EpyxChat
Privacy Policy
Last updated: 9 October 2026 · See also: Terms of Service
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Kevin Wendel
c/o NORDINITY #63330
Norderkamp 1
24803 Erfde
Deutschland
[email protected]
Questions and requests about your data: [email protected]
2. In short
EpyxChat only processes the data it needs to run the Service. There is no advertising, no tracking or analytics, no profiling, and we do not sell data. Chat messages that pass through an overlay are not saved in a database.
3. Visiting the website and overlays
When you open a page or an overlay, your browser or OBS sends technical data to the server: IP address, date and time, the requested address, browser and device information (User-Agent) and the referring page. This is necessary to deliver the page and to keep it secure (Art. 6(1)(f) GDPR, legitimate interest in a working and secure Service).
The application itself does not write access logs. The web server or reverse proxy in front of it may keep log files with this data for a limited time for security and error analysis. IP addresses are also held briefly in the memory of the application to limit login, sign-up and password reset attempts; they are not saved in the database.
Fonts: all fonts of the pages, the editor and the overlays are stored on this server and delivered by it. Neither the pages nor the overlays load fonts from Google or from any other third party.
Images: overlays and the editor preview load emotes, badges and avatars directly from the servers of the platforms and emote services (for example Twitch, Kick, YouTube, TikTok, 7TV, BetterTTV and FrankerFaceZ). These servers receive the IP address of the device that shows the overlay. When an overlay runs in OBS, that is the streamer's computer; people who watch a stream do not load anything from us or from these services.
4. Account data
When you sign up we store your user name, your display name, a password hash (the password itself is never stored; it is hashed with the salted scrypt method), your chosen language, the time of sign-up and of your last login, your e-mail address and whether you confirmed it. We use this data to provide your account (Art. 6(1)(b) GDPR).
The e-mail address is required when you sign up and has to be confirmed with a link. An address that Twitch passes on when you sign in with Twitch counts as confirmed, because Twitch only passes on addresses it has verified. We use the address to send the confirmation link, password reset links and similar messages about your account, and to recognise an account that you already have, so that you do not end up with two (see "Linked platform accounts"). We never use it for advertising. The messages are sent through the mail server configured for this Service.
For every login we keep a session: a random identifier (stored only as a hash), the time of creation and of last use, the expiry time and the first 200 characters of your browser's User-Agent. It exists so that you stay signed in, and it is deleted when you log out, when it expires, or when you delete your account.
6. Linked platform accounts
When you link a platform account, or sign in or sign up with a Twitch or Kick account, you are sent to the platform and sign in there; we never see your password for that platform. The platform then tells us the data listed below. We use it to prove that you own the channel, to sign you in, to show your linked accounts and to let you pick them in the editor (Art. 6(1)(b) GDPR). You start every linking and every sign-in yourself.
- Twitch: user ID, login name, display name and profile picture. To link the account we ask for the permissions "channel:read:redemptions" and "moderator:read:followers" so that the overlay can show channel point redemptions and new followers of your channel. For this, the access and refresh tokens are stored encrypted (AES-256-GCM) in our database until you unlink the account. When you unlink, we revoke the token at Twitch. To sign in or sign up with Twitch we only ask for the permission "user:read:email" and also receive your verified e-mail address; that token is used once and not stored.
- Kick: user ID, user name and profile picture, and the e-mail address of the account if Kick passes one on (permissions "user:read" and "channel:read"). The access token is used once and not stored. A new account made from your Kick account keeps that address, but you have to confirm it like any other, and we never use it to join your Kick account to an account that already exists, because we cannot tell whether Kick verified it.
- YouTube / Google: permission "youtube.readonly" (read-only) together with "openid" and "profile". We read the YouTube channel of the Google account: channel ID, handle, title and thumbnail. We do not access videos, playlists, subscriptions, comments, your e-mail address or other Google data, and we do not store the access token.
- TikTok (Login Kit): permissions "user.info.basic" and "user.info.profile". We read your TikTok open ID, display name, profile picture and user name. The access token is used once and not stored.
The use and transfer to any other app of information received from Google APIs by EpyxChat will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data from Google APIs is used only to verify and show your linked YouTube channel. It is not used for advertising, not sold, not passed on to third parties, not used to develop or train AI or machine learning models, and not read by people except where this is needed for security or required by law.
A platform account belongs to exactly one account. If you sign in with a Twitch account whose verified e-mail address is the confirmed address of an account that already exists, the Twitch account is added to that account instead of creating a second one. If two accounts of yours exist anyway, you can merge them: after you proved the platform account of the other account by signing in at the platform, and after you confirmed on the account page, the chats and platform accounts of the other account move to the account you are signed in to, and the other account with its sessions is deleted. While you decide, the proof is kept encrypted for at most 10 minutes. The last way to sign in to an account cannot be removed.
You can unlink any platform account on the account page and withdraw the permission at the platform, for example in your Twitch connections or your Google account permissions, and in the settings of your Kick and TikTok accounts. Also see the Google Privacy Policy.
Where linking is not offered for a platform you type in the channel name yourself, and no data is read from your platform account.
7. Chats and settings
We store what you enter in the chat editor: title, channel names for each platform, design options, event settings and the random code in the overlay link. This stays until you delete the chat or your account (Art. 6(1)(b) GDPR). Channel names are normally public.
8. Chat messages and events in overlays
While an overlay is open, our server connects to the chats of the channels in its settings and passes messages and events (message text, user names and colors, badges, emotes, profile pictures, and amounts such as bits or gifts) on to the overlay in real time. This content is already public on the platforms.
Messages are not saved in the database. For the function that shows recent messages when an overlay starts, the server keeps up to 200 messages in its memory only. Messages older than 15 minutes are not shown again, and everything is discarded when the overlay has been closed for a short time or the server restarts.
Legal basis: Art. 6(1)(b) GDPR towards the streamer who uses the Service, and Art. 6(1)(f) GDPR (our interest and the streamer's interest in showing the public chat on the stream) towards the people whose public messages are passed on. The streamer shows the overlay on their stream and is responsible for it.
9. Recipients and third-party services
Depending on the platforms you use, our server communicates with the following services. They receive technical connection data, such as the IP address of our server, and the name or ID of the channel that is requested:
- Twitch: chat, events and profile data.
- Kick, including its real-time service Pusher: chat and events. When Kick's official API is used, Kick sends events to our address /webhooks/kick.
- YouTube (Google): the public live chat of the channel.
- TikTok, and Euler Stream (eulerstream.com), a signing service that the connection to TikTok LIVE needs. It receives the TikTok user name of the channel and technical request data.
- 7TV, BetterTTV and FrankerFaceZ: we look up the custom emotes of a channel by its name or ID.
- Hosting and e-mail: the server and the mail system on which the Service runs.
Some of these providers are located outside the EU/EEA, in particular in the USA. They process data under their own privacy policies; transfers rely on the mechanisms they use, for example adequacy decisions or standard contractual clauses. Apart from this, we do not pass your data to third parties unless the law requires it.
10. Retention
- Account, linked platform accounts and chats: until you delete them or your account.
- Sessions: until you log out, until they expire (30 days after the last use), or until you delete your account.
- Confirmation and password reset links: valid for 24 hours and 1 hour. The used or expired record is removed a day after it expires.
- Records of a running sign-in, linking or merge: at most 10 minutes.
- Public platform data that is cached to save requests, for example the Kick chat room ID of a channel: up to 30 days.
- Chat messages: only in memory, as described above.
- The latest lines of the server log: only in memory, at most 2000 lines, until the application restarts.
11. Your rights
You have the right to access, rectification, erasure, restriction of processing and data portability, and the right to object to processing that is based on legitimate interests (Art. 15 to 21 GDPR). If processing is based on your consent, you can withdraw it at any time with effect for the future.
You can do much of this yourself: change your profile and password, unlink platform accounts and delete your account on the account page. For everything else write to us: [email protected]
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work or where the alleged violation took place.
There is no automated decision-making, including profiling.
12. Security
The Service is meant to be used over HTTPS. Passwords are stored only as salted hashes, session identifiers and e-mail link tokens only as hashes, and Twitch tokens are encrypted. No system is perfectly secure, so please use a password that you use nowhere else.
Only the operator can open an internal admin area. It is only for reading and shows accounts (user name, display name, e-mail address and whether it is confirmed, linked platform accounts, sign-up and last login, open sessions with their browser description), chats (title, channels, settings) and the server log. It never shows passwords, tokens or the full overlay links. We use it to run the Service, to find and fix errors, to answer support requests and to prevent abuse (Art. 6(1)(f) GDPR). The latest lines of the server log, which can name channels and contain error messages, are kept for this in the memory of the application only (at most 2000 lines, gone when the application restarts).
13. Children
The Service is not directed at children under 16, and we do not knowingly collect their data. If you think a child has signed up, please contact us and we will delete the account.
14. Changes to this policy
We update this policy when the Service or the law changes. The current version is always at https://chat.epyx.cc/privacy; the date of the last change is at the top.