Privacy Policy

This Privacy Policy explains what RexBot (“we”, “us”) collects and how it is used when you visit the RexBot website or use the Twitch bot, Discord bot, dashboard, overlays, and related services.

1. Information we receive

When you connect Twitch, we may receive your Twitch user ID, login, display name, avatar, broadcaster status, the email address on your Twitch account, and OAuth tokens needed to operate requested features. When you connect Spotify, we receive the account information and authorization needed for song requests and playback controls. The Discord bot receives server, channel, member, message, and interaction data that Discord makes available to a bot with the permissions you grant.

RexBot may store bot settings, custom commands, timers, moderation settings, song-request activity, queue state, overlay preferences, reaction-role mappings, and role-menu mappings. We may receive basic technical information such as IP address, browser type, timestamps, and error logs when you use the website.

If you add editors to your dashboard, they can view and change your bot settings; you can remove an editor at any time.

If you join using a partner link, we record that partner with your first Twitch signup so RexBot administrators can see partner signup totals. Reconnecting an existing account does not change its signup source. The partner tag is carried in site links during your visit; this does not add tracking cookies or browser storage.

If you apply to become a community partner, we collect what you enter on the application (your answers, average viewers, followers, streams per week and the RexBot features you use), your Twitch channel, and the results of our checks against the partner requirements, including your Twitch account’s creation date as reported by Twitch. RexBot administrators review applications in an admin dashboard, and a copy is posted to a private Discord channel that only the review team can see. We use this information only to decide on your application and to run the partnership, and we keep it for as long as we need it for those purposes. You can ask us to delete it at any time (see section 8). The Partner Guidelines explain how the program works.

If you make a purchase, Stripe collects your payment details (such as card number, billing details and fraud-prevention signals) on its own checkout page. RexBot never sees or stores your full card number. We receive and keep a record of the purchase: your Twitch account, what you bought, the amount and currency, the date, the Stripe customer, payment and refund IDs, and the email address Stripe has for your receipt.

2. How we use information

We use information to authenticate you, operate bot commands and overlays, save your configuration, provide moderation and analytics features, maintain security, troubleshoot failures, and improve the Services. We do not sell personal information.

If a streamer turns on Mod activity, RexBot records, for that channel only, how many chat messages each moderator sent (not the messages themselves), the moderation actions Twitch reports (which moderator, what action, the affected username, and any reason given), and when RexBot was connected. Only the channel owner can see it. Action details are deleted after 90 days and hourly totals after about a year, and the owner can delete all of it at any time from the dashboard. Raid suggestions store the channels a streamer marks as favorites and the raids RexBot observed to and from their channel.

We use purchase records to deliver what you bought, send receipts, handle refunds and disputes, prevent fraud, and meet tax and accounting rules. We use your email address only to contact you about RexBot and your purchases. Service notices tell you about changes that affect your setup, such as a new overlay URL, and are on by default. News about new features is sent only if you opt in. You can turn either off from the Connections page of your dashboard, and every email includes an unsubscribe link. We do not share your email address with anyone except the email delivery provider used to send these messages.

3. Storage and security

Credentials and refresh tokens are stored with application-level protections. No internet service can guarantee absolute security, so do not place passwords, payment details, or other secrets in bot commands, messages, custom responses, or overlay settings.

4. Third-party services

RexBot connects to Twitch, Discord, Spotify, YouTube, Railway, Vercel, Stripe (which processes payments), Resend (which delivers our account emails), and other providers used to deliver the Services. Those providers process information under their own policies. We share only what is needed for the requested integration or required to operate and secure the Services.

Payments through Stripe

Purchases are processed by Stripe Payments Canada, Ltd. and its affiliates. Stripe collects and processes your payment information under its own Privacy Policy, and may use it to detect fraud and meet legal obligations. Stripe may process data outside Canada. We receive from Stripe only the purchase details described in section 1. We do not sell purchase information.

Live partner streams on the home page

When a community partner featured on the home page is live, their card can show their stream in Twitch’s embedded player, muted. Loading the player connects your browser to Twitch, which may set cookies and receive your IP address and device information under the Twitch Privacy Notice. For visitors identified by our hosting service as being in the United States or Canadian provinces and territories other than Quebec, the player starts on its own on larger screens. Everywhere else, for an unknown location, or if your device asks for reduced motion, it loads only after you press Watch here. On phones, and when no partner is live, no Twitch content is loaded.

Google Analytics cookies

When analytics is on, we use Google Analytics 4 to measure visits to this website and the dashboard, sessions, which dashboard sections get used, whether dashboard saves succeed, and clicks on sign-in links. Google receives a cookie identifier and browser/device information, and processes your IP address to derive approximate location. We send the website page address (keeping only campaign utm_ tags from the query string), the referring page, and for the dashboard a fixed URL plus section names; we do not include Twitch identities, emails, form contents, chat messages or private overlay links in these events. Advertising personalization is disabled. Google's processing is described in its Privacy Policy.

For visitors identified by our hosting service as being in the United States or Canadian provinces and territories other than Quebec, the website and dashboard show a short notice with an Opt out control. Analytics starts after the notice has been visible for 15 seconds unless you opt out. For Quebec, other countries or an unknown location, analytics starts only after you allow it. The hosting service supplies approximate country/province information; the consent endpoint does not return or log your IP address or location. An automatic start is not saved as an explicit consent choice.

You can use RexBot with analytics off. Your explicit choice is remembered in this browser, and you can change it using the notice or under Legal & privacy. Existing opt-out choices remain off. Turning analytics off stops further measurement from this integration and removes its analytics cookies; it does not erase information already received by Google. Browser-source overlays and embedded editors are excluded from this tracking.

5. Retention and deletion

We retain configuration and connection data while it is needed to provide the Services. You can disconnect integrations at any time. To request deletion of your account data, email rexbotapp@gmail.com from the email address on your Twitch account — we'll delete your account data within 30 days. Deleting your account data does not remove purchase and refund records, which we keep for as long as tax, accounting and chargeback rules require (generally up to six years), after which they are deleted or anonymized. Stripe keeps its own records under its policy. Operational backups and security logs may remain for a limited period. The RexBot issue tracker is for bug reports, not account or data requests, since issues there are public.

6. Children

The Services are not directed to children who are below the minimum age required by the platforms they use. If you believe a child has provided personal information, contact us so we can review it.

7. Changes

We may update this policy as the Services change. The effective date above identifies the current version.

8. Your rights

You can ask to access, correct, or delete your data, or withdraw your consent to feature-news emails, at any time. Email rexbotapp@gmail.com and we'll take care of it. Account deletion specifically is handled the same way — see Section 5.

9. Contact

Questions about this policy can be sent to rexbotapp@gmail.com. Brandon Deurbrouck (everex), Alberta, Canada, is responsible for privacy at RexBot. General contact options are listed at everexmedia.ca.