Privacy Policy
1. Who we are
Breakr.tv (the Service) is operated by Breakr.tv (the Company, we, us), based in the State of Missouri, United States. We are the data controller for the personal data described below. Reach us at privacy@breakr.tv.
2. What we collect
2.1 Account data
When you create an account we collect your email address, your chosen display name, a hashed password (we never store the plain password), and a timestamp. If you sign in through Discord or Google, we also receive the identifiers and public profile fields the provider sends during OAuth.
2.2 Workspace data
Content you create in your workspace: overlay settings, scene flashes, break builds, show notes, templates, uploaded media, invite records, and team members. We hold this to render the Service.
2.3 Usage and device data
Access logs, feature use, IP address at request time, user-agent, and crash reports. We use this to run and secure the Service and to find bugs.
2.4 Platform surface data (Whatnot and future platforms)
When you install the Breakr.tv browser extension, it reads live events on the pages you open on supported platforms (today, Whatnot) — show titles, chat messages, auction state, viewer usernames, and similar surface data — and forwards that data to your own workspace so it can appear in your overlays and dashboards.
The extension does not read pages outside the supported platforms. We do not sell this data. We do not use it to profile you or your viewers for advertising.
2.5 Rewards data
Viewer identifiers from supported platforms, point balances, redemption history, and operator-side fulfillment notes. We hold this to run the rewards shop you configure for your workspace.
2.6 Payment data
If you subscribe, our payment processor (Stripe) collects your payment details directly. We receive a customer identifier, the subscription state, billing cycle timestamps, and the last four digits of the card. We do not see your full card number.
2.7 Email metadata
For transactional email (verify-your-email, password reset, team invites, billing notices) we store the recipient, template type, timestamp, and delivery events we receive from our email provider (sent, delivered, opened, clicked, bounced). This lets us debug delivery and comply with anti-spam law.
2.8 Analytics
If analytics is on for your workspace (default, and switchable from the Settings page once that control ships), we send product-event names, aggregate counts, and anonymous session identifiers to PostHog so we can see how the Service is used. We do not send message content or secrets to PostHog.
3. How we use it
- Provide, operate, and improve the Service.
- Authenticate you and keep your account secure.
- Process payments and manage your subscription.
- Send transactional email about your account, your billing, your team, and the Service.
- Diagnose crashes and performance problems.
- Enforce our Terms, prevent abuse, and respond to legal requests.
- Measure feature use in aggregate to decide what to build next.
4. Legal bases (EU and UK)
If GDPR or UK GDPR applies to you, we rely on these legal bases:
- Contract. To run the account you asked for, to process your payment, and to deliver the paid plan.
- Legitimate interests. To keep the Service secure, to prevent abuse, to debug, and to measure aggregate usage. We balance these interests against your rights.
- Legal obligation. To keep records law requires and to respond to lawful requests.
- Consent. Where we rely on consent (for example, non-essential analytics after you opt out of the default), you can withdraw it at any time.
5. Who we share data with
We do not sell your personal data. We share data only with service providers (sub-processors) that help us run the Service, and only to the extent they need. Our current sub-processors include:
- Railway — application hosting and Postgres database (United States).
- Stripe — payment processing (United States).
- Resend — transactional email delivery (United States).
- PostHog — product analytics (United States, with EU residency available).
- Discord and Google — only when you sign in through them (OAuth providers).
Each sub-processor is bound by a data-processing agreement that limits what they can do with your data. We may add or change sub-processors; we post the current list here and give notice of material changes.
We may also disclose data if law requires it, to protect our rights or users, or as part of a merger, acquisition, or sale of assets (with notice to you).
6. International transfers
Our sub-processors are mostly in the United States. If you access the Service from the EU, UK, or another region with transfer restrictions, your data may be transferred to the US under standard contractual clauses or an equivalent lawful mechanism.
7. How long we keep data
- Account data — for as long as the account is active, then up to 90 days after you delete the account, except for records we must keep by law (billing).
- Workspace content — for as long as the account is active; deleted shortly after you delete the account.
- Billing records — up to 7 years, as tax law requires.
- Email delivery logs — up to 2 years, to debug delivery and respond to complaints.
- Access logs and crash reports — up to 90 days, except where a security investigation requires us to keep them longer.
8. Your rights
Depending on where you live, you may have the right to:
- Know what personal data we hold about you (access).
- Correct inaccurate data (rectification).
- Delete your data (erasure), subject to legal retention.
- Receive your data in a portable format (portability).
- Object to or restrict certain processing.
- Withdraw consent at any time where we rely on it.
- Lodge a complaint with your local data-protection authority.
To exercise a right, email privacy@breakr.tv. We will respond within 30 days (or shorter where law requires). We may ask you to verify your identity before we act. We do not discriminate against you for exercising a right.
California residents. Under the CCPA, you have the rights above and may designate an authorized agent. We do not sell personal information and have not sold or shared it in the preceding 12 months as those terms are defined under California law.
9. Cookies and tracking
We use a small number of cookies and similar technologies:
- Session cookie — required to keep you signed in. Essential; cannot be turned off while you are signed in.
- Theme preference — remembers your light or dark preference on this device.
- Analytics — PostHog uses a first-party cookie or local storage to measure feature use. You can opt out from the Settings page (once the control ships) and from the cookie banner on your first visit (where law requires).
Your browser's "Do Not Track" signal is not a legal standard, so we do not act on it. We do act on jurisdiction-specific opt-outs where law requires.
10. Children
The Service is not for anyone under 18. We do not knowingly collect personal data from anyone under 18. If you believe a child under 18 has given us personal data, email privacy@breakr.tv and we will delete it.
11. Security
We protect your data with hashed passwords (bcrypt), HTTPS in transit, access control between workspaces, and operational practices around secrets and backups. No system is perfectly secure. If you discover a vulnerability, email security@breakr.tv. We investigate every report in good faith.
12. Changes to this policy
We may update this policy. When we do, we post the new version here and update the "Last updated" date. For material changes, we also notify active subscribers by email.
13. Contact
Email privacy@breakr.tv for any privacy question or request. For other questions, email hello@breakr.tv.
Breakr.tv · Terms of Service · Home