Privacy Policy

Controller: Trigglow.

Contact: contact@trigglow.com.

Scope: web platform, API (api.trigglow.com), overlays, public payment pages and the Trigglow apps you connect to your account (the Trigglow Dynamic Delay OBS plugin, the Trigglow Desktop app and the Stream Deck plugin).

We collect and process:

• Account Data: email, username, Argon2/scrypt password hashes, language preferences.
• Streaming platform data (Kick, Twitch or YouTube, for the platforms you connect): user ID, channel name, public avatar and OAuth tokens (encrypted). While you stream, also your channel chat events and messages (text, public display name and ID of the author), follows, subscriptions, bits, Super Chats, memberships, raids and other channel events. For YouTube, see section 12.
• Discord data (only if you connect a server): server, channel and role IDs, and the messages and events the bot needs to run your commands, moderation and notices.
• Spotify data (only if you connect it): OAuth tokens and the currently playing track, to show it on your music overlay and manage song requests.
• YouTube song requests (only if you enable them): the requested video (ID, title, channel, thumbnail and length) and the public name and platform ID of the viewer who requested it in chat; while the player is open, its state (current video, position, paused). No Google account needs to be connected. See section 12.
• Imports from other bots (Nightbot, Botrix or others, only if you use it): the command list of your account, which is copied into Trigglow.
• Technical & Log Data: IP address (hashed for fraud prevention), User-Agent, server logs, WebSocket telemetry. When a viewer searches for GIFs or sounds on the pay page, a pseudonym of their IP address — a keyed hash (HMAC), not the raw IP — is stored temporarily (15 minutes) together with the results shown to them, solely to check that the media they pick comes from that search (and respects the streamer’s content filter). The same kind of IP pseudonym is used in temporary counters that limit abuse (requests when signing in, connecting apps, opening tickets or using Trigi without an account, among others), which expire on their own within at most one hour (one minute on the pay page); a Trigi conversation without an account also keeps a pseudonym of this kind, only to mark it as a guest’s.
• Site & Download Analytics (cookie-free): the visited path (without query strings), or the type of plugin download, with its timestamp and an anonymous identifier produced by salted-hashing the IP address and User-Agent, regenerated every day — so it can count unique visitors within one day but cannot follow anyone across days. No cookies are set and the raw IP is not stored; admin pages and overlays are not tracked, and the browser Do Not Track signal is honoured. Used only for aggregate statistical reports emailed to designated administrators.
• Billing Data: Stripe customer/subscription IDs, transaction history (for paid alerts, including whether the alert fired and, if it could not be delivered, the time and technical reason of the failure, so it can be retried and claims can be handled). Full card numbers are handled exclusively by Stripe.
• Product Data: triggers, uploaded media (including clips and their subtitles) and support tickets (messages and attachments, such as the OBS log you choose to attach from the OBS plugin; the subject and message you type in the plugin go through the same server-side filter that hides paths with your user name, URLs, keys, emails and IPs). If you open a ticket without an account, we keep the name and email address you give us to reply to you; the confirmation email we send does not repeat your name or subject.
• AI support assistant (Trigi), on the web and in the Trigglow Dynamic Delay OBS plugin: the messages you write and its replies, conversation events (whether it helped, a hand-over to a person or a ticket), where you ask from (on the web, the path of the page you open the assistant from; in the plugin, its version and operating system) and the language; in the plugin, also the version of the AI notice you accepted. From the plugin, and only if you tick “Include OBS technical data”, also OBS technical data made of numbers and states only: OBS and system versions, CPU architecture, renderer, graphics card vendor, RAM, the stream encoder family (x264, NVENC, QSV, AMF…), canvas and output resolutions and fps, the delay’s state and settings (including whether a live scene and a waiting scene are chosen, yes or no, never which), OBS and plugin performance and the plugin’s recent error codes; never scene or source names, paths, stream keys, URLs or IP addresses. Messages written from the plugin also go through a server-side filter that hides paths with your user name, URLs, keys, emails and IPs before they are stored and sent to the AI provider. The OBS log is never sent to the assistant: it is only attached to a ticket if you choose so, and the plugin hides the same data on your computer first. Please do not type passwords, stream keys, overlay URLs or payment details.
• Sessions & Connected Apps: for each signed-in session and each Trigglow app you connect to your account (the Trigglow Dynamic Delay OBS plugin, the Trigglow Desktop app or the Stream Deck plugin), the start and last-use dates and the IP address and User-Agent of the last use, to show them in Settings → Active sessions so you can sign them out or disconnect them; for the OBS plugin, also its version and operating system. While you confirm an app connection on the web we also keep a pseudonym (keyed hash) of the network range the request came from, solely to warn you if it comes from a different network than yours: for at most 10 minutes, or about 12 with the previous connection flow (10 to confirm and 2 for the app to pick up its access). The OBS plugin’s connection, with its IP address and User-Agent, is kept while its access is valid (it expires after 30 days unless renewed, and never lasts more than a year) and a few minutes more; after that, or when you disconnect it, it is deleted. Since version 0.6.0 the OBS plugin gets its own access, limited to its features (checking your account, Trigi and your Dynamic Delay tickets), which it stores on your computer encrypted with Windows data protection together with your display name, without your email.
• Viewer Data: optional name, message text and ephemeral voice audio clips on the pay page, and purchase details (name and email) in the store.

Performance of Contract (Art. 6.1.b): Core overlay alerts, OBS sync, authentication (including the apps you connect to your account, such as the OBS plugin), Starter/Pro subscriptions, and handling, payment and delivery of store orders.

Legal Obligation (Art. 6.1.c): Tax and accounting compliance.

Legitimate Interests (Art. 6.1.f): Security, automated moderation of uploaded content (to detect unlawful content; if content is wrongly blocked, a member of our team reviews it through support and you can contest the decision), fraud prevention, referral abuse defense, and customer support.

Legitimate Interests (Art. 6.1.f) — aggregate usage statistics: internal daily, weekly and monthly reports on visits, plugin downloads, donations, subscriptions and incidents, with minimal impact (no cookies, no raw IP, no cross-day tracking).

AI support assistant (Trigi): Performance of Contract (Art. 6.1.b) to answer the questions you ask and, if you request it, prepare your ticket, including the OBS technical data you choose to send (if you ask on the website without an account, our legitimate interest in answering your request, Art. 6.1.f); and Legitimate Interests (Art. 6.1.f) to keep conversations for at most 12 months in order to handle follow-ups and claims, review the quality of the answers, improve the service and prevent abuse. You can object and delete your conversations at any time (section 7). Trigi does not make decisions that produce legal or similarly significant effects on you: it only answers and, if you ask, prepares a ticket that a person handles.

Consent (Art. 6.1.a): Third-party ad cookies (Adsterra network) via the in-banner consent prompt on the Free plan. You can withdraw it at any time.

We do not disclose your data to third parties for commercial purposes. Data is shared only with:

• Processors (service providers): Vercel Inc. (content delivery network), Resend Inc. (transactional email), OpenAI (automated moderation of uploaded content) and NVIDIA Corporation (audio transcription for clip subtitles and the Trigi AI support assistant, on the web and in the OBS plugin). All are bound by data processing agreements under GDPR Art. 28. Trigglow does not authorize data sent to OpenAI or NVIDIA to be used to train or improve their AI models.
• Payment providers: Stripe Payments Europe, Ltd., acting as an independent controller for payment processing, fraud prevention and banking compliance.
• Third-party platforms (interoperability): Kick Streaming Pty Ltd, Twitch Interactive, Google LLC / YouTube, Discord Inc. and Spotify AB (and, if you use them to import commands, Nightbot and Botrix), through their official APIs and only under the authorization you grant when connecting them. Each acts under its own terms and privacy policy.
• Advertising networks (Free plan only): Adsterra, subject to your prior express consent, acting as controller of the advertising cookies and technologies it deploys.

The API, databases and files are hosted on Trigglow’s own servers in Spain (European Union). US vendors (Stripe, Vercel, Resend, OpenAI, NVIDIA, Google, Discord, Spotify) are certified under the EU-U.S. Data Privacy Framework (DPF) or utilize Standard Contractual Clauses (SCCs).

Account data is kept while your account is active. Accounting and tax records are kept for the 6-year legal period required by the Spanish Commercial Code.

Ephemeral viewer voice clips are deleted within 24-48 hours. The IP pseudonym (keyed hash) and media search results from the pay page are deleted automatically after 15 minutes; the rate-limit counters tied to that pseudonym, within at most one hour. Moderation events are deleted automatically after 60 days, song requests after 14 days, and technical server logs after 14 days.

Chat messages from connected platforms are kept in the operational history for a maximum of 60 days for filters, commands and statistics, after which they are deleted automatically. Other events (follows, subscriptions, donations, stream statistics) and aggregate totals stay linked to your account while it is active, and are deleted when you disconnect the platform or delete your account.

Conversations with the AI support assistant (Trigi), from the web and from the OBS plugin, together with any OBS technical data you choose to send, are kept for at most 12 months from when the conversation ended (or started, if it was never closed; a finished conversation takes no more messages or events) and then deleted automatically. You can delete them earlier at any time (section 7), and they are also deleted when you delete your account. What becomes part of a support ticket (the summary and the conversation you decide to send to the team) is kept with that ticket. The history you see in the OBS plugin only lives in your computer’s memory and disappears when you close the dialog.

Session and connected-app data is kept while the session or app stays active and is deleted when you sign it out or disconnect it, sign out in the app, change or reset your password, or when it expires. The OBS plugin’s connection is deleted at most a few minutes after its access expires. The network-range pseudonym used when connecting an app is deleted within at most 10 minutes (about 12 with the previous connection flow).

You have the right to access, rectify, erase, restrict, port, or object to your personal data, and to withdraw any consent you gave at any time, by emailing contact@trigglow.com. Withdrawing consent does not affect the lawfulness of prior processing. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).

To delete your conversations with Trigi you don’t need to write to us: in Settings → Privacy & data → Conversations with Trigi you can see how many are stored and delete all of them at once (web and OBS plugin). If you used Trigi without an account, or want us to delete one specific conversation, email contact@trigglow.com. To remove a connected app’s access, use Settings → Active sessions (in the OBS plugin, also Sign out in its dock).

Encryption in transit (HTTPS/TLS 1.3 and secure WebSockets), secure password hashing, cookies with Secure, HttpOnly and SameSite=Lax flags, and isolated containerized databases.

Authorized Trigglow staff may access your account in read-only mode when needed to provide support, keep the service secure, prevent fraud or meet legal obligations. This access cannot change your account, hides your credentials and payment details, and is logged internally.

Apps connected with limited access, such as the OBS plugin, can only use their own features; their access expires, renews automatically and can be revoked at any time. The OBS plugin only talks to our API over HTTPS, stores its access encrypted on your computer, and hides paths with your user name, URLs, keys, emails and IPs from the OBS log on your computer before attaching it to a ticket.

The service is restricted to people aged 18 or over. We do not knowingly collect data from minors.

Revisions to this policy are published with an updated effective date and, where substantial, we will ask you to accept them again when you next sign in.

We use a strictly necessary session cookie/identifier to keep you signed in — under EU ePrivacy rules, this does not require consent.

On the Free plan dashboard we may show an advertising banner served by our advertising partner, Adsterra. It only loads, and only sets its cookies, after you explicitly accept it — you will first see a consent prompt on that banner. If you decline (or do not decide), you will instead see a Trigglow house banner, which sets no third-party cookies.

For the detailed list of cookies, their purposes, providers and retention periods, see our Cookie Policy, or manage them at any time in Settings → Privacy. Adsterra explains its own advertising cookie usage at https://adsterra.com/privacy-policy-managed.

If you connect your YouTube channel, Trigglow accesses your Google account only with the permissions you grant (youtube.readonly and youtube.force-ssl) and only for your own channel.

We use this data solely to provide the features you enable: showing Super Chat, membership and new-subscriber alerts on your overlays, reading your live chat to run your commands, timers and filters, replying and moderating in your chat (deleting messages, temporary or permanent bans), updating your broadcast title and computing your stream analytics.

Trigglow’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements (https://developers.google.com/terms/api-services-user-data-policy).

We do not sell this data, use it for advertising or to train AI models, or transfer it to third parties except to provide the service, to comply with law, or for security. No Trigglow personnel read YouTube chat content unless you explicitly consent (for example in a support request), for security or abuse purposes, or where required by law.

Retention: YouTube chat messages are deleted automatically after 60 days; other YouTube events are kept in your activity history while your account is active. They are deleted when you disconnect YouTube in Trigglow or when your account is deleted. OAuth tokens are deleted on disconnect.

YouTube song requests: this feature uses YouTube API Services. To search videos by name or read a link’s details, Trigglow queries the YouTube Data API with Trigglow’s API key (or, if you connected your channel, under your authorization) and, for links, YouTube’s public oEmbed service. Neither your Google account nor your viewers’ are accessed for this feature.

Videos play only in YouTube’s official embedded player (IFrame Player), in its privacy-enhanced mode (youtube-nocookie.com), inside Trigglow’s player page that you open in OBS or your browser. During playback, YouTube (Google) may process data from the device playing the video — such as its IP address or device identifiers — under its own privacy policy; Trigglow does not receive that data.

Song request retention: played or discarded requests are deleted automatically after 14 days; pending ones are kept until they play, are removed, or you clear the queue. The player state expires 45 seconds after the player is closed. Video data obtained from YouTube is cached for at most 7 days (search results) and 24 hours (per-video details), always under the 30-day limit set by the YouTube API Services policies.

By using YouTube song requests, you and your viewers agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms).

You can revoke access at any time at https://myaccount.google.com/permissions or by disconnecting YouTube in Trigglow (Connections). YouTube data is also subject to the Google Privacy Policy (https://policies.google.com/privacy) and the YouTube Terms of Service (https://www.youtube.com/t/terms).

Regarding viewer data (chat messages, usernames or ephemeral audio shown live), the streamer acts as controller of their own public broadcast and Trigglow acts as the provider of the technical display tool.

For direct payments on the pay page (Trigglow Link) and in the store, Trigglow and Stripe process the identification and payment data strictly necessary to carry out the transaction.

For the purposes of GDPR Art. 28, regarding viewer personal data processed in overlays and chats, the Terms of Service constitute the data processing agreement between the streamer (controller) and Trigglow (processor); Trigglow undertakes to process such data only in line with the technical configuration set by the creator and under the security measures set out in this policy.