1. Who we are
Strimba is a service of Paceworks B.V., Drienerstraat 77, 7551 HL Hengelo, the Netherlands (Dutch Chamber of Commerce no. 42109694). Paceworks B.V. is the controller of the personal data described in this policy within the meaning of the General Data Protection Regulation (GDPR). You can reach us at support@strimba.com.
2. In short
- We only process what Strimba needs to work: your account, the channels you connect and what happens in their chats.
- Chat messages are kept for 24 hours, stream events for 7 days.
- We do not sell personal data, do not show ads and do not use analytics or tracking cookies.
- We do not share data from YouTube, Twitch, Kick or TikTok with third parties.
- Passwords are stored only as a salted scrypt hash; platform tokens are stored encrypted.
- You can disconnect any platform at any time and ask us to delete your account.
3. What we process and why
Your account
- E-mail address, display name and avatar (the picture URL from the platform you signed in with), whether your e-mail address is verified, your role and the address of your dashboard. We need these to give you an account, show who you are to your team and send account e-mails such as address verification and password reset. Legal basis: performance of our agreement with you (Art. 6(1)(b) GDPR).
- Password. If you sign up with an e-mail address, we store your password only as a salted scrypt hash. We never store or log the password itself. When you choose a password, we check it against known data breaches with the Have I Been Pwned Pwned Passwords service using its k-anonymity model: only the first 5 characters of the password's SHA-1 hash leave our server, never the password or the full hash. Legal basis: our legitimate interest in keeping accounts secure (Art. 6(1)(f)).
- Linked logins. When you sign in with or connect Twitch, Google or Kick, we store your Twitch user ID, Google account ID or Kick user ID, the login name, e-mail address and avatar that platform gives us, the permissions you granted, and the access and refresh tokens, encrypted. Strimba uses the tokens only for the features described in this policy. Legal basis: performance of our agreement.
- Two-factor sign-in (if you turn it on): your authenticator secret (encrypted), your recovery codes (hashed) and, if you tick “remember this device”, a hashed device token with the browser and operating system name and when it was last used.
Your channels, team and settings
- Connected channels: per platform the channel ID, login, display name and avatar (for TikTok only the username you enter).
- Your team: who you added or invited (by e-mail address or Twitch login), which roles and permissions they have and who added them. If you turn on the Twitch moderator sync, we read your Twitch moderator list to keep the team in step.
- Settings you create: OBS shortcuts and chat commands with their replies, activity feed, receipt, light and credits settings, bitrate triggers, and connections to donation services (StreamElements, Streamlabs, Tipeee Stream), whose tokens we store encrypted.
Legal basis: performance of our agreement with you.
The Strimba agent
- Devices: the name of each paired PC, the agent version, which features it supports, when it was last online, and a hashed device token.
- Command log (audit trail): every command sent to an agent, with who sent it, to which PC, the command and its settings, the result and the time. It lets you and your team see what happened and helps us investigate abuse and errors.
- Activity log: who on your team did what in the dashboard (for example changed a shortcut or invited someone), and what the agent reports back (for example a chat command that ran).
Legal basis: performance of our agreement, and our and your legitimate interest in an audit trail of who controlled your stream (Art. 6(1)(f)).
Chat and stream events
- Chat messages in the channels you connected, for the combined chat: the platform's message ID, the author's ID, name, avatar, name colour and badges, the text, emotes and the time. Chat lines that start with a command are passed to your agent so it can run your shortcuts.
- Stream events for the activity overview: follows, subscriptions and gifted subscriptions, cheers, raids, Super Chats, Super Stickers, memberships and donations, with the name of the viewer, the amount and their message.
- Chat replies: when a viewer uses a chat command you gave a reply, Strimba posts that reply as your channel in the chat it came from (Twitch, YouTube or Kick).
Legal basis: performance of our agreement with you, the streamer. See also section 4.
Technical data
- IP address. We use your IP address to limit how often sign-in, registration, password reset, two-factor and pairing attempts can be made (rate limiting). These counters exist only in memory for 15 minutes and are not written to our database. Your IP address is also sent to Cloudflare Turnstile (below). Like any web server, our servers may briefly keep technical logs. Legal basis: our legitimate interest in protecting the service against abuse.
- Cloudflare Turnstile. The sign-in, registration and password-reset forms are protected by Cloudflare Turnstile, a privacy-focused alternative to CAPTCHAs. Turnstile evaluates signals from your browser and your IP address to tell people from bots; it does not show ads. See the Cloudflare privacy policy. Legal basis: our legitimate interest in preventing automated abuse.
- YouTube API usage: how many YouTube API calls and quota units Strimba used per streamer per day. See section 5.
The public website strimba.com does not use cookies, analytics or any third-party scripts or fonts.
4. Viewers in a streamer's chat
If you chat in the stream of a streamer who uses Strimba, Strimba processes your public chat messages, your public name, avatar and badges, and public stream events such as your Super Chat or subscription, so the streamer and their moderators can see them in one place and the streamer's chat commands can respond. We do this on the basis of the legitimate interest of the streamer and of Strimba in running the stream (Art. 6(1)(f)). Your messages are deleted after 24 hours and stream events after 7 days. When a platform's moderators delete a message or ban or time out a viewer, Strimba removes those messages too. You can exercise your rights (section 11) by mailing support@strimba.com.
5. YouTube data
Strimba uses the YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service. Google processes your data under the Google Privacy Policy (https://policies.google.com/privacy).
Permission we ask for
When you connect your YouTube channel, Strimba asks Google for the permission https://www.googleapis.com/auth/youtube.force-ssl (“See, edit, and permanently delete your YouTube videos, ratings, comments and captions”). Google offers no narrower permission that allows posting in a live chat. Strimba uses it only to read your channel and live chat and to post the chat-command replies you set up; it never touches your videos, ratings, comments or captions. Channels connected earlier may have the read-only permission youtube.readonly; those can read chat but not post replies.
What YouTube data we access and store
- Your channel: channel ID, channel name and channel picture, so Strimba knows which channel to read and can show it in your account.
- Your live broadcast: whether your channel is live and the ID of its live chat.
- Live chat messages in your own live stream: the text and time, and the author's channel ID, name, picture and badges (owner, moderator, member).
- Super Chats, Super Stickers and memberships (new members, milestones and gifted memberships) in your live chat, with the viewer's name, amount and message, including Super Chats and Super Stickers from before Strimba started reading the chat, up to 7 days back.
- Moderation events in your live chat (deleted messages, banned or timed-out users), only to remove those messages from your combined chat.
- Messages Strimba posts: the replies to chat commands that you configured, sent as your channel.
- API usage per streamer: how many YouTube API calls and quota units were used on your behalf per day and per type of call, so we can keep Strimba within YouTube's daily quota for everyone.
- Your Google tokens: the access and refresh token Google issues, stored encrypted.
How we use it
Only to provide Strimba's features to you: showing your live chat in your combined chat, showing Super Chats, Super Stickers and memberships in your activity overview, passing chat commands and stream events to your own Strimba agent so it can run your OBS shortcuts and alerts, and posting the replies you set up. Data is shown only to you and to the team members you give access. We do not use YouTube data for advertising, profiling or training AI models, we do not sell it, and people at Strimba do not read it except when you ask us for support, for security reasons or when the law requires it.
How long we keep it
- Live chat messages: 24 hours, then deleted automatically.
- Super Chats, Super Stickers, memberships and other stream events: 7 days, then deleted automatically.
- API usage counts: 30 days, then deleted automatically.
- Channel ID, name and picture and your Google tokens: as long as the YouTube channel is connected to your Strimba account; deleted when you remove the channel or disconnect Google, or when your account is deleted.
Sharing
We do not share YouTube data with any third party. It is stored on our own servers (section 8) and sent only to your own browser, the browsers of team members you gave access, and the Strimba agent on your own PC.
Cookies and your device
Strimba does not place or read cookies on your device for YouTube or Google purposes. The only cookies are the sign-in cookies described in section 6.
How to revoke access
- In Strimba, open your account page. Removing your YouTube channel makes Strimba stop reading it and deletes the channel and its stored chat straight away. Disconnecting your Google login deletes your Google tokens straight away (this is possible as long as you have another way to sign in, such as a password or another platform).
- You can also revoke Strimba's access at any time in your Google account at https://myaccount.google.com/permissions. After that, Strimba can no longer access your YouTube data.
Chat messages and events that were already stored are deleted on the schedule above. If you want them deleted sooner, mail support@strimba.com and we will delete them within 7 days.
Limited Use. Strimba's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Cookies
The dashboard at app.strimba.com only uses cookies that are strictly necessary:
- Session cookie: keeps you signed in. It is HTTP-only and secure, and expires 30 days after your last visit or when you sign out.
- Sign-in cookies: short-lived cookies that protect the sign-in with Twitch, Google or Kick against forgery (CSRF and state cookies) and remember where to send you back.
- Trusted-device cookie: only if you tick “remember this device” at two-factor sign-in. It stops working after 30 days without use.
We do not use analytics, advertising or tracking cookies. Because these cookies are necessary for the service, no consent is required. The public site strimba.com sets no cookies at all.
7. Services we use
We use a small number of providers, each only for what is described here:
- TransIP (the Netherlands): hosting of our servers and database.
- Cloudflare: Turnstile bot protection on the sign-in forms.
- Have I Been Pwned: the k-anonymity password check (only a 5-character hash prefix, no personal data).
- An e-mail provider to deliver account e-mails (verification, password reset, invites).
Strimba also exchanges data with the platforms you connect, at your request: Twitch, Google/YouTube, Kick, TikTok, StreamElements, Streamlabs and Tipeee Stream. Those platforms are independent controllers under their own privacy policies. The TikTok chat is read by the Strimba agent on your own PC from TikTok's public LIVE page.
We do not sell personal data and do not share it with advertisers or data brokers.
8. Where your data is
Our servers and database are in the Netherlands. Where a provider above processes data outside the European Economic Area (such as Cloudflare), this happens under the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.
9. How long we keep it
| Data | Kept for |
|---|---|
| Chat messages (all platforms) | 24 hours |
| Stream events (activity overview) | 7 days |
| YouTube API usage counts | 30 days |
| Rate-limit counters with IP address | 15 minutes, in memory only |
| E-mail verification and password-reset links | Until used or expired |
| Agent pairing codes | Until used or expired |
| Trusted-device tokens (two-factor) | Until 30 days without use, or until you remove them |
| Linked logins and platform tokens | Until you disconnect the platform or your account is deleted |
| Account, channels, team, settings, devices, command log and activity log | As long as your account exists |
When you ask us to delete your account, we delete it and everything linked to it (channels, chat, events, settings, devices, logs and tokens) within 30 days. Records we are legally required to keep are kept only as long as the law requires.
10. Security
- All traffic to Strimba is encrypted with TLS (HTTPS only).
- Passwords are hashed with scrypt; platform tokens and two-factor secrets are encrypted at rest.
- The Strimba agent only carries out commands that are digitally signed by Strimba, and each PC has its own token that you can revoke at any time.
- You can turn on two-factor sign-in, and streamers can require it for team roles.
- Within your team, everyone gets only the permissions their role allows.
11. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have incorrect data corrected;
- have your data deleted;
- restrict how we process your data;
- receive your data in a structured, machine-readable format (data portability);
- object to processing based on our legitimate interests;
- withdraw consent you gave, at any time (for example by disconnecting a platform).
You can change most of your data yourself on your account page. For anything else, including deleting your account, mail support@strimba.com. We answer within one month. We may ask you to confirm your identity first.
You also have the right to lodge a complaint with the Dutch Data Protection Authority, Autoriteit Persoonsgegevens, or the supervisory authority where you live. We would appreciate the chance to help you first.
12. Children
Strimba is not intended for anyone under 16. We do not knowingly create accounts for children under 16. If you believe a child has given us personal data, mail support@strimba.com and we will delete it.
13. Changes
We update this policy when Strimba changes. The date at the top shows the latest version. If a change matters for how we use your data, we will tell you in the dashboard or by e-mail before it takes effect.
14. Contact
Paceworks B.V., Drienerstraat 77, 7551 HL Hengelo, the Netherlands (Dutch Chamber of Commerce no. 42109694)
E-mail: support@strimba.com
See also our Terms of Service.