deutschmark toolset privacy

Toolset collects only what is needed to run the service, authenticate your account, save your tool configuration, and make the connected streaming features work. The app is not an advertising product. It does not run Google Analytics, Mixpanel, PostHog, or similar third-party tracking SDKs.

Operational logs (who hit which endpoint, what response code, when) are reviewed when investigating bugs, abuse, or security incidents. They are not used for behavioral profiling or marketing.

• Authenticate you with Twitch and keep your Toolset session active.
• Save and load your widget, source, bot, stream, and command settings.
• Issue, rotate, validate, and delete hosted OBS / browser-source tokens.
• Connect Spotify features such as now-playing, song requests, queue controls, and playlist updates.
• Fetch Twitch clips, videos, stream markers, chat color, profile color, and bot-account details for tools that need them.
• Pair local ForgetMeNot runtimes and deliver bot settings and policy to those runtimes.
• Process supporter donations through Stripe and grant the matching cosmetic and active-supporter perks.
• Protect the service with CSRF checks, CORS allowlists, rate limits, encrypted records, and security headers.
• Review operational logs when investigating bugs, abuse, or reliability issues.
• Respond to support, privacy, and security requests.

The services below process or receive data on behalf of Toolset. Twitch, Spotify, Discord, Stripe, and Google Gemini act as independent data controllers for data flowing to their platforms — their use of that data is governed by their own privacy policies, not by this one.

Toolset uses a minimal cookie model. The auth worker sets a secure, HTTP-only dm_session cookie for the signed-in session and a JavaScript-readable dm_csrf cookie used to protect mutation requests against cross-site forgery. Cloudflare may also set security cookies for bot management, load balancing, and abuse prevention.

The browser may store local Toolset preferences such as the selected accent color and a "last-seen" timestamp for the What's-new feed in the topbar. Blocking strictly necessary cookies may prevent sign-in or dashboard requests from working.

• Toolset session cookies expire 24 hours after issue (refreshable by activity).
• OAuth state and pairing codes are short-lived (typically under 10 minutes) and deleted or allowed to expire after use.
• Twitch profile data, encrypted OAuth tokens, tool configuration, source tokens, and ForgetMeNot bot settings are retained for the life of your Toolset account.
• Deleting a hosted source from a tool page removes its record immediately. Disconnecting Spotify removes stored Spotify credentials, tokens, and profile data immediately.
• Donor records (Stripe customer ID, lifetime total, sub state, perk window) are retained for the life of your Toolset account so cosmetic tiers and supporter perks remain accurate. Stripe retains payment records under Stripe's own retention policy and applicable financial regulations.
• Monthly funder pool records (total raised, supporter count, donor handles for the month) are retained indefinitely as part of the public funding history; opting out of the public list at checkout means your handle never lands there in the first place.
• Cloudflare retains security and operational edge logs at the standard tier for approximately 24-48 hours; longer-retained security telemetry is governed by Cloudflare's own policies.
• Account deletion: email the contact address below with the Twitch login associated with the account. Account-level deletion removes all per-user records (tokens, settings, source records, donor record); aggregate financial records held by Stripe and totals already credited to public monthly funder pools are not deleted.

Toolset uses HTTPS everywhere, secure session cookies, CSRF checks on mutation routes, CORS allowlists that distinguish private dashboard endpoints from public widget-read endpoints, rate limits per endpoint and per token, no-referrer and standard security headers on worker responses, and ownership checks on opaque source tokens. Twitch, Spotify, and bot-account OAuth tokens, plus Spotify client credentials, are encrypted at rest with AES-GCM envelopes in Cloudflare KV using a versioned encryption key. Installation secrets are stored as SHA-256 hashes after the initial pairing exchange.

No electronic transmission or storage system is perfect. If you believe there is a security issue, contact the address below — security reports are reviewed on priority.

Breach notification. If a security incident affecting your personal data occurs, affected users will be notified without undue delay and in accordance with applicable law.

You have the following rights with respect to data Toolset holds about your account:

• Request a copy of the personal data Toolset stores about your account.
• Ask for correction of inaccurate account or configuration data.
• Ask for deletion of Toolset data associated with your Twitch account, subject to operational and security limits described below.
• Disconnect Spotify from the Connections page — this removes stored Spotify credentials, tokens, and profile data.
• Delete hosted source tokens from the relevant tool pages.
• Cancel or change recurring support from the Stripe Customer Portal linked under Settings → Billing.
• Use browser settings to clear local Toolset preferences, theme accent, and cookies.

Depending on your location, you may have additional rights under laws such as the EU GDPR, the UK GDPR, the California Consumer Privacy Act (CCPA / CPRA), or similar state privacy laws.

Toolset is made for Twitch creators and stream operators. It is not directed at children under 13, and personal information from children under 13 is not knowingly collected. The minimum age aligns with Twitch's own age policy, which Toolset users inherit through Twitch sign-in. If you believe a child has provided personal information through Toolset, contact the address below so it can be reviewed and deleted where appropriate.

Toolset user data is not sold. Toolset is not funded by advertisers or data brokers. Your Twitch, Spotify, bot, widget, hosted source, and donor data is not sold to third parties and is not shared with third parties for their own marketing.

For California residents: Toolset does not "sell" or "share" personal information as those terms are defined under the CCPA / CPRA, including for cross-context behavioral advertising.

Toolset infrastructure (Cloudflare Workers, KV, Pages) is hosted in the United States, with Cloudflare's CDN providing edge caching at points of presence worldwide. If you use Toolset from outside the United States — including from the European Economic Area, the United Kingdom, or other jurisdictions with data-transfer requirements — your personal data will be transferred to and processed on US infrastructure.

Where required, transfers rely on the recipient's own legal mechanisms (for example, Cloudflare publishes Standard Contractual Clauses and a Data Processing Addendum available on its trust site). Twitch, Spotify, Stripe, Discord, and Google each maintain their own legal mechanisms for their independent processing.

This Privacy Policy may change as Toolset evolves. The "Last Updated" date at the top of this page reflects the most recent revision. Material changes will be highlighted on the Toolset What's-new feed. Continued use of Toolset after a policy update means the updated policy applies to your use of the service.

For privacy questions, data requests, or security concerns, email [email protected] or check the docs for setup help.

For copyright, DMCA notices, and rules of use, see the Terms of Service.