Privacy notice for ChatPicker

1. Controller and contact

Prime Codes GmbH
Pappelallee 78/79
10437 Berlin
Germany

Managing director: Devin Grützmacher
Email: ceo@primecodes.de
Phone: +49 1579 2495914

For privacy questions or to exercise your rights, contact the email address above. This notice concerns ChatPicker. Processing by Twitch and by individual streamers is also covered by their own privacy notices.

2. Website access and hosting

Prime Codes GmbH operates ChatPicker on servers in Germany. Access transmits technically necessary connection data, such as IP address, time, requested address and browser information, to the servers for delivery, troubleshooting and prevention of misuse. The basis is Article 6(1)(f) GDPR: our interest in secure, reliable operation. Article 6(1)(b) GDPR also applies to necessary functions of a requested user account.

Retention of technical logs and backups is determined by troubleshooting, investigation of specific security incidents and service recoverability. Contact us for information on storage of your data. Optional usage analytics stores no IP addresses, full requested URLs or user-agent details; its random visitor identifier is described in section 6.

3. Signing in with Twitch

Sign-in takes place on Twitch using OAuth. ChatPicker receives in particular your Twitch user ID, display name, profile-image address and access tokens, but not your Twitch password. Permission to read your channel’s chat messages is requested to collect giveaway participants and messages. Article 6(1)(b) GDPR covers provision of the requested service; protection of the sign-in process is based on Article 6(1)(f) GDPR.

OAuth tokens and session keys are held in server memory, not the application database. Sign-in is valid for up to eight hours. Logout and server restarts end the session. You can also revoke the connection in Twitch’s connection settings. Logging out alone does not delete saved giveaway settings.

4. Giveaways, chat messages and stream overlay

While chat is connected, ChatPicker processes publicly visible messages and their associated Twitch user IDs and names from the relevant streamer’s Twitch chat. Posting the keyword adds a viewer once to the draw pool. Stored data includes user ID, name, profile-image address and entry time. Excluded users are stored by user ID to prevent re-entry.

Processing serves the requested participation and giveaway. Where necessary to perform the participation relationship, the basis is Article 6(1)(b) GDPR; operation, prevention of duplicate entries and technical administration rely on Article 6(1)(f) GDPR. The hosting streamer is responsible for entry rules, prizes, their own broadcast publication and the necessary information to viewers.

Up to ten recently received messages per viewer are buffered in memory, limited to 10,000 viewers per channel. No older Twitch chat archive is retrieved. The winner view can show the winner’s three latest available messages, name, profile picture and winning probability. These are visible to holders of the overlay link and, when broadcast, stream viewers. Recording, republication and storage of the stream are outside ChatPicker’s control.

Resetting or changing the keyword clears the current pool. Winner history, including user ID, name, profile-image address, draw time, title, keyword and winning probability where available, is stored separately. Exclusion lists and channel settings are also retained. There is currently no automatic deletion period for these data. They document past channel giveaways and support future ones. Contact us to request deletion; its conditions and statutory exceptions are assessed individually. Message buffers are removed on server restart and continuously displaced by newer messages or viewers.

We also store participant roles identified from Twitch chat badges (subscriber, VIP, moderator). These are updated on further received chat messages and used for eligibility filters and the chance multipliers set by the streamer. The win-once option stores winner IDs within the current pool.

In the optional feedback area, we publish your posts with your Twitch display name, profile picture and date. Posts, status tags and total scores are public, including in the archive. Your Twitch user ID and individual vote are stored internally to allow one vote per account; individual votes are not shown to other users. Posts and votes remain stored until deleted. Please use the contact above for deletion requests. For internal moderation measures, we store the affected Twitch user ID, display name, profile picture and time. These details are visible only to the operator and are removed when the measure is lifted. Deleting feedback removes it from public view. Its content, author association, votes and deletion time remain stored in an operator-only area for internal review, including posts deleted by their author. Complete deletion of stored data can be requested using the contact above.

5. Cookies and browser storage

picker_flow: necessary cookie securing Twitch sign-in; up to ten minutes.

picker_session: necessary login-session cookie; up to eight hours or until logout.

picker-language: explicitly selected language stored locally until browser storage is cleared.

picker-privacy-v1: the optional analytics choice is respected until a new choice is requested, at the latest after 180 days. Change it at any time in “Privacy settings”.

picker-visit: random identifier in browser session storage, only after analytics consent; removed on withdrawal and normally discarded when the browser session ends.

Strictly necessary storage access for requested features and remembering your privacy choice is based on section 25(2), point 2 TDDDG. Optional analytics storage relies on consent under section 25(1) TDDDG and Article 6(1)(a) GDPR. Sign-in and giveaway functions remain available without consent.

6. Optional usage analytics and operational counters

With consent, the visible website regularly sends activity reports containing a random browser-session identifier, day, page view and, for signed-in visitors, Twitch account ID. These produce online counts and usage statistics available only to operator administration. No advertising profiles or third-party analytics services are used.

“Online” covers reports from the last two minutes. Daily analytics records are stored in our database without automatic timed deletion. Withdrawal through “Privacy settings” stops further reports and initiates deletion of records for the visitor identifier still available in the current browser. Contact us regarding other browsers or earlier sessions. Withdrawal does not affect the lawfulness of prior processing.

Independently of optional visitor analytics, successful logins, draw starts, resets and accepted entries are counted as daily totals without user or visitor identifiers in the counters themselves. Active OBS connections are temporarily recorded per channel for operational monitoring. Operation and functionality checks rely on Article 6(1)(f) GDPR; personal website-visit detail statistics require the consent described above.

7. Recipients and Twitch connections

Authorised Prime Codes GmbH staff have access where necessary for operation, support or enquiries. Participants and winners are shown to the relevant streamer and, as described, overlay recipients. Twitch supplies sign-in, chat events and profile data. Profile pictures load directly from Twitch’s image infrastructure, transmitting in particular your IP address to it.

Twitch may process data outside the EU or EEA. See Twitch’s privacy notice for its stated recipients, transfer grounds and safeguards. Processing solely in Germany is not guaranteed for these external services. The functions described here do not use AWS speech synthesis or StreamElements donation tracking; those belong to the separate internal moderator dashboard.

Twitch privacy notice

8. Contact enquiries

We process information you send to handle your enquiry. The basis is Article 6(1)(b) GDPR for contractual matters, otherwise Article 6(1)(f) GDPR for appropriate communication. Data is deleted once handling is complete and further retention is unnecessary; statutory retention duties or establishing, exercising or defending claims may prevent immediate deletion.

9. Your rights

Subject to legal conditions, you have rights of access, rectification, erasure, restriction and data portability. You may withdraw consent at any time for the future. For processing based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. Where needed to identify the data, specify relevant Twitch channels and your Twitch user identifier; we may request appropriate proof of identity.

You may complain to a supervisory authority, particularly where you usually reside or work, or where the suspected infringement occurred. For Berlin, see the Berlin Commissioner for Data Protection and Freedom of Information.

Berlin Commissioner for Data Protection and Freedom of Information

10. Necessity and automated selection

You can view the public interface without Twitch sign-in. Without the necessary Twitch data and permissions we cannot provide account-related giveaway functions. Visitor analytics is voluntary. Winners are selected technically at random from the eligible pool; personal characteristics are not evaluated to select the winner.