above and are then deleted or anonymised, unless longer storage is required for security reasons or legal obligations.

3. Accounts, invitations and connected bot services

For Custom Bots accounts we process your account identifier, username, email address, password hash, invitation status and access permissions. When you connect Twitch or Spotify, we also process the service account identifiers, the permissions you grant and the credentials needed to operate the connected features. Bot credentials are stored encrypted. Credentials, passwords and authorisation codes are excluded from our application event logs and usage statistics.

We use these data to provide the account and bot features you request, including chat commands, timers, song requests and account connections. The legal basis is Article 6(1)(b) GDPR where processing is necessary to provide those services. Connecting an external service involves communicating with Twitch or Spotify; those providers also process data under their own privacy policies.

4. Application events and usage statistics

We record important application events, such as invitation acceptance, successful sign-ins, account connections and disconnections, changes to bot settings or permissions, and technical failures. These records can identify the Custom Bots user responsible for or affected by an action. Access to the central event view is restricted to administrators using their own accounts.

We also maintain usage counters and daily aggregates associated with your Custom Bots account and bot connections. These include executed commands, accepted and rejected song requests, requests recognised as playing, sampled bot connected time, response losses and activity by day, week and month. The bot owner's account is used for these statistics; they do not create individual usage profiles for chat viewers. Chat message contents and song search inputs are not included in these statistics or diagnostic logs. Data needed to perform song requests or other features is processed separately from these counters.

The purposes are troubleshooting, secure operation, understanding feature usage and maintaining account usage histories for users. The legal basis for these limited operational and usage measurements is Article 6(1)(f) GDPR, based on our legitimate interests in operating and improving Custom Bots and providing useful usage histories. You can contact us to request access to your statistics or to exercise your right to object; the user-facing statistics view is not yet available.

Central technical diagnostic events are retained for up to 30 days, administrative and user action events for up to 180 days, and detailed command diagnostics for up to 24 hours. Detailed diagnostics can be enabled by an administrator for a specific bot for a maximum of 60 minutes at a time. Buffered events awaiting delivery and deduplication receipts have a bounded retention period of seven and eight days respectively. Cleanup is performed during regular manager polling; if the manager is unavailable, physical cleanup resumes when it returns. Separate hosting and process logs are governed by the respective operational retention and deletion procedures.

Personal usage totals and daily aggregates have no fixed expiry while your Custom Bots account exists and these purposes continue to apply. Deleting an individual bot does not reset your account's usage history. Upon deletion of your Custom Bots account, its personal statistics and associated event records are removed. Independently maintained platform totals and grouped activity counts contain no account or bot identifiers and are retained for platform reporting. They are not obtained by assigning your individual records to another user.

5. Tournament registration

If you register for a tournament through Custom Bots, we process the information you provide in the registration form.

Depending on the tournament setup, this may include:

• Your player name or username
• Your Discord name or other community identifier, if requested
• Your team name or team affiliation, if applicable
• Information about whether you can play specific roles, such as Killer
• Your availability for tournament scheduling
• The date and time of your registration
• Technical information required to prevent misuse or duplicate submissions

We use this data only to organise, manage and run the tournament. This includes checking registrations, planning matches, assigning teams or roles, coordinating schedules and contacting participants within the tournament context where necessary.

The legal basis for this processing is Article 6(1)(b) GDPR, insofar as the processing is necessary for your participation in the tournament. Where we process data to protect the registration process against misuse or duplicate entries, the legal basis is Article 6(1)(f) GDPR.

6. Prevention of duplicate or abusive registrations

To protect the tournament registration process, we may use technical measures to detect duplicate or abusive submissions. This may include temporary rate limiting, registration tokens, browser-based indicators or pseudonymised technical identifiers.

If IP addresses are used for this purpose, we aim to avoid storing them in plain text wherever possible. Instead, we may store a pseudonymised representation, such as a cryptographic hash, in order to detect repeated submissions without directly storing the original IP address in the tournament registration record.

These measures are not used for automated final decisions about tournament participation. In cases where a duplicate registration is suspected, the tournament organisers may review the case manually.

7. Cookies and local storage

This website may use technically necessary cookies or local storage entries to provide core functionality, such as remembering that a registration has already been submitted from the same browser or enabling access to an edit link.

We do not use these technologies for advertising or cross-site tracking.

8. Recipients of personal data

Personal data may be accessible to the tournament organisers and administrators of Custom Bots where this is necessary to organise and run the tournament.

In addition, technical service providers, especially hosting providers, may process data on our behalf in order to operate the website.

We do not sell personal data and do not share it with third parties for advertising purposes.

9. Storage period

Tournament registration data is stored only for as long as it is needed to organise and complete the tournament. Unless a longer retention period is necessary in an individual case, registration data will be deleted or anonymised after the tournament has ended and follow-up organisational tasks have been completed.

Technical data used for abuse prevention, such as pseudonymised IP-based identifiers, is stored only for as long as necessary to protect the registration process and is then deleted.

10. Your rights

Under the GDPR, you have the following rights, subject to the legal requirements:

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure of your data
• Right to restriction of processing
• Right to data portability
• Right to object to processing based on legitimate interests
• Right to withdraw consent, where processing is based on consent

To exercise your rights, you can contact us using the contact details provided above.

11. Right to lodge a complaint

You also have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.

12. Changes to this Privacy Policy

We may update this Privacy Policy when the website, tournament functionality or legal requirements change. The current version is always available on this page.

Last updated: May 2026