Privacy

Visiting this site

The info pages run no analytics, ads or trackers. The site is served by Amazon Web Services, which handles your IP address to deliver the pages and to block abuse; we don't keep access logs. The pages load their fonts from Google Fonts, which sees your IP address when it sends them.

The site sets cookies only when you sign in: tt_oauth holds a random check value for the ten minutes a sign-in takes, and tt_session keeps you signed in for up to 30 days. Both are first-party and unreadable by scripts.

What we store when you sign in

Signing in with Twitch keeps only what the game needs:

• Your Twitch user id and login name, so the site knows who you are.
• Sessions: a fingerprint (hash) of each sign-in, never the session itself. A session ends when you sign out, and lapses on its own after 30 days.

Streamers also store:

• The Twitch sign-in the game uses to read chat, post its replies, read Channel Point redemptions, see who is in chat and tidy game commands out of chat. We keep Twitch's refresh token, encrypted with a key held in AWS's key service, and use it to hand the game short-lived access tokens. It is never shown to anyone, including you.
• Game settings you change on the dashboard. Settings can't hold passwords or tokens; the server refuses them.
• The OBS link key: only its fingerprint (hash). The full link is shown to you once and can't be read back. It lets the game in OBS read your settings, fetch a short-lived Twitch token and report round winners, nothing else.
• Wins per channel: for each viewer who wins a round on your stream, their Twitch user id, the name they played under, their win count and the last round counted. These feed the channel and global leaderboards, which show names and win counts only. Names are refreshed from Twitch every hour; a viewer whose account Twitch no longer returns is hidden at once and deleted after 30 days.

While the dashboard and the game are open, the link service keeps a record of each open page (a connection id, your user id, the page's role and a random page id) for at most three hours.

Everything else stays until you delete your account. Server error logs are kept for two weeks and hold no tokens, IP addresses or chat. The database keeps rolling backups for up to 35 days, so deleted data leaves the backups within 35 days.

What stays on the streamer's PC

• The game files and the art. The game reads the streamer's own copy of the original game in the browser. Those files, and the art the game draws from them, never leave the streamer's PC and never reach this site.
• Art for OBS goes straight from the dashboard to the game in OBS over a direct browser-to-browser connection (WebRTC) on the same PC. Our link service only passes the short messages that set that connection up and refuses anything else.
• Stats (races, wins, points, kills and the daily boards) live in that browser's own storage.
• Chat is read by the game straight from Twitch. We don't receive or keep chat messages. Emotes in chat bubbles load from Twitch's image servers.

The streamer's game runs locally too, without signing in here. Then nothing reaches this site at all, and the Twitch sign-in stays in that browser.

Public STUN servers

To find a direct route between the dashboard and the game in OBS, both pages ask public STUN servers run by Cloudflare and Google for their network address. Those servers see the streamer's IP address. They receive no game data, art or account details.

Deleting your data

On the dashboard, open the Twitch tab and choose Delete my account. That removes your profile, settings, encrypted Twitch token, OBS link key, every session, your login lookup and your channel's wins straight away. Then remove Tristram Tumble under Connections in your Twitch settings so Twitch revokes its access too.

Viewers can remove their own wins from every channel and from the global board on the Forget me page: sign in with Twitch there (we keep only a one-hour session, no Twitch token) and choose Remove. A later win is counted again. Stats and game files in your browser are yours: Forget files on the dashboard removes the game files, and clearing this site's data in your browser removes everything it kept there.

Contact

Questions, deletion requests or anything else about your data: contact@tristramtumble.com.