Privacy Policy - Elo Aux Battles

1. Who We Are

Elo Aux Battles ("we", "us", "our") is an online platform that lets Twitch streamers host music battle sessions with their communities. This privacy policy explains what personal data we collect, how we use it, and your rights under the General Data Protection Regulation (GDPR).

For any privacy-related questions or requests, contact us at: studioboclips@gmail.com

2. What Data We Collect

We collect the following data when you use Elo Aux Battles:

Twitch username and display name — obtained via Twitch OAuth login.
Twitch user ID — used to uniquely identify your account.
Twitch access and refresh tokens — used to authenticate API actions on your behalf (polls, chat) for league owners. Stored securely in our database.
Song submissions — YouTube links and video titles you submit during sessions.
Session and ELO history — your scores, rankings, and ELO progression across sessions and seasons.
Session cookies — an encrypted cookie is stored in your browser to maintain your login state. It contains no personal information beyond your Twitch session data listed above.

            We do not collect your email address, real name, location, payment information,
            or any data beyond what is listed above.
        

3. How We Use Your Data

Your data is used exclusively to operate the platform:

To authenticate you via Twitch and maintain your session.
To display your username in session queues, leaderboards, and battle history.
To calculate and store your ELO ratings across sessions and seasons.
To enable league owners to manage polls and chat interactions on Twitch on your behalf (league owners only).
To enforce moderation actions (bans, timeouts) within a league.

4. Legal Basis for Processing (GDPR)

Under the GDPR, we process your data on the following legal bases:

Contractual necessity — processing your Twitch identity and session data is necessary to provide the service you signed up for.
Legitimate interests — maintaining ELO history and leaderboards constitutes a legitimate interest in providing a functional, competitive platform.
Consent — by logging in with Twitch and using the platform, you consent to the data practices described in this policy. You may withdraw consent at any time by requesting deletion of your data.

5. Data Sharing

We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes. Your data is only shared in the following limited circumstances:

Twitch — we use Twitch's OAuth API to authenticate users and manage polls. Twitch's own Privacy Notice applies to any data handled by their platform.
YouTube — submitted song links are resolved via YouTube to retrieve video titles. No personal data is sent to YouTube beyond the video URL.
Infrastructure — we use third-party hosting and database services to run the platform. These providers process data only as instructed by us and are bound by data processing agreements.

Elo Aux Battles is ad-free. No advertising networks have access to your data.

6. Data Retention

We retain your data for as long as your account is active or as needed to operate the platform. Specifically:

Session cookies expire when you log out or close your browser session.
Twitch tokens are refreshed automatically and updated in place — old tokens are overwritten, not accumulated.
ELO history and battle records are retained indefinitely to maintain leaderboard continuity, unless you request deletion.

7. Your Rights Under GDPR

As a user based in or interacting from the EU, you have the following rights:

Right of access — you can request a copy of the personal data we hold about you.
Right to rectification — you can request correction of inaccurate data.
Right to erasure — you can request deletion of your personal data ("right to be forgotten").
Right to restriction — you can request that we limit how we process your data.
Right to data portability — you can request your data in a structured, machine-readable format.
Right to object — you can object to processing based on legitimate interests.

To exercise any of these rights, contact us at studioboclips@gmail.com. We will respond within 30 days.

8. Cookies

We use a single encrypted session cookie to keep you logged in. This cookie:

Is set only when you log in with Twitch.
Contains your Twitch session data in encrypted form.
Is marked HttpOnly and SameSite=Lax to protect against cross-site attacks.
Is marked Secure in production (HTTPS only).
Is cleared when you log out.

We do not use tracking cookies, analytics cookies, or third-party advertising cookies.

9. Security

We take reasonable technical measures to protect your data, including encrypted session storage, HTTPS in production, and secure token handling. However, no system is completely immune to security risks. If you believe your data has been compromised, please contact us immediately at studioboclips@gmail.com.

10. Children's Privacy

Elo Aux Battles is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this privacy policy from time to time. When we do, the "last updated" date at the top of this page will be revised. Continued use of the platform after changes are posted constitutes acceptance of the updated policy.

12. Contact

For any questions, data requests, or concerns regarding this privacy policy:

📧 studioboclips@gmail.com