Privacy Policy

1. Scope and who is responsible

This Privacy Policy explains how RPS Brawl (“we,” “us,” or “our”) handles personal information when you use the RPS Brawl website, Twitch Extension, live tournaments, crowd mode, and related services (the “Service”). RPS Brawl is responsible for the processing described in this policy.

For privacy questions or requests, contact jeremy@rps-brawl.com.

2. Information we collect

Twitch account information

When you sign in with Twitch or share your identity with the Twitch Extension, we receive your Twitch user ID and username. For website sign-in, we also receive and store an OAuth access token and its expiration time so we can authenticate your requests. Twitch may include your email in an authorized API response, but RPS Brawl does not persist your email address.

Tournament and gameplay information

We process tournaments you host or join, player identifiers and usernames, game pairings, moves, timing, match outcomes, tournament winners, and related status information. Some of this information is shown publicly in the relevant lobby, stream overlay, or tournament.

Extension, session, and device information

The Twitch Extension sends a signed authorization token containing information such as the Twitch channel, viewer identifier, role, and expiration time. We verify that token to authenticate Extension requests. We also use random authentication state values, player tokens, and a session cookie to keep you signed in and protect requests.

Our infrastructure may automatically process technical information such as IP address, browser and device type, requested URLs, timestamps, WebSocket events, and diagnostic or security logs.

3. How we use information

We use this information to:

• authenticate players and streamers;
• create, operate, display, and resolve tournaments and matches;
• connect the website and Extension to Twitch;
• prevent duplicate entries, cheating, abuse, and security incidents;
• debug, maintain, and improve reliability and performance;
• enforce our Terms of Service and comply with legal obligations.

Where data-protection law requires a legal basis, we rely on performance of our agreement with you, our legitimate interests in operating and securing the Service, consent where requested, and compliance with legal obligations.

4. Cookies and browser storage

RPS Brawl uses storage that is necessary to run the Service:

• a secure, HTTP-only crowd_session cookie that lasts up to seven days unless you log out or remove it sooner;
• local storage for Twitch sign-in details, including the access token and its expiration, and short-lived sign-in intent information;
• session storage for tournament player sessions, which is generally cleared when the browser tab’s session ends.

We do not use this storage for third-party advertising or cross-site behavioral tracking. You can clear browser storage through your browser settings, but doing so may sign you out or interrupt an active game.

5. When we share information

We share information only as needed with:

• Cloudflare, which provides hosting, serverless compute, databases, real-time connections, networking, and security for the Service;
• Twitch, when you use Twitch sign-in or the Extension, in accordance with Twitch’s own privacy policy;
• authorities or other parties when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or defend legal claims;
• a successor in connection with a merger, financing, acquisition, or transfer of the Service, subject to appropriate protections.

We do not sell your personal information or use it for targeted advertising.

6. Retention

OAuth security state values expire after about 10 minutes, and crowd-mode sessions expire after up to seven days. Tournament, player, and game records may be retained to operate the Service, maintain tournament history, prevent abuse, and resolve technical or legal issues. Twitch account records and expired OAuth tokens are retained until they are no longer needed or you request deletion, subject to security, legal, and backup requirements.

When information is no longer needed, we delete or anonymize it within a reasonable period. Infrastructure logs and backups may remain for their providers’ limited retention periods.

7. Security and international processing

We use reasonable technical and organizational safeguards, including encrypted connections, signed tokens, access controls, and secure cookies where appropriate. No online service can guarantee absolute security.

RPS Brawl and its providers may process information in countries other than yours. Where required, we rely on legally recognized safeguards for international transfers.

8. Your privacy choices and rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to processing of your personal information, receive a portable copy, or withdraw consent. You may also have the right to complain to your local data-protection authority.

You can clear local browser data, log out of crowd mode, and manage or revoke RPS Brawl’s access from your Twitch account settings. To make another privacy request, email jeremy@rps-brawl.com from an address or account that lets us verify your request. Revoking Twitch access does not automatically delete records already held by RPS Brawl; contact us if you also want those records deleted.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided information in violation of this policy, contact us so we can review and delete it where appropriate.

10. Changes to this policy

We may update this Privacy Policy as the Service or applicable requirements change. We will post the updated version here and revise the “Last updated” date. If a change is material, we will provide additional notice when reasonably possible.