Privacy Policy

Draft. This document is being reviewed by legal counsel before launch.

# Privacy Policy (draft)

Effective date: 20 September 2026

CryptoDon ("we") operates cryptodon.cc. We collect as little personal data as possible.

## 1. Data we collect

**Streamers (account holders)**
- Channel data received from the streaming platform you sign in with (Twitch, YouTube, Kick):
  channel ID, login, display name, avatar, follower count and, where provided, email address.
- Access tokens for those platforms, used only to read your channel and live status.
- Wallet addresses you enter.
- Settings, uploaded animations and sounds, moderation lists.
- Security data: two-factor secret, one-time email codes, and an activity log
  (action, time, IP address, browser) used to protect your account.
- Stream statistics: when you are live and the viewer counts reported by the platform.

**Donors**
- The name and message you type on the donation page.
- Public blockchain data of your transfer, including the sending address.
- Technical data needed to prevent abuse: IP address and rate-limiting counters.

We do **not** collect payment card data, bank details, private keys or seed phrases, and we
never ask for them.

## 2. Why we use it

- To run the service: create donation invoices, match payments, show alerts.
- To protect streamers and viewers: filtering, bans, rate limits, fraud prevention.
- To give streamers statistics about their own channel.
- To contact account holders about security events, for example a wallet change.

Legal bases (GDPR): performance of a contract (Art. 6(1)(b)), legitimate interests in security
and abuse prevention (Art. 6(1)(f)), and consent where required.

## 3. Sharing

We share data only with service providers needed to operate the platform: hosting, blockchain
data providers, email delivery and content delivery. They process data on our instructions.
We do not sell personal data.

Blockchain transactions are public by nature; we do not control that data.

## 4. Storage and retention

Data is stored on servers in Germany and encrypted in transit. Donation records are kept
while the streamer's account exists. Security logs are kept for 12 months. Backups are kept for
14 days.

## 5. Your rights

You can request access, correction, deletion or export of your personal data, and object to
processing, by writing to [email protected]. Streamers can delete their account in the dashboard,
which removes their profile, settings and uploaded media.

## 6. Children

The service is not intended for anyone under 18.

## 7. Changes

We will announce material changes on the service before they take effect.

## 8. Contact

[email protected]