Privacy Policy
This Privacy Policy explains how SoundSlap collects, uses, discloses, retains, and protects information in connection with soundslap.stream, the SoundSlap Twitch Extension, broadcaster dashboard, APIs, browser-source overlay, and related services (collectively, the "Service").
1. Scope and Operator
SoundSlap is currently an unincorporated online service operated from California by its owner ("SoundSlap," "Operator," "we," "us," or "our"). This Policy applies to information processed by SoundSlap. It does not govern Twitch, Klipy, OBS, or other third parties, which maintain their own privacy practices.
Privacy questions and requests may be sent to soundslap.stream@gmail.com. SoundSlap does not presently maintain a physical public office. Additional operator or legal-entity information will be posted when the business structure changes or when legally required.
2. Information We Collect
Information from Twitch
- Twitch user ID, login, display name, avatar URL, channel ID, role, and granted OAuth scopes;
- encrypted Twitch access and refresh tokens, token type, connection dates, and expiration information;
- Extension authorization data, including Extension client ID, channel ID, opaque viewer ID, linked Twitch user ID when available, and JWT metadata;
- Bits product, transaction, SKU, amount, viewer, broadcaster, and transaction-status information;
- moderator and subscription-status information when the broadcaster authorizes those Twitch scopes; and
- chat delivery and EventSub information used to announce alerts and process Twitch events.
Information from Broadcasters and Managers
- uploaded audio files, filenames, MIME types, sizes, durations, and technical metadata, plus URLs and metadata for Klipy GIFs selected by users;
- upload-rights certifications, policy version, time, associated sound, and authenticated account identifiers;
- sound names, codes, categories, artwork, visibility, prices, volume, cooldowns, and queue settings;
- manager identities, roles, permissions, and actions;
- custom overlay HTML, CSS, JavaScript, alert styles, and other configuration;
- blocked-viewer records, moderation reasons, support requests, and other content voluntarily submitted; and
- public/private library selections and Klipy GIF identifiers, titles, URLs, dimensions, and safety ratings.
Information from Viewer Interactions
- viewer Twitch or opaque identifiers, display name, and anonymous-display selection;
- selected sound, payment method, amount, timestamp, queue state, and playback result;
- transaction identifiers and hashed transaction-payload information;
- Restore Token status, failure reason, value, creation, use, and expiration information; and
- moderation and blocked-viewer records associated with a broadcaster's channel.
Information Collected Automatically
- IP address, port, browser or user-agent information, requested URL, referrer where supplied, timestamps, response codes, and request identifiers;
- server, API, security, rate-limit, WebSocket, overlay, and error logs;
- essential session-cookie and OAuth-state information; and
- service-health, storage, queue, transaction, and aggregate usage statistics.
SoundSlap does not receive your Twitch password or full payment-card information. Twitch controls the Bits purchase flow. Choosing "Anonymous" changes public display but does not prevent Twitch or SoundSlap from processing identifiers needed for transaction validation, security, moderation, or Restore Tokens.
3. Sources of Information
We collect information from:
- you, when you connect Twitch, upload content, configure the Service, or contact us;
- Twitch, through OAuth, the Extension Helper, Bits, EventSub, chat, and Twitch APIs;
- broadcasters and managers who configure a channel or moderate viewer activity;
- Klipy when a broadcaster searches for or selects GIF artwork;
- our hosting, networking, security, and infrastructure systems; and
- automated interactions with the website, API, Extension, and overlay.
4. How We Use Information
SoundSlap uses information to:
- authenticate users and maintain essential dashboard sessions;
- display broadcaster-approved libraries and process viewer selections;
- verify Twitch Extension JWTs, Bits products, transaction amounts, and duplicate receipts;
- operate alert queues and overlays;
- display names or "Anonymous" as selected and send configured chat announcements;
- issue, verify, use, or void Restore Tokens for eligible failed alerts;
- store, transcode, and stream uploaded audio, and fetch and display user-selected Klipy artwork;
- manage permissions, moderation, blocks, cooldowns, and panel availability;
- provide support, diagnose failures, monitor availability, and improve usability;
- prevent fraud, abuse, security incidents, unauthorized access, and policy violations;
- comply with law, enforce the Terms, resolve disputes, and protect legal rights; and
- create aggregate or deidentified operational statistics that are not reasonably linked to a person.
SoundSlap does not currently offer or process Channel Points redemptions. A future integration is planned; this Policy will be updated before related data collection begins.
SoundSlap does not use personal information for third-party targeted advertising or automated decisions producing legal or similarly significant effects. Automated rules may enforce cooldowns, queue limits, duplicate-transaction checks, blocked-viewer settings, and other technical safeguards.
5. Cookies and Similar Technologies
SoundSlap uses essential first-party cookies for dashboard authentication and Twitch OAuth request integrity. The dashboard session cookie is HTTP-only, Secure in production, and SameSite=Lax, and is configured to expire after approximately 14 days. The OAuth-state cookie is short lived, generally about 10 minutes. These cookies are necessary to provide login and security features.
SoundSlap does not currently use third-party advertising cookies, cross-site behavioral advertising, or third-party analytics cookies. Twitch may use cookies or similar technologies within Twitch under Twitch's own policies. Loading Klipy-hosted artwork may disclose ordinary request information, such as IP address and user agent, to Klipy or its content-delivery providers.
6. How We Disclose Information
We may disclose information to the following recipients for the purposes described in this Policy:
- Twitch: to authenticate accounts and operate Bits, EventSub, Extension identity, subscription checks, and chat features;
- broadcasters and authorized managers: to operate and moderate their channel, review history, manage Restore Tokens, and investigate failed or abusive activity;
- viewers and the public: when a broadcaster marks content public or when names, sounds, prices, artwork, and alert activity are intentionally displayed in the Extension, overlay, or Twitch chat;
- Klipy and content-delivery providers: when users search for, select, or load Klipy GIF artwork;
- hosting and infrastructure providers: to host, secure, transmit, back up, and maintain the Service;
- professional advisers and transaction parties: for legal, accounting, security, financing, incorporation, reorganization, acquisition, or transfer of the Service, subject to appropriate confidentiality and legal restrictions; and
- government, legal, and safety recipients: when required by valid legal process or reasonably necessary to prevent harm, fraud, abuse, or security incidents, enforce agreements, or protect rights.
SoundSlap does not sell personal information for money and does not share personal information for cross-context behavioral advertising as those terms are defined by the California Consumer Privacy Act.
7. Public Content and Manager Access
Sound names, artwork, prices, codes, public-library content, viewer display names, and alert messages may be visible to broadcasters, managers, viewers, stream audiences, or Twitch chat depending on configuration. Public streams and chat may be recorded, clipped, redistributed, or indexed by people and services outside SoundSlap's control.
Authorized managers may access the channel information permitted by their assigned role, which can include sound configuration, queue controls, settings, uploads, history, Restore Tokens, and moderation records. Broadcasters are responsible for granting and revoking manager access appropriately.
8. Retention
We retain information for as long as reasonably necessary for the purposes described in this Policy, including providing the Service, maintaining transaction integrity, preventing duplicate Bits receipts, supporting Restore Tokens, resolving disputes, enforcing agreements, protecting security, and complying with law. Current retention generally includes:
- dashboard sessions until expiration or logout, generally up to 14 days;
- OAuth state until used or expired, generally about 10 minutes;
- connected Twitch tokens until disconnection, replacement, revocation, expiration, account deletion, or operational removal;
- uploaded content and configuration while maintained by the broadcaster, subject to deletion, backups, public-library use, and legal holds;
- transaction, queue, audit, moderation, and Restore Token records for the period reasonably needed for integrity, fraud prevention, support, legal compliance, and dispute resolution; and
- server and security logs according to operational, hosting, backup, and security needs.
Deletion from active systems may not immediately remove information from limited backups or records that must be retained for legal, security, fraud-prevention, transaction-integrity, or dispute purposes. We will isolate or restrict retained information where reasonably appropriate.
9. Security
SoundSlap uses reasonable administrative, technical, and physical safeguards appropriate to the Service, including HTTPS, server-side Twitch JWT verification, transaction validation, duplicate-receipt rejection, encrypted stored OAuth tokens, hashed session identifiers, HTTP-only cookies, rate limiting, restricted dashboard access, scoped manager permissions, and signed EventSub verification.
No security measure or online service can guarantee absolute security. Users should protect their Twitch accounts, overlay URLs, devices, manager permissions, and connected integrations and should promptly report suspected unauthorized access to soundslap.stream@gmail.com.
10. California Online Privacy Disclosures
This section is intended to address the California Online Privacy Protection Act, California Business and Professions Code §§ 22575-22579 ("CalOPPA"), and the California Consumer Privacy Act, California Civil Code § 1798.100 et seq., as amended by the California Privacy Rights Act (collectively, "CCPA"), where those laws apply.
SoundSlap is an early-stage service and may not presently meet the statutory thresholds that make an operator a "business" subject to every CCPA requirement. If and when the CCPA applies, SoundSlap will honor the rights and obligations required by that law. We also endeavor to respond to reasonable privacy requests where feasible even when a particular statutory right does not apply.
Categories Collected and Disclosed
The following table describes categories of personal information SoundSlap may have collected during the preceding 12 months, examples, business purposes, and categories of recipients. We do not use every example listed in the CCPA's statutory category definitions.
| CCPA category | SoundSlap examples | Purposes | Recipient categories |
|---|---|---|---|
| Identifiers | Twitch ID, login, display name, opaque viewer ID, channel ID, IP address, session and transaction identifiers | Authentication, alert delivery, security, moderation, transaction integrity | Twitch, broadcasters/managers, infrastructure providers, legal/safety recipients |
| Customer records information | Account and contact information, connected-service records, support communications | Account administration, support, security, legal compliance | Twitch, infrastructure providers, professional advisers, legal/safety recipients |
| Commercial information | Bits SKU, amount, transaction ID, selected sound, Restore Token | Transaction validation, playback, fraud prevention, support, accounting | Twitch, broadcasters/managers, infrastructure providers, legal/safety recipients |
| Internet or electronic network activity | Requests, URLs, user agent, timestamps, session activity, queue and overlay events, logs | Service delivery, diagnostics, security, rate limiting, abuse prevention | Infrastructure and security providers, legal/safety recipients |
| Audio, visual, or similar information | Uploaded sounds, artwork, selected GIFs, custom alert media | Operate the library, Extension, preview, and overlay | Broadcasters/managers, viewers/public as configured, Klipy, infrastructure providers |
| Professional or role information | Broadcaster, manager, moderator, administrator, or viewer role | Permissions, channel administration, moderation | Twitch, broadcasters/managers, infrastructure providers |
| Inferences and aggregate metrics | Top sounds, usage totals, failure trends, operational risk flags | Dashboard reporting, security, reliability, Service improvement | Broadcasters/managers, infrastructure providers |
| Sensitive personal information | Account authentication tokens and credentials used to access connected Twitch functionality | Authentication and authorized Twitch API operations; not used to infer characteristics | Twitch and infrastructure providers as operationally necessary |
No Sale or Behavioral-Advertising Sharing
SoundSlap has not sold personal information or shared personal information for cross-context behavioral advertising during the preceding 12 months. SoundSlap has no actual knowledge that it sells or shares the personal information of consumers under 16. Because we do not engage in these practices, there is currently no separate "Do Not Sell or Share My Personal Information" link.
California Rights
Where the CCPA applies, California residents may have rights to know or access categories and specific pieces of personal information, delete information, correct inaccurate information, opt out of sale or sharing, limit certain uses of sensitive personal information, receive information about disclosures, and receive equal service and pricing without unlawful discrimination for exercising privacy rights.
Submit a request to soundslap.stream@gmail.com with the subject "California Privacy Request." Describe the right you wish to exercise and identify the Twitch account or channel involved. We may verify the request through the connected Twitch account, identifiers associated with the interaction, or other reasonable information. An authorized agent must provide proof of authority, and we may still verify the consumer's identity directly. We will respond within the time required by applicable law and may deny or limit a request where an exception applies.
Shine the Light
California Civil Code § 1798.83 permits certain California residents to request information regarding disclosure of personal information to third parties for their direct-marketing purposes. SoundSlap does not disclose personal information to third parties for their own direct marketing. Questions may be sent to the privacy contact above.
11. Do Not Track and Global Privacy Control
Some browsers transmit "Do Not Track" signals. Because SoundSlap does not currently track users over time across unaffiliated websites for behavioral advertising, the Service does not use a separate process for Do Not Track signals. Third parties such as Twitch or Klipy may receive ordinary request information under their own practices when their services or media are used.
Global Privacy Control ("GPC") is treated as a request to opt out of sale or sharing where legally required. SoundSlap does not currently sell personal information or share it for cross-context behavioral advertising, so a GPC signal does not change current SoundSlap practices.
12. Children's Privacy
The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Children under 13 may not use SoundSlap. Users between 13 and the age of legal majority may use the Service only as permitted by Twitch and with the permission and supervision of a parent or legal guardian.
If we learn that we collected personal information from a child under 13, we will take reasonable steps to delete it consistent with the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501-6506, and 16 C.F.R. Part 312. A parent or guardian may contact soundslap.stream@gmail.com with a deletion request.
13. United States Processing
SoundSlap is operated from the United States. Information may be processed in the United States and in locations where Twitch, Klipy, or infrastructure providers operate. This Policy is written for a California-based United States operator and does not claim compliance with legal regimes that do not apply to SoundSlap. We will update the Policy and operations if expansion creates additional legal obligations.
14. Changes to This Policy
We may update this Policy as the Service, business structure, providers, or applicable laws change. The updated Policy will be posted at this URL with a revised effective date. We will provide additional notice of material changes when required by law. Material changes apply prospectively unless law permits otherwise.
15. Contact and Requests
Send privacy questions, access requests, correction requests, deletion requests, or California privacy requests to soundslap.stream@gmail.com. Include enough information to identify the applicable Twitch account, channel, transaction, or interaction, but do not send your Twitch password, full payment information, or unnecessary sensitive information.