Privacy Policy

1. Introduction

clubstream.io ("we", "us", "our") is an independent platform for discovering and sharing live electronic music streams. We are committed to protecting your personal data and complying with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the German Telecommunications-Telemedia Data Protection Act (TDDDG).

This privacy policy explains what personal data we collect, the legal basis for processing, how we use it, with whom we share it, and what rights you have.

2. Data Controller

The party responsible for data processing (Art. 4(7) GDPR) is:

Alexander Sadomsky
c/o IP-Management #42121
Ludwig-Erhard-Str. 18
20459 Hamburg, Germany
Email: [email protected]

3. Authentication via Twitch (OAuth 2.0)

clubstream.io does not maintain its own username/password system. Instead, we use Twitch OAuth 2.0 for authentication. When you click "Sign in with Twitch", you are redirected to Twitch's authorization page where you grant permission for clubstream.io to access certain account data.

3.1 Scopes Requested

We request the following OAuth scopes:

• openid — Verify your identity
• user:read:email — Read your email address (if provided)

3.2 Data Received from Twitch

Upon successful authentication, Twitch transmits the following data to us:

• Twitch User ID (numeric identifier)
• Username and display name
• Profile picture URL
• Email address (if you have one registered with Twitch)

3.3 What We Do NOT Access

• We do not access your Twitch password
• We cannot post, stream, or perform actions on your Twitch account
• We do not read your Twitch chat messages or subscriptions
• We do not access your Twitch payment or financial information

3.4 Legal Basis

Processing is based on your consent (Art. 6(1)(a) GDPR), which you give by clicking "Authorize" on the Twitch authorization page. You may revoke access at any time via your Twitch Connections settings.

4. Data We Store

4.1 User Account Data

When you sign in, we store the following in our database:

• Twitch User ID, username, display name
• Profile picture URL
• Email address (if provided by Twitch)
• Account creation and last update timestamps
• User role (user, listener, admin)

4.2 DJ Profile Data

If you create a DJ profile, we additionally store:

• DJ name, tagline, bio, location, residencies, equipment, and selected genres
• Social media links you voluntarily provide, including but not limited to: Twitch, YouTube, Instagram, SoundCloud, Spotify, Mixcloud, Beatport, Discogs, Bandcamp, Linktree, Discord, Facebook, and personal website
• Twitch follower count (fetched via Twitch API)
• Live status (updated via Twitch EventSub webhooks)

4.3 Listener Profile Data

If you create a listener profile, we store:

• Bio and preferred music genres
• Profile slug (URL identifier)

4.4 Interaction Data

• Follow relationships (which DJs you follow)

4.5 Auto-Discovered DJ Profiles (Public Twitch Data)

clubstream.io may automatically create temporary DJ profile pages based on publicly available data from the Twitch API. This occurs when a user of our platform discovers a streamer who is currently live in a music or DJ category on Twitch.

The following publicly available data may be processed:

• Twitch username and display name
• Twitch profile picture URL
• Twitch user ID (numeric identifier)
• Stream metadata (title, category, language, tags)
• Twitch follower count (approximate, publicly visible)
• Live/offline status

Legal basis:

Processing is based on our legitimate interest (Art. 6(1)(f) GDPR) in providing a music discovery platform that helps users find live electronic music streams. We have conducted a balancing test and concluded that:

• The data is already publicly available on Twitch and accessible to anyone
• Processing is limited to professional/public streaming activity, not private data
• Auto-discovered profiles are clearly labeled as "Discovered via Twitch" and include a disclaimer
• Auto-discovered profiles are not indexed by search engines (noindex)
• We do not store or display sensitive personal data
• Streamers can request removal at any time (see below)

Data retention:

Auto-discovered profiles are temporary. If the streamer has not been live for more than 24 hours, the profile becomes inaccessible. Stream-specific data (e.g. current viewer count) is only used for real-time display and is not permanently stored as an aggregate metric.

Opt-out and removal:

If you are a Twitch streamer and an auto-discovered profile has been created for you, you have the right to request its immediate removal. You can do so by:

• Using the "Request removal" link on the profile page itself
• Sending an email to [email protected] with your Twitch username
• Using our contact form with the category "Data Removal / Privacy Request"

Removal requests are processed within 48 hours. Upon removal, all stored data related to your auto-discovered profile (including stream history) is permanently deleted.

5. Website Analytics

We use a self-hosted, cookie-free analytics system to understand how our website is used. This system does not use cookies, does not track users across sessions, and does not create persistent user profiles.

5.1 How It Works

For each page view, a temporary visitor hash is generated from:

• Your IP address
• Your browser's User-Agent string
• The current date
• A random daily salt (regenerated each day)

This hash is a one-way cryptographic function — we cannot derive your IP address from it. The hash changes daily, so no cross-day tracking is possible.

5.2 Data Collected

• Page path visited
• Referrer URL
• Screen resolution
• Visitor hash (anonymized, rotated daily)
• Timestamp

5.3 Do Not Track

We respect the Do-Not-Track browser setting. If your browser sends DNT: 1, no analytics data is collected.

5.4 Legal Basis

Processing is based on our legitimate interest (Art. 6(1)(f) GDPR) in understanding website usage to improve the service. Given the privacy-preserving design (no cookies, no persistent identifiers, daily rotation), we consider this proportionate and minimally invasive.

6. Cookies

clubstream.io uses only technically necessary cookies. We do not use advertising, marketing, or third-party tracking cookies.

For a detailed list of all cookies, their purpose, and duration, please see our Cookie Policy.

6.1 Session Cookies (Essential)

• next-auth.session-token — Authentication session (encrypted JWT, httpOnly)
• next-auth.csrf-token — CSRF protection token
• next-auth.callback-url — Redirect URL after login

6.2 Third-Party Cookies

When you watch an embedded Twitch stream, Twitch may set its own cookies in your browser. These cookies are governed by the Twitch Privacy Notice. Twitch embeds are only loaded with your consent.

6.3 Cloudflare Cookies

Our CDN provider Cloudflare may set security-related cookies (__cf_bm, cf_clearance) for bot protection. These are classified as strictly necessary and do not require consent under TDDDG §25(2).

6.4 Legal Basis

Essential cookies are processed under TDDDG §25(2) (strictly necessary for the service). Third-party cookies from Twitch embeds are loaded only with your consent(Art. 6(1)(a) GDPR / TDDDG §25(1)).

7. Email Notifications

7.1 Types of Emails

If you opt in via your notification settings, we may send you the following types of emails:

• DJ Goes Live — Sent when a DJ you follow starts streaming
• System Announcements — Important platform updates, new features, and maintenance notices
• Recommendations — Suggested DJs and streams based on your listening history (sent periodically)

We also send transactional emails (e.g. contact form confirmations) that are not related to marketing and do not require separate opt-in.

7.2 Data Processed

To send email notifications, we process:

• Your email address (as provided by Twitch during authentication)
• Your display name (for personalized greetings)
• Your notification preferences (which types of emails you have opted into)
• Your follow relationships (to determine which DJ live notifications to send)

7.3 Email Service Provider

Emails are sent via SMTP through IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany). IONOS processes your email address solely for the purpose of delivering the email. All email infrastructure is located within the European Union.

Privacy Policy: https://www.ionos.de/terms-gtc/datenschutzerklaerung/

7.4 Legal Basis

Email notifications are sent based on your consent (Art. 6(1)(a) GDPR), which you give by enabling email notifications in your notification settings. All email notification types are disabled by default and require explicit opt-in.

7.5 Withdrawal of Consent

You can withdraw your consent and disable email notifications at any time via your notification settings. Every email we send also contains an unsubscribe link. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR).

8. Vibr (Algorithmic Mixing Tool)

8.1 Data Processed

If you use Vibr, we process the following data that you voluntarily provide:

• Track titles and artist names
• Musical keys, BPM values, and energy levels
• Tracklist order and set structure

This data is stored in association with your account and is not shared with third parties. You can delete your tracklist data at any time.

8.2 Legal Basis

Processing is based on the performance of a contract (Art. 6(1)(b) GDPR) — specifically, providing the Vibr feature you have chosen to use.

9. Selected Requests (Upcoming Feature)

9.1 Data Processed

When Selected Requests becomes available, the following data may be processed:

• Track request details (selected song, timestamp)
• Listener display name and user ID (for request attribution)
• Payment-related data (processed by a third-party payment provider — details will be disclosed before launch)
• DJ payout information (provided voluntarily by the DJ)

9.2 Payment Processing

clubstream.io does not directly process or store payment card details. All financial transactions will be handled by a certified third-party payment processor. The identity of this provider, along with their privacy policy and data processing practices, will be disclosed in an updated version of this Privacy Policy before the feature launches.

9.3 Legal Basis

Processing of transaction data will be based on the performance of a contract(Art. 6(1)(b) GDPR) and, where applicable, legal obligations (Art. 6(1)(c) GDPR) for financial record-keeping requirements.

10. Twitch EventSub (Webhooks)

For registered DJs, we subscribe to Twitch EventSub notifications to detect when a DJ goes live or offline. This uses:

• stream.online — Notifies us when a DJ starts streaming
• stream.offline — Notifies us when a DJ stops streaming

These notifications contain only the Twitch User ID and stream metadata (title, game, viewer count). No private user data is transmitted via webhooks.

11. Third-Party Services

11.1 Twitch (Twitch Interactive, Inc.)

We use the Twitch API and Twitch Embed for authentication and displaying livestreams. Data may be transmitted to Twitch Interactive, Inc. (350 Bush Street, San Francisco, CA 94104, USA). Twitch is a subsidiary of Amazon.com, Inc.

Privacy Policy: https://www.twitch.tv/p/en/legal/privacy-notice/

Data transfer to the USA is based on the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, July 10, 2023).

11.2 Cloudflare, Inc.

We use Cloudflare for CDN, DNS, and DDoS protection. Cloudflare may process server logs and set security cookies.

Privacy Policy: https://www.cloudflare.com/privacypolicy/

11.3 IONOS SE (Email)

We use IONOS SMTP services to send email notifications. IONOS processes recipient email addresses solely for the purpose of delivering emails on our behalf. All processing occurs within the European Union.

Privacy Policy: https://www.ionos.de/terms-gtc/datenschutzerklaerung/

11.4 Hetzner Online GmbH

Our servers are hosted at Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). All user data is stored on servers located in Germany.

Privacy Policy: https://www.hetzner.com/legal/privacy-policy/

12. Account & Profile Deletion

You can delete your data directly from your Dashboard at any time:

• Delete Profile — Removes your public DJ or Listener profile (including bio, genres, stream history and follower data). Your clubstream.io account stays active, and you can create a new profile later.
• Delete Account — Permanently removes your entire account, all profile data, follows and interaction history. You will be signed out immediately.

Both options require confirmation by typing "DELETE". Deletion is executed immediately and cannot be undone. If you prefer, you may also request deletion by email at [email protected].

13. Data Retention

• Account data is retained as long as your account exists. Upon account deletion (via Dashboard or email request), all personal data is removed immediately.
• Auto-discovered profiles become inaccessible after 24 hours of inactivity (streamer not live). All associated data is removed upon opt-out request.
• Analytics data (anonymized pageviews) is retained for 90 days, then aggregated into daily statistics without personal identifiers.
• Server logs (IP addresses in Nginx access logs) are retained for 14 days for security purposes and then deleted.

14. Your Rights (GDPR)

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access (Art. 15) — Request a copy of the data we hold about you
• Right to Rectification (Art. 16) — Correct inaccurate data
• Right to Erasure (Art. 17) — Request deletion of your data ("right to be forgotten") — you can do this directly from your Dashboard
• Right to Restriction (Art. 18) — Restrict how we process your data
• Right to Data Portability (Art. 20) — Receive your data in a machine-readable format
• Right to Object (Art. 21) — Object to data processing based on legitimate interest
• Right to Withdraw Consent (Art. 7(3)) — Withdraw consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. The competent authority for Hamburg, Germany is the Hamburgische Beauftragte für Datenschutz und Informationsfreiheit.

15. Data Security

We implement appropriate technical and organizational measures to protect your data:

• TLS/SSL encryption for all data in transit (Cloudflare Origin Certificates)
• Encrypted database connections
• httpOnly, Secure, and SameSite cookie flags for session tokens
• Server access restricted by IP allowlists and SSH key authentication
• Regular security updates and monitoring

16. Children's Privacy

clubstream.io is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

17. Independence Disclaimer

clubstream.io is an independent platform and is not affiliated with, endorsed by, or sponsored by Twitch Interactive, Inc. or Amazon.com, Inc. Use of the Twitch API is in accordance with the Twitch Developer Agreement. All Twitch-related trademarks and logos belong to their respective owners.

18. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated "Last updated" date. For material changes, we will notify registered users via the platform. We encourage you to review this page periodically.

19. Contact

For any questions about this privacy policy or your personal data, contact us at:
[email protected]

Full contact details are available in our Imprint.