This policy explains what personal data Fishrift handles, why, who else sees it, how long we keep it and what rights you have. It applies to Creators, their Team members, Viewers, members of Discord servers that use the Fishrift bot, and anyone who visits fishrift.com or docs.fishrift.com.
Fishrift is responsible (the "controller") for your account, the website, the docs site, security, and features that work across channels, such as Viewer accounts, cosmetics, pronouns and Fishrift ripples and cookies. Our company details are on the Legal Notice page.
When a Creator switches on a feature that handles data about their community, such as the chatbot, loyalty points, giveaways, song requests, text to speech or the Discord bot, the Creator decides how that feature is used in their channel, and Fishrift processes the data for them under a data processing agreement (section 8 of our Terms of Service). If you are a Viewer and have a question about a specific channel, you can ask the Creator or ask us; we will help either way.
When you sign in with Twitch, YouTube or Kick, and when you link other services, we receive:
Overlays, alerts, rifts, commands, timers, quotes, schedules, links pages, profile settings, Discord bot settings and the files you upload to your media library.
When a Creator uses Fishrift, we receive data from their platform about the people in their community:
If a Creator adds the Fishrift bot to their Discord server, we process member IDs, names and roles, and depending on what the Creator switches on: support tickets with their messages and a transcript of the ticket when it closes, moderation cases (warnings, timeouts, kicks, bans and reasons), birthdays members choose to share (day and month), giveaway entries and winners, and self roles.
When you visit Fishrift, our hosting provider Cloudflare processes your IP address and browser details to deliver the page and protect it from attacks. We use IP addresses for rate limiting and keep a short security log of events like sign ins and account closure requests. We do not run analytics scripts; Cloudflare gives us aggregated traffic numbers from its own server logs.
If you email us or report content, we keep your message, your email address and what we did with it.
When paid plans launch, Stripe will process your payment details. We receive only your plan, the amount, the date, the country for VAT and the last four digits and brand of your card, never the full card number. When you start a plan we also record that you agreed to an immediate start (with the time, IP address and browser), so we can show it if there is ever a dispute about your right of withdrawal.
| What we do | Legal basis (GDPR article 6) |
|---|---|
| Running your account and the features you use | Performance of a contract, 6(1)(b) |
| Handling community data for a Creator's channel | The Creator's legitimate interest in running their community, and ours in providing the service, 6(1)(f) |
| Public profiles, leaderboards and activity feeds | Contract for the Creator's own data; legitimate interests for Viewer names shown on them, 6(1)(f). Viewers can ask to be hidden (section 11) |
| Security, rate limiting and fraud prevention | Legitimate interests, 6(1)(f) |
| Service emails and Sonar messages about your account | Performance of a contract, 6(1)(b) |
| Product news by email | Legitimate interests for existing users, with an opt out in every email and in your settings, 6(1)(f) |
| Payment, VAT and accounting records | Legal obligation, 6(1)(c) |
| Things you choose to share, like your birthday or giveaway contact details | Consent, 6(1)(a). You can remove them at any time |
| Handling reports and legal requests | Legal obligation (DSA), 6(1)(c), and legitimate interests, 6(1)(f) |
Where we rely on legitimate interests, we have weighed them against your interests, and you may object (section 11).
Each service you connect has its own privacy policy. We only ask for the permissions a feature needs.
You can disconnect any service in your account settings. Disconnecting stops new data coming in; ask us if you also want past data deleted.
Fishrift has public pages and a public API on purpose. The following can be seen by anyone:
These companies process data for us under data processing agreements and only for the purposes described here:
| Provider | What for | Where |
|---|---|---|
| Cloudflare | Hosting, database, file storage, security | Worldwide network, company in the US |
| Amazon Web Services (Amazon Polly) | Turning text to speech messages into audio | EU (Stockholm) |
| Resend | Sending service emails | US |
| Stripe (when paid plans launch) | Payments | EU and US |
When a feature acts on a Connected service (section 5), data goes to that service, for example a bot reply to Twitch chat, a song to Spotify or a ticket to Discord. Those services are responsible for what they do with it.
Some pages load content directly from other companies, which then see your IP address:
Fonts come from Google Fonts, but Fishrift's own servers fetch them and pass them on, so your browser never contacts Google for them.
Creators and the Team members they invite can see the community data of their own channel and server. Creators never see data about other channels.
We share data with authorities only when Dutch or EU law requires it, for example after a valid court order, and we check every request.
If Fishrift is taken over, your data moves to the new owner under this policy, and we tell you beforehand.
Most data is processed in the EU. Cloudflare, Resend and some Connected services are US companies and may process data in the US. Those transfers rely on the EU US Data Privacy Framework where the company is certified, or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards.
| Data | How long |
|---|---|
| Your account and settings | As long as your account exists. Deleted within 30 days after we process your closure request |
| Community data of a channel or server | As long as the Creator's account exists, unless the Creator or the Viewer has it deleted sooner |
| Uploaded files | Until you delete them; after account closure, within 30 days |
| Backups | Overwritten within 30 days |
| Security log | 7 days |
| Rate limit counters | A few minutes |
| Emails and reports to us | As long as needed to handle them, at most 2 years after the case is closed |
| Payment, VAT and invoice records | 7 years, as Dutch tax law requires |
| Records of consent to an immediate start of a paid plan | 7 years after the subscription ends |
| Record that you accepted the Terms (version, time, IP address, browser) | As long as your account exists |
If a data breach is likely to put your rights at risk, we report it to the Autoriteit Persoonsgegevens within 72 hours, and if the risk is high we tell you directly.
You have the right to:
How: many settings, including your profile, pronouns, birthday, connections and account closure, are in your account settings. For everything else, email privacy@fishrift.com from the email address on your account, or tell us which platform username is yours. We may ask you to prove it is your account, for example by sending a code in chat. We answer within one month. For complex requests we may take two more months, and we tell you why.
Viewers without a Fishrift account can use the same rights for the data a channel holds about them. Tell us the platform, your username and the channel. We may involve the Creator, because they decide how their channel uses the data.
Complaints: if you are not happy with how we handle your data, please tell us first. You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or the authority in the EU country where you live.
We do not make decisions that have legal or similarly significant effects on you based only on automated processing. Chat filters, cooldowns and automatic timeouts are set up by Creators for their own chat.
You must be 18 or older to create a Fishrift account. Younger Viewers can still appear in a Creator's community data, because platforms such as Twitch and YouTube allow viewers from 13. We treat that data the same way as everyone else's and never use it for advertising or profiling. If you are a parent and want data about your child removed, email privacy@fishrift.com.
When we change this policy in a way that matters, we tell you by email and Sonar before the change applies. The date at the bottom of this page shows the latest version.
Updated 4 October 2026 · Fishrift, The Netherlands · privacy@fishrift.com