Privacy Policy

1. Controller and Contact

The independent operator of ExcelProtocol is the controller responsible for the processing described here. Privacy questions and data requests may be sent to stayexcellent on Discord or through the ExcelProtocol support server.

The Service is hosted on Fly.io in the Frankfurt region. Its primary application database is stored on a persistent Fly.io volume.

2. Data We Process

Discord account and server data

• Discord user ID, username, avatar reference, and the servers you can manage while you are signed into the dashboard
• Guild, channel, role, category, message, and member IDs needed for configured features
• Server settings, setup metadata, reaction-role content, welcome or goodbye text, voice-room settings, and permission state
• Birthday day and month, optional birth year, and the associated Discord user ID when the birthday feature is used
• User ID, username, action, reason, and timestamp for configured safety actions and authorized admin activity
• Suggestion text, internal comments, usernames, user IDs, guild ID, and timestamps when the suggestion feature is used

Twitch and streaming data

• Twitch logins and user IDs for broadcasters and monitored streamers, including optional links to Discord members
• Stream start and end times, notification status, milestone state, and temporary public stream details fetched from Twitch
• Custom command text, settings, total-use counts, and per-viewer Twitch ID or login and use count
• Broadcaster OAuth access and refresh tokens, granted scopes, and token-expiry information for authorized Twitch features
• Reward identifiers and titles, video links, trim points, volume, hotkey, and overlay appearance settings
• Giveaway configuration, entry and redemption identifiers, Twitch user IDs, logins, display names, eligibility notes, winners, and timestamps

Operational and security data

• Notification message IDs and delivery logs, permission issues, unresolvable Twitch accounts, and health state
• Hashed companion or plugin keys, opaque OBS overlay tokens, access timestamps, and revocation state
• For ExcelProtocol FX: the device name, random device ID, plugin and OBS versions, negotiated capabilities, last-seen time, desired effect settings, and safe command-result metadata. Pairing codes and device credentials are stored only as one-way keyed hashes, and command bodies are not retained
• For Excel Interactio: the same limited device and connection metadata. Current Twitch chat text and plugin-requested bot messages are processed transiently for delivery, are not retained by ExcelProtocol, and are not replayed after a disconnect. Interactio timer schedules remain in the OBS plugin and are not created or stored by ExcelProtocol
• A random dashboard session identifier stored in a secure, HTTP-only cookie; the corresponding session data is held in application memory
• Standard web-server and platform logs, which may include request time, route, error information, and network metadata such as IP address

Discord OAuth access tokens are used to complete sign-in and fetch identity and manageable-server information; they are not stored in the application database. We never receive your Discord or Twitch password.

3. Sources of Data

We receive data directly from dashboard users and command users; from server owners or administrators who configure features; from interactions with the bot, Twitch chat, Channel Points, or giveaways; and from Discord and Twitch APIs. This means some information may be configured by a server administrator rather than supplied directly by the affected member or viewer.

4. Purposes and Legal Bases

Where data-protection law requires a legal basis, processing is based on one or more of the following:

• Performance of the Service: authenticating dashboard users, applying settings, delivering alerts, running commands, rewards, overlays, roles, voice rooms, birthdays, and giveaways
• Legitimate interests: securing the Service, preventing abuse, diagnosing failures, maintaining short operational histories, and improving reliability
• Consent or user direction: optional Twitch OAuth permissions, birthday information, optional integrations, and actions explicitly initiated by authorized users where consent is the appropriate basis
• Legal obligations: responding to valid legal requests and protecting legal rights

We do not sell personal data, use it for behavioral advertising, or use Discord or Twitch data to build advertising profiles.

5. How Data Is Used and Displayed

Data is used only to operate, secure, support, and improve the stated features. Depending on server configuration, selected information may be displayed in Discord messages, role panels, welcome or birthday posts, Twitch chat messages, OBS browser sources, dashboards, statistics, leaderboards, or giveaway wheels and history.

Server owners and administrators choose many of these destinations. They are independently responsible for configuring access appropriately and providing any notices or permissions their communities require.

6. Service Providers and Data Sharing

We disclose data only as needed to operate the Service, comply with law, protect rights and security, or follow your direction:

• Discord: authentication, server and member information, messages, channels, roles, voice rooms, and moderation actions
• Twitch: OAuth, EventSub, public stream data, chat, clips, Channel Points, rewards, and giveaway interactions
• Fly.io: application hosting, network delivery, logs, and persistent database storage
• YouTube/Google: embedded video playback, reward-video previews, and web-font delivery; those providers may receive device and network information
• Ko-fi: optional tips after you follow the external link; ExcelProtocol does not receive card or payment-account details

We do not disclose Discord or Twitch API data to data brokers, advertising networks, or unrelated third parties. Providers may process data in countries outside your own under their own terms and transfer safeguards.

7. Cookies and External Media

ExcelProtocol sets one strictly necessary dashboard session cookie named ep_session. It is Secure, HTTP-only, SameSite=Lax, and expires after up to seven days. We do not use advertising or analytics cookies.

Google Fonts and YouTube embeds are third-party resources. Loading them may allow Google or YouTube to receive network and device information and apply their own technologies under their privacy terms. YouTube previews load only where the relevant video or overlay feature is used.

8. Retention

• Dashboard sessions remain in memory for no more than seven days and are also removed on logout or restart
• Notification delivery logs are automatically trimmed after 30 days
• Per-server and global stream-event history keeps the current and previous calendar month
• Notification message IDs are normally removed when a stream ends; temporary voice-room records are removed when rooms close
• Custom-command per-viewer counters are deleted when that command is deleted
• Twitch OAuth tokens remain until the account is disconnected, authorization is revoked, the related server data is deleted, or a valid deletion request is completed
• Server configuration, birthdays, safety records, reward settings, OBS settings, and giveaway data are retained while needed for the enabled feature or its requested history
• Native OBS plugin pairing codes expire after ten minutes; revoked device records and safe FX command audit metadata remain with the server configuration until guild data is deleted or a valid deletion request is completed
• Suggestions and their comments remain until an authorized admin deletes them or a valid deletion request is completed
• Admin audit history is limited to the latest 100 actions

Removing the bot starts a seven-day grace period so an accidental removal can be reversed. If the bot is not re-added, guild-scoped configuration and history are deleted after that period. Some short-lived global stream history may remain until its normal rolling cleanup because the same streamer can be tracked by multiple servers. Data may be retained longer only when required by law or reasonably necessary to resolve abuse, security, or legal claims.

9. Automated Moderation

If a server administrator enables the safety filter, ExcelProtocol can automatically kick or ban a joining member based on configured signals such as account age, username patterns, or the absence of an avatar. The administrator chooses the signals, minimum age, bypass role, and action. ExcelProtocol does not infer sensitive traits or use these checks for advertising or credit-like decisions.

Affected users should contact that server's owner or moderators to contest a decision. Server administrators can inspect safety records, change the rules, disable the feature, or reverse Discord actions where Discord permits.

10. Your Choices and Rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to processing, or receive a portable copy of personal data, and to withdraw consent where processing is based on consent. You may also complain to your local data-protection authority.

• Use the dashboard or commands to correct or delete many settings directly
• Disconnect Twitch to stop authorized Twitch processing and remove stored broadcaster tokens
• Delete a custom command to remove its per-viewer counters
• Remove the bot to begin guild-data deletion, or contact us for a specific access or deletion request

To protect users, we may need to verify your Discord or Twitch identity and authority over the relevant server or account before fulfilling a request.

11. Security

Safeguards include HTTPS/WSS, secure and HTTP-only session cookies, Discord permission checks, owner/admin access controls, OAuth state validation, short-lived one-time device pairing, one-way keyed credential hashes, strict native-plugin command schemas and limits, Twitch EventSub HMAC-SHA256 verification, scoped Twitch authorization, and restricted dashboard routes. OAuth tokens, device credentials, and overlay URLs should still be treated as secrets.

No online system is completely secure. If you believe credentials, overlay URLs, or personal data have been exposed, revoke the affected authorization or key and contact us promptly.

12. Children

ExcelProtocol is not intended for anyone below the minimum age required by Discord, Twitch, or applicable law. Server administrators should not submit information about a child who is not permitted to use those services. Contact us if you believe prohibited child data has been provided.

13. Changes to This Policy

We may update this Policy when features, providers, retention practices, or legal requirements change. The date above identifies the latest version. Material changes will be announced through the dashboard or support server when practical.

14. Contact and Requests

For privacy questions or data requests, contact stayexcellent on Discord or use the ExcelProtocol support server. Include the relevant Discord server ID, Discord user ID, or Twitch login where appropriate, but never send a password, OAuth token, or secret key.