PRIVACY POLICY

The controller of your personal data on the Ghost Empire portal (hereinafter: Portal) is Gh0s77tt — a streamer active on Twitch, Kick and Discord. GDPR contact: via the Discord server discord.gg/deAPJ9Ym2F — a direct message to the admin.

When you sign in via OAuth (Twitch / Discord), the Portal receives:

• ▸Your email address (from your Twitch or Discord account)
• ▸Your nickname (username) and display name
• ▸Your avatar (image URL)
• ▸Your platform ID (Twitch User ID, Discord User ID — unique identifiers)
• ▸OAuth access token and refresh token (to keep the session and refresh data)
• ▸Your channel subscription status (if available via the API)

While you use the Portal we also collect:

• ▸The number of Discord messages and time spent in voice — sent by the Discord bot
• ▸Ghost Tokens transaction history (earned, spent, donations)
• ▸Achievements earned, quests completed, items bought in the shop
• ▸Request IP for administrative actions (audit log, for security purposes)
• ▸Donation data (donor name, amount, optional message) received via Streamlabs / YouTube / PayMedia webhooks
• ▸Shipping & contact details (full name, address, phone, email, parcel locker) — only if you choose to save them to claim a physical reward; stored encrypted and with your explicit consent
• ▸Web-push subscription (if you enable notifications) and passkey credentials (if you register one), to deliver notifications / passwordless sign-in

• ▸Authorization: sign-in and session maintenance (Art. 6(1)(b) GDPR — performance of a contract)
• ▸Ghost Tokens economy: awarding rewards, fulfilling purchases, maintaining the ranking
• ▸Subscriber identification: granting extra features to Twitch/Kick subs
• ▸Security: admin action audit log, rate limiting, abuse detection (Art. 6(1)(f) — legitimate interest)
• ▸Communication: in-portal notifications (e.g. “you won a giveaway”)

• ▸Vercel Inc. (USA) — Portal hosting. Standard Contractual Clauses (SCC)
• ▸Supabase Inc. (Frankfurt, EU) — database. Hosted in eu-central-1
• ▸Twitch Interactive Inc. and Discord Inc. — OAuth providers, for authentication
• ▸Streamlabs, PayMedia, YouTube, Steam — donation / super-chat processing and game-stat lookups
• ▸Stripe Inc. (USA) — payment processing for portal subscriptions (Standard Contractual Clauses), where enabled
• ▸Emote CDNs (7TV / BTTV / FFZ) — rendering chat emotes (images only, no personal data)
• ▸We do not sell or share data with marketers

If you sign in with Google, we request the youtube.readonly scope solely to read your YouTube channel's public handle and title at sign-in, so we can show your channel identity on your profile and in the ranking. We do not store your YouTube content, nor share or use this data for any other purpose. Ghost Empire's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• ▸User account: until deletion (at your request)
• ▸OAuth tokens: rotated automatically, old ones deleted
• ▸Sessions: 30 days from the last sign-in
• ▸Admin action audit log: indefinitely (for security and forensics)
• ▸Notifications: deleted after 90 days
• ▸Shipping details: kept until the reward is fulfilled, then deleted — and you can delete them yourself anytime in your profile

• ▸Right of access — you can request a copy of your data
• ▸Right to rectification — we correct inaccurate data
• ▸Right to erasure (right to be forgotten) — we delete the account and all related data
• ▸Right to restriction of processing
• ▸Right to data portability — export in JSON format
• ▸Right to lodge a complaint with the President of the UODO (https://uodo.gov.pl)

To exercise any right — message the admin of the Ghost Empire Discord server. We'll respond within 30 days.

We use:

• ▸HTTPS (TLS 1.3) on all traffic
• ▸HSTS preload (force-https for 2 years)
• ▸Content Security Policy, X-Frame-Options, Permissions-Policy headers
• ▸Rate limiting on public endpoints
• ▸Atomic database transactions for economy operations
• ▸Audit log with IP for all administrative actions
• ▸OAuth passwords are NOT stored — we only use tokens
• ▸Sensitive data (OAuth tokens, shipping details) is encrypted at rest (AES-256-GCM)

The Portal uses only technical cookies (the NextAuth session) — essential for it to function. We do not use tracking / marketing / analytics cookies.

We publish changes on this page. Major changes are announced on Discord. Using the Portal after changes take effect means accepting them.