Privacy Policy
Information on how we handle your data
1. Data Controller
The data controller for this website is:
Timo Schwertfeger
c/o IP-Management #11071
Ludwig-Erhard-Straße 18
20459 Hamburg
Germany
Email: hello@chatstonks.com
A Data Protection Officer is not appointed, as the requirements under Art. 37 GDPR are not met.
2. Data We Collect
- Account data: Username, email (provided by Twitch for Twitch sign-in, entered directly by you for email sign-in), profile picture, Twitch ID (if available)
- Usage data: Trades, portfolio, posts, comments, votes
- Technical data: IP address, browser type, access times
- Content data: User-generated posts and comments
3. Legal Bases
- Consent (Art. 6(1)(a) GDPR): Twitch OAuth login
- Contract performance (Art. 6(1)(b) GDPR): Platform services, account management, trading, posts
- Legitimate interest (Art. 6(1)(f) GDPR): Abuse prevention (including storage of a peppered SHA-256 hash of your email address to enforce sign-up limits), server logs, platform stability
4. Processing Details
Registration (Twitch OAuth)
We collect: username, email, profile picture, Twitch ID, and followed channels. Legal basis: consent. Retention: until account deletion.
Email Sign-In
When you sign in via email, you provide us with your email address and optionally a desired username. We deliver a sign-in link to that address through our processor Brevo (Sendinblue, France). The email address is stored in Supabase for account management. Legal basis: contract performance (Art. 6(1)(b) GDPR). Retention: until account deletion.
For abuse prevention, we also store a peppered SHA-256 hash of your email address in a separate table (signup_attempts). The email address cannot be reconstructed from this hash. The hash is retained after account deletion so that sign-up limits remain effective. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Platform Usage
We store: trades, portfolio data, posts, comments, and votes. Legal basis: contract performance. Retention: until account deletion.
Technical Data
Automatically collected on each visit: IP address, browser type, access time. Legal basis: legitimate interest. Retention: 30 days (Vercel server logs).
Server-Side Analytics
We use PostHog server-side in our data pipeline for operational monitoring. No user browsing data is collected. Legal basis: legitimate interest.
5. Cookies and Local Storage
We use only technically necessary cookies and local storage. A cookie consent banner is therefore not required (Section 25(2) TDDDG).
| Storage | Purpose | Duration |
|---|---|---|
| Supabase Auth Cookie | Session authentication | Until logout |
| sidebar-* (localStorage) | Sidebar layout preference | Permanent |
| pending_consent (localStorage) | Consent state during sign-in | Cleared after login |
6. Third-Party Services
| Service | Purpose | Location | Safeguard |
|---|---|---|---|
| Supabase | Database and authentication | EU (Frankfurt) | DPA |
| Twitch (Amazon) | OAuth login and API data | USA | EU-US DPF |
| Brevo (Sendinblue) | Sign-in email delivery | France (EU) | DPA |
| Vercel | Web hosting | USA | EU-US DPF, DPA |
| Hetzner | Pipeline server | Germany | DPA |
| PostHog | Server-side operational analytics | EU | DPA |
7. International Data Transfers
Data is transferred to Twitch (Amazon, USA) and Vercel (USA). These transfers are covered by the EU Commission's adequacy decision on the EU-US Data Privacy Framework (DPF) of July 10, 2023.
8. Your Rights
Under the GDPR, you have the following rights:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR): you can delete your account at any time in your settings
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR): a data export is available in your settings
- Right to object (Art. 21 GDPR)
- Right to withdraw consent (Art. 7(3) GDPR): you can revoke Twitch OAuth access at any time in your Twitch settings
To exercise your rights, contact hello@chatstonks.com.
You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Straße 22, 20459 Hamburg.
9. Data Retention
- Account data: until account deletion
- Usage data (trades, portfolio, posts): until account deletion
- Hashed email address (signup_attempts): retained after account deletion (abuse prevention)
- Server logs (Vercel): 30 days
- Pipeline analytics (PostHog): per PostHog retention policy
10. Automated Decision-Making
No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.
11. Minors
Use of ChatStonks requires a minimum age of 16 (Section 7 BDSG). We do not knowingly collect data from persons under 16.
12. Changes
We may update this privacy policy as needed. Material changes will be communicated via the platform.
Last updated: 16 July 2026