Privacy Policy

Last updated 22 September 2026

This policy explains what personal data Devotions collects, why, who sees it, how long we keep it, and your rights. It covers visitors, people who pay creators (as a guest or signed in), supporters and creators.

The short version

You can pay a creator as a guest. You don't need an account.
We never show a supporter's Google name, photo or email address to the public or to creators.
Names and messages you send with a tribute go only to that creator.
We publish your alias and totals on a creator's leaderboard only if you tick the box for that creator.
We never see your full card number. Stripe handles it.
No advertising, no tracking cookies, and we never sell your data.

Who we are

[operator's legal name: to be added] runs Devotions and is the controller of your personal data. Contact us about anything in this policy at [support email address: to be added]. Our full details are at the end of this page.

Creators see some information about the people who pay them (listed below). What a creator does with it outside Devotions is their own responsibility.

What we collect, why, and our legal basis

If you sign in with Google

From Google we get your name, email address, profile photo and Google account ID. Supabase runs sign-in for us. We never see your Google password.
We don't keep your Google name or photo on your profile once you've set up your account, and we never show them to anyone. A creator types the page name they want, and a supporter picks an alias.
We also record whether you're a creator or a supporter, when you confirmed you're 18 or over, and when you accepted our terms and which version.
Why: to create and secure your account and to check you're old enough. Legal basis: our contract with you, and our legitimate interest in keeping under-18s off Devotions.

If you're a creator

Your page is public: your username, page name, bio, pictures, links, games, channel link and whether you're live.
Stripe collects your identity and bank details directly. We receive your Stripe account ID, country and currency, and whether you can take payments and receive payouts.
For your overlays we keep a secret overlay address and the time each overlay source last checked in. For your analytics we count page views and link clicks per day, without recording who viewed or clicked.
Legal basis: our contract with you.

When you pay a creator

The amount, fee, currency, time and status of each payment, and any refund or dispute.
From Stripe: the email address you gave at checkout, and three facts about your card: a card fingerprint (a code that recognises the same card without revealing its number), whether it's a credit, debit or prepaid card, and the country that issued it. We use the email address to send you the confirmation of your payment and, for a run, to tell you if the charge at the end of it fails.
A record of your consent: the prices and maximum you were shown, the boxes you ticked, the terms version, the time, and your IP address and browser details when you paid.
For a game: each play's result and time, who pressed play, and, if you played it yourself, the IP address and browser details of the device that pressed play.
If you dispute a payment with your bank, we send the bank, through Stripe, the evidence we hold about that payment: your consent record (including the IP address and browser details from when you paid), the prices, outcomes and chances you were shown, and the log of plays.
What you type: the Twitch username for a run on stream, a player name for a run you play yourself, and a name and message with a tribute. Anyone can type any name, so please don't type someone else's.
If the charge at the end of a run fails, we record the card fingerprint and, if you were signed in, your account, so the same card or account can't start another run with that creator until the amount is paid.
Why: to take your payment and run your game, to keep accounting records, to prevent fraud, and to answer refund requests and disputes. Legal basis: our contract with you, our legal obligations to keep financial records, and our legitimate interests in preventing fraud and defending disputes.

Saved cards

To take the charge at the end of a run, Stripe saves your card on a Stripe customer record. We never see or store the card number.
If you paid as a guest, we remove the card from Stripe after the run is paid for, refunded or closed.
If you're a signed-in supporter, Checkout may offer to save your card for next time. We keep a card you chose to save until you ask us to remove it or delete your account.

Aliases, leaderboards and donation walls

A supporter can choose an alias (a nickname). It becomes public only on the pages of creators whose box you ticked.
For each creator, you choose whether to appear on their leaderboard and donation wall. The box is never ticked for you, and you have to confirm you're 18 or over first. We record which version of the wording you agreed to and when.
You can untick the box at any time, on the creator's page or on your account page (/me), and your alias leaves that creator's page and overlays straight away. “Remove me from every wall” on your account page hides you from every creator at once and withdraws every box you ticked; turning the switch back on doesn't tick them again. We can't recall screenshots that other people took earlier.
We show only your alias, your rank and your total for that creator, and a picture only if you uploaded one yourself. Guests are never ranked. Payments from guests, and from supporters who haven't ticked the box, show on the wall only as "Anonymous" with the amount and time.
A record of tributes to a creator in this niche could reveal something about your sex life, which the law treats as special category data. That's why we publish it only with your explicit consent, and why you can always pay as a guest or mark a payment as anonymous. Legal basis for publishing: your explicit consent, which you can withdraw at any time.

Reports and complaints

When you report something or complain, we keep the reason, the details, the page it's about and your email address if you give it.
Legal basis: our legal obligations under the Online Safety Act 2023, and our legitimate interest in keeping Devotions safe.

Technical data

To stop abuse, we count requests per IP address. We store only a one-way hash of the address, never the address itself, and delete it after 8 days.
We keep copies of Stripe's payment notifications for 30 days to make sure each is processed exactly once.
Our hosting providers keep short-lived logs of requests, including IP addresses: Vercel for about a day, and Supabase for up to 7 days.
Legal basis: our legitimate interests in keeping Devotions secure and working.

Stripe processes every payment and checks creators' identities. For some purposes, such as fraud prevention and meeting its legal duties, Stripe is a controller in its own right. See Stripe's privacy policy.
Supabase hosts our database, sign-in and file storage, in the European Union.
Vercel hosts the website. Our server code runs in the European Union, and Vercel's network delivers pages from locations near you.
Google signs you in if you choose Google, and plays YouTube videos on creator pages if you press play. Pages that show a game, and OBS overlays, load the game's font from Google Fonts, so your browser sends Google its IP address and browser details when such a page opens (see Cookies).
Resend sends our emails: your payment confirmations and notices about a failed charge. It gets your email address and the text of the email.
The creator you pay sees, for a run: the Twitch username or player name you gave, the results, the amounts and the times. For a tribute: your name (unless you chose anonymous), your message, the amount and the time. We don't give creators your email address, card details or Google details.
The creator's audience sees your Twitch username on stream during your run, unless the creator hides names. Streams can be recorded. If you opted in, they also see your alias and total on that creator's leaderboard.
Advisers and authorities: our accountants and lawyers, and the police, regulators or courts when the law requires it or to protect someone from harm.
A buyer of our business, if we sell it, who must keep to this policy.

We don't sell your data, and we don't use it for advertising.

Transfers outside the UK

We store your data in the European Union (Supabase in Frankfurt, and our server code runs in Frankfurt too). The UK recognises the EU and the EEA as giving adequate protection under its adequacy regulations, so no further safeguards are needed for that.

Stripe, Google, Vercel and Supabase are, or belong to, US companies, so some of your data may be processed in the United States. Where that happens, it's protected by the UK's adequacy regulations for the country or company involved, or by the UK International Data Transfer Addendum to the EU standard contractual clauses.

How long we keep it

Your account: until you delete it. If payment records mention your account, we keep your sign-in record (your Google account ID and email address) with them for as long as we keep those records, below, and use it for nothing else.
Payment, consent and run records, including the IP addresses and browser details in them: 6 years after the end of the financial year in which you paid, because tax law requires it and disputes can arrive long after a payment.
Leaderboard consent records: as long as your consent is active, then 6 years, so we can show what you agreed to. If you delete an account that has no payments, its consent records are deleted with it.
Reports and complaints: 3 years after we close them.
Hashed IP addresses for abuse limits: 8 days. Stripe notification copies: 30 days.

Deleting your account

Supporters can delete their account on their account page (/me), and creators in Dashboard settings. You can also email [support email address: to be added] from the address on your Google account. We delete your pictures, your saved cards and your profile. If you've made or received payments, we keep the payment records the law requires, but remove your profile details, alias and page. We also keep your sign-in record (your Google account ID and email address) with those records, only to show whose payments they were, for as long as we keep them; the account itself can no longer be used.

Your rights

Under UK data protection law you can ask us to:

give you a copy of your personal data,
correct it,
delete it,
restrict how we use it, or stop using it where we rely on our legitimate interests,
give you the data you gave us in a format you can move elsewhere.

You can see your own payment history on your account page (/me). You can withdraw your consent at any time. For leaderboards, untick the box. If the charge at the end of a run failed and a card or account is blocked from new runs, you can ask a person to review that decision.

Email [support email address: to be added]. We reply within one month. We may ask you to confirm who you are, for example by writing from the email address you used.

If you're unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Security

Connections to Devotions are encrypted. Payment records can only be read by our server, not from your browser, and we give each person the least access they need.

Children

Devotions is not for anyone under 18. If we learn that an account belongs to someone under 18, we close it.

Cookies

We use only the cookies we need to sign you in and to let you play the run you paid for. The Cookies page lists them, and explains YouTube videos.

Changes to this policy

When we change this policy, we update this page and the date at the top.

Contact us

Operator: [operator's legal name: to be added]
Address: [operator's postal address: to be added]
Email: [support email address: to be added]
Website: devotions.vercel.app