Privacy Policy

What we collect

• Access requests: your Twitch login, email address, the message you write and the language of the page.
• Account: your Twitch user ID, login, display name, role and interface language. Sign-in asks Twitch for no permissions and gives us no email address or password. The Twitch token from sign-in is used once to confirm your identity and is not stored.
• Connections: for DonationAlerts, your account ID and name and the access tokens, stored encrypted. For Twitch chat, the public IDs and logins of your channel and of the bot account and the permissions granted. We do not store Twitch tokens.
• Viewer content on your channel: donations (donor name, amount, currency and message), Twitch chat messages and channel-point redemptions, the replies the character generates and their audio.
• Viewer memory: facts and conversation history the character derives from donations and chat, linked to a viewer's Twitch or donor name.
• Desktop app: recognized text of what you say to the character and, while you are live, of what you say on air. Speech is recognized on your computer, and no audio is sent. Until the app has learned your voice print, this text can include other people who speak near your microphone. The app also keeps the history of your conversations with the character and a voice print on your computer (see “Voice print”).
• Visit statistics: the pages you open on riffaro.app and app.riffaro.app, the referring site, your browser, operating system, device type, screen size, language and time zone, and on riffaro.app the buttons and links you click. The web application sends page addresses without their query and fragment and records no clicks. These statistics are not linked to your account and use no cookies or browser storage.
• Technical data: diagnostic events (operation names, identifiers, durations and error codes, without message text or audio), server logs and IP addresses used to limit sign-in attempts.

How we use it

We use the data to run the service: to sign you in, to generate and voice the character's replies, to remember viewers for your channel, to protect accounts from abuse and to find and fix failures. We use access requests only to decide on access and to write to you about it.

We use visit statistics only to learn which pages and features people use. We do not sell personal data, do not show advertising and do not use advertising trackers.

Services that receive data

• Hetzner hosts our server in Helsinki, Finland.
• Cloudflare provides DNS, stores our encrypted backups and the desktop installers in its EU storage region, and serves the desktop app updates that the app checks for.
• OpenRouter, and the model providers it routes requests to, receive the text needed to generate a reply: donation and chat messages, conversation text and relevant memory. OpenRouter also computes the text embeddings used to search memory.
• TypeSafe receives chat and stream context, donation messages, what you say to the character and on air, memory text and generated replies to make structured decisions, such as whether the character should speak or whether a message is safe to voice.
• ElevenLabs receives the text of a reply to synthesize its voice.
• PostHog (EU region) receives the visit statistics through our server. It counts unique visitors by a hash of the IP address, browser and site with a key that changes every day, so a visit on one day cannot be linked to a visit on another day.
• Langfuse (EU region), when enabled, records prompts and replies with your account ID so that we can check the quality of replies. Prompts contain the same text that OpenRouter and TypeSafe receive, including viewer names and messages and what you say.
• Twitch and DonationAlerts exchange data with Riffaro when you connect them. Their own privacy policies apply to your accounts there.
• GitHub serves the speech models that the desktop app downloads; it receives only the download request.

Some of these providers process data in the United States and other countries outside the EU.

How long we keep it

Data is deleted after the periods below. Deletion runs in the background, so data can stay somewhat longer than the stated period.

• Donations, reactions and their delivery records: 90 days after the donation is completed or cancelled. Per-currency running totals are kept without names or messages. The donor's name and message also go to the character's memory (see below).
• Audio of reactions: 7 days.
• Desktop conversation turns: 7 days; the fingerprints used to detect repeated messages: 90 days. What you say to the character and its replies also go to the character's memory. The history in the desktop app stays on your computer until you clear it.
• What you say on air and the recent chat: held in the server's memory for up to 10 minutes. Short excerpts of them are saved as the channel's chat moments.
• The character's memory, including what it learned from donations, chat and conversations, and the channel's saved chat moments: no fixed period. When the streamer forgets a viewer, the moments with that viewer's Twitch account are also removed.
• Auction bids (viewer name, message and amount): no fixed period.
• Access requests: 90 days after the decision.
• Sessions: 7 days after sign-in.
• Backups: encrypted snapshots are kept for up to 30 days, so deleted data can remain in them for that long.
• Server logs: rotated by size and overwritten.

Voice print

The desktop app learns a voice print automatically, from the voice it hears most in the first minutes of speech, so that it can tell your voice from other voices in the room. The voice print is a set of numbers computed on your computer. It is stored only on your computer, is never sent to us or to anyone else, and no audio is kept to create it.

The voice print is deleted when you press “Forget voice” in the app settings, when you change the microphone, or when you delete the app's data. We do not use it for any other purpose.

If you are a viewer

When you donate or write in the chat of a channel that uses Riffaro, your name and message reach the character so that it can answer and remember the conversation. The streamer can view, correct and forget what the character remembers about you. You can also write to us to see or delete your data; we may ask you to prove that the account is yours.

Your rights

Depending on where you live, you may have the right to access your data, to correct it, to delete it, to receive a copy, to restrict or object to its processing and to withdraw consent. Riffaro does not yet let you delete your account or export your data yourself. To use these rights, write to us at the address below. We answer within 30 days.

If you are in the EU or the UK, you may also complain to your data protection authority. If you are in California, you have the right to know, delete and correct personal information; we do not sell or share it for cross-context behavioral advertising.

Cookies

• riffaro_session keeps you signed in for 7 days.
• riffaro_twitch_state protects Twitch sign-in for 10 minutes.
• riffaro_locale remembers your language for up to 400 days and is shared between riffaro.app and app.riffaro.app.

All of them are needed for the service to work. We use no other cookies. The web application also keeps one entry in your browser storage: that you have hidden the introduction card on the Live screen.

Security

All connections use HTTPS. Connection tokens are encrypted, only hashes of session tokens are stored, and backups are encrypted before they leave the server.

Age

Riffaro is for streamers who are at least 18 years old. We do not knowingly create accounts for younger people.

Changes and contact

When we change this policy, we update the date at the top. We announce significant changes on this page before they take effect.

Questions and requests: privacy@riffaro.app.