Privacy Policy

From Twitch, when you use the Extension:

• Your Twitch opaque user ID. Twitch gives every Extension an anonymous ID for each viewer. We store it so the Extension can recognise you when you come back.
• Your Twitch user ID and username (login name) — only if you choose to share your identity. The Extension shows the Twitch “share your identity” prompt when you press Login with Twitch. If you allow it, we use your Twitch user ID to look up your username through the Twitch API, and we store both so your cards can be tied to you. If you decline, the Extension still works for browsing but cannot show your collection. (If you are the channel owner, Twitch signs your role into the token instead, and we use your channel ID.)
• When you use “Log in with Twitch” on the website, Twitch asks for your permission to share your basic public profile with us: your Twitch user ID, login name, display name and profile picture. We request no extra permissions — we cannot see your email address, chat, follows or subscriptions, and we cannot act on your Twitch account. We use the Twitch access token only once, to read that profile, and then revoke it; we never store it.
• Your public Twitch profile picture, fetched from Twitch’s public API to show next to your collection and on the leaderboard. Profile pictures are cached for up to 7 days.

From playing:

• Your collection: which cards you have pulled, granted, or upgraded, and in which season; and the resulting leaderboard score, which is calculated from your collection.
• An activity log of recent game events (pulls, grants, upgrades, trades, resets), each with your username and a timestamp. Only the most recent 500 events are kept.
• Trade offers you make or receive (who, which cards, any note you write, and when), kept in a log of the latest 400 finished trades. Open offers on the Trade page, including the board, are visible to logged-in viewers.
• A history for every card copy. Each copy of a card has a serial number and a record of when it was created and who held, traded or spent it (kept with the usernames involved). It is shown on the card’s public page.
• Your settings and profile choices if you set any: a short bio, your Looking for list, display and notification preferences, how you arranged your profile, and a few samples of your score and rank (taken when you open My Stats) for the history chart.
• A profile record (username, display name, Twitch user ID, creation time, and an optional note the channel owner may add).
• When a viewer’s name is sent to us by the streamer’s own tools (for example a channel-point redemption that opens a pack), we receive that username so the pack can be opened for them.

Automatically:

• Basic technical data (IP address, browser and device type, pages requested, timestamps) in our hosting provider’s logs, and privacy-friendly analytics and performance measurements (Vercel Web Analytics and Speed Insights) for the Extension and website. These do not use cookies and are not used to build a profile of you.
• A login cookie (“tcg_session”) if you log in on the website. It is a signed token holding your Twitch login name, user ID and display name, so the site knows who you are when you view your stats or upgrade cards. It is strictly necessary for logging in, lasts up to 30 days, and is removed when you log out. A short-lived cookie (“tcg_oauth”, about 10 minutes) also protects the sign-in step itself.
• One item of local storage in the Extension (“tcg_panel_loggedout”) that remembers you chose to log out, so it doesn’t log you straight back in. It stays on your device.

We do not collect your email address, real name, payment details, precise location, or your Twitch chat messages or follows. We do not ask for Twitch permissions beyond the optional identity share.

• To show you your cards and let you upgrade them (in the Extension or, when you are logged in, on the website), and to record cards you earn on stream.
• To keep you logged in on the website and show your personal stats.
• To calculate and display leaderboards and card values for each season.
• To run the stream overlay and the website, keep them secure, prevent abuse, and fix problems.
• To understand, in aggregate, how the Extension and website perform.

We do not use your information for advertising, and we do not sell or rent it.

The game is social, so some information is visible to anyone who knows where to look:

• Collection pages and leaderboards are public. Anyone can open a collection page by typing a Twitch username, and the leaderboard lists usernames, profile pictures, scores and card counts for each season. They are not behind a login.
• The home page shows recent pulls (username, card, and when), the top collectors, and season statistics that are built from everyone’s collections.
• Every card copy has a public history. Each copy of a card has a serial number and a page showing when it was created and who has held it, traded it or spent it in an upgrade. Collectors with a private profile are shown as “a private collector” there.
• You can step back from the public boards. Signed in with Twitch, Settings lets you add a short public bio, make your profile private (you are left off the leaderboard, owner lists and recent pulls; your page still opens by link), switch off trade notices or direct offers, and download everything we hold about you. Those choices are stored with your username.
• Pack openings and collection displays are shown live on the streamer’s broadcast with your username, and may be saved in VODs and clips.

If you would rather not appear, don’t log in to the Extension; you can ask us to remove your data at any time (see section 7).

We use a few service providers to run the Extension. They process data on our behalf:

• Twitch — the Extension runs inside Twitch, and we call the Twitch API to resolve usernames and profile pictures. Twitch’s own privacy notice applies to what Twitch collects.
• Vercel — hosting, logs, analytics and performance measurement, plus the database (Vercel KV, Redis) and file storage (Vercel Blob) where the data above is kept. These services may store data in the United States and other countries.
• Discord and other streaming tools — only if the streamer has connected them. The streamer can have game events (for example “<username> pulled a card”) posted to their own Discord server, or sent to tools such as Mix It Up. Those messages contain your username and the card involved, and are then governed by those services’ policies and the streamer’s settings.

We may disclose information if required by law or to protect the rights, safety, or security of our users or the service. If the project were ever transferred to someone else, this data would transfer with it, subject to this policy.

• Collections, profiles and leaderboard data are kept until you ask us to delete them or the streamer removes them (for example when resetting a season).
• The activity log keeps only the latest 500 events. Cached profile pictures refresh weekly.
• Hosting logs and analytics are kept for the period set by our hosting provider.

Requests from the Extension are authenticated with Twitch-signed tokens, administration is behind a password, and data is stored with reputable providers over encrypted connections. No system is perfectly secure, so we can’t guarantee absolute security. The data we hold is limited by design: it is mostly game data plus Twitch usernames and IDs.

• Don’t share your identity. Decline Twitch’s prompt, and we never learn your username or Twitch ID.
• Log out. The logout button in the Extension deletes the link between your Twitch opaque ID and your username. Log out on the website deletes your login cookie. Neither deletes your collection or profile.
• Disconnect from Twitch. You can remove this site’s access from your Twitch account under Settings → Connections at any time; we hold no Twitch token, so there is nothing further to revoke on our side.
• Stop sharing your identity. You can stop sharing your Twitch identity with an Extension from Twitch itself (see Twitch’s help pages on Extension permissions).
• Access, correct or delete your data. Contact us (below) and we will provide a copy of the data we hold about you, correct it, or delete your collection, profile and activity entries. Depending on where you live (for example the EU/UK under GDPR, or California under the CCPA/CPRA) you may have additional rights, including to object to or restrict processing and to complain to your local data-protection authority. We will respond within the time required by applicable law.

Where the law requires a legal basis for processing, ours is to provide the game you asked to take part in (performance of a contract) and our legitimate interest in running and securing it. Your decision to share your Twitch identity is voluntary and you can withdraw it at any time.

The Cheesy TCG is intended for Twitch users, and Twitch requires users to be at least 13 (or the age of digital consent where they live, if higher). We do not knowingly collect information from anyone younger. If you believe a child has used the Extension, contact us and we will delete their data.

We may update this policy as the game changes. The “Last updated” date above shows the latest version, and we will make any significant change visible in the Extension or on the channel.

Questions or requests about your data: contact the streamer who operates this extension through the stream’s Twitch channel (for example via a whisper or the channel’s contact details), and mention that it is a privacy request.