Privacy Policy
Last updated: 6 September 2026
This policy explains what data Tribathon Insights processes, why, and what you can do about it. It describes what the product actually does today — not what it might do later.
Who is responsible
[LEGAL ENTITY NAME], with registered address at [ADDRESS] ('we', 'us'), is the data controller for the processing described here. You can reach us about anything in this policy at [CONTACT EMAIL].
What we process, and why
Tribathon Insights is an analytics tool for creators. Almost everything we hold is about you — the creator — and about your own content and broadcasts. We deliberately do not store data about the people in your audience.
| Data | Why we hold it | Legal basis |
|---|---|---|
| Your Tribathon account identifier, role and language preference | To create your Insights account and let you sign in | Performance of a contract |
| Session records (a hash of your session token and its expiry — never your IP address, browser or device) | To keep you signed in and let you sign out everywhere | Performance of a contract |
| Your connected platform accounts: platform, account identifier, and public username | To know which accounts to collect metrics for | Performance of a contract |
| Access tokens for platforms you connect in Insights, stored encrypted (AES-256-GCM) | To read your own statistics from those platforms on your behalf | Your consent, given when you connect each platform |
| Your historical events imported from Tribathon: platform, event type, timestamp and figures such as tier, bits or quantity | To build your metrics and media kit | Performance of a contract |
| Viewer counts sampled while you are live, and metrics for your own videos and posts (views, likes, comments, shares, title, thumbnail) | To show your audience and content performance | Performance of a contract, plus your consent for each connected platform |
| Daily aggregates calculated from the above | So your dashboard and media kit load without recomputing everything | Performance of a contract |
What we deliberately do not collect
This is a design constraint of the product, enforced in code, not just a promise:
- No personal data about your viewers, subscribers or donors: no names, no usernames, no messages, no email addresses.
- No raw payloads or metadata from the source platforms.
- No IP addresses, browser or device information tied to your session.
- No tracking or advertising cookies. The only cookies we set are the ones that keep you signed in and remember your language.
Where your data comes from
- From you, when you sign in and connect your platform accounts.
- From Tribathon, which shares your authorised historical events with us after you approve the connection. You can revoke that approval at any time.
- From the platforms you connect (Twitch, Kick, YouTube, Instagram, TikTok), which we query using the authorisation you granted.
Who we share it with
We do not sell your data, and we do not share it for advertising. We share it only with the providers we need to run the service:
- Our hosting and database provider, which stores the data on our behalf.
- The streaming and social platforms you connect, when we call their APIs to read your statistics.
- Tribathon, as the source of your imported history.
Anyone you share a media kit link with can see the aggregated metrics on that page. Those links contain only aggregate numbers, never personal data, and you can revoke them.
International transfers
Some of the platforms we query on your behalf (Google, Meta, TikTok, Twitch, Kick) operate outside the European Economic Area, mainly in the United States. Those transfers rely on the European Commission's adequacy decisions or on standard contractual clauses, depending on the provider.
How long we keep it
- While your account is active, we keep your metrics so your history stays available to you.
- If you ask us to delete your account, we remove your data within 30 days at the latest.
- If you disconnect a platform, we stop collecting from it immediately and delete its stored access token.
- Session records expire on their own and are purged automatically.
Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in a portable format. Where we rely on your consent, you can withdraw it at any time — disconnecting a platform does exactly that.
Write to [CONTACT EMAIL] and we will respond within one month. If you think we have handled your data badly, you can complain to your national data protection authority; in Spain that is the Agencia Española de Protección de Datos (aepd.es).
If you are in California
You have the right to know what personal information we collect and why, to request its deletion, to request a copy, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA. Use the same address, [CONTACT EMAIL], to exercise any of these rights.
Age
Tribathon Insights is not intended for people under 18, or under the minimum age required by the platforms you connect, whichever is higher.
Changes
If we change this policy in a way that affects you, we will tell you in the product before the change takes effect. The date at the top always reflects the current version.