Privacy & Security
What we collect, why we use it and how you can exercise control over your data.
1. Who is responsible
This policy covers spgames.dev, its studio pages, demos and contest accounts. The operator responsible for personal data is:
SP Games · Independent developer (individual)
2. Data we process
When you browse, our servers receive your IP address, requested URL, time, browser information and technical error information. If you sign in using Kick or Telegram, we receive the provider account identifier and display name. For Kick, we also store the profile picture URL to show your avatar in your account. We do not receive your provider password and do not retain OAuth access tokens.
You may provide a Stake username, a payout wallet address, bet-receipt links, Kick video links and timestamps. We keep entry details, verification evidence, moderation decisions, tickets, rewards, payment references and an audit history of profile changes. A wallet address and public blockchain transactions may be linked to an individual.
To verify ownership of a Stake account, we store your challenge target and expiry, verification bet identifier, check result and the Stake account identifier returned with the public bet. We do not request your Stake password or API key.
3. Purposes and legal bases
We use account and entry data to provide the features you request, check eligibility, administer contests and arrange rewards under their published rules. Where applicable, this processing is necessary to perform our agreement with you. Our legitimate interests in securing the site, preventing duplicate or fraudulent entries and resolving disputes support proportionate security logs, verification and audit records. We also process records when required by applicable law.
We do not use this cookie notice as consent to advertising, sell personal data or use advertising or analytics trackers on the studio website.
5. How long we keep data
Account data is retained while the account is used or needed to settle its entries and rewards. Contest evidence, payout and audit records are kept for the period needed to complete verification, pay rewards, resolve disputes and meet applicable record-keeping duties. The relevant contest, any open dispute and applicable legal obligations determine that period; it is not automatically the lifetime of a cookie. Contact us to request deletion or the retention criteria for a particular record.
Session access expires after 30 days; sign-in challenges expire after 10 minutes. Expired database records are cleaned during later sign-ins. Web access logs rotate daily with 14 retained rotations; other service or incident records may have different retention. Cookie lifetimes are listed in the Cookie Policy.
6. Security and reporting
We use HTTPS, restricted administrator access, protected session cookies, request validation and access controls. No internet service can promise absolute security. Keep your provider account secure and sign out on shared devices. We will never ask you to send a Stake password, wallet seed phrase or private key to enter a contest.
Report suspected vulnerabilities to the contact above with the affected URL and a minimal description. Do not access another person’s account, copy personal data or disrupt the service. This reporting channel does not authorise intrusive testing.
7. Your rights and contact
Depending on applicable law, you may request access, correction, deletion, restriction or portability of your data, object to certain processing and complain to the competent data protection authority. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. Some rights have exceptions. We may request proportionate information to verify your identity. Under GDPR, requests are normally answered within one month, with any permitted extension explained.
Receipt checks and contest scoring use automated rules. You can ask us to review an entry decision and explain the result. The site is intended for adults aged 18 or above, or the higher minimum age required locally. Contact us if you believe we hold data about a child. Changes to this policy are dated on this page.
Support chat and browser storage
The support chat is provided through StreamerPlatform / Torro Widget (get.strplatform.com). It connects when a public page loads, including before you open the chat. The service receives technical connection information, the page URL and, when available, the referring page URL, and creates a chat session. Messages and attachments you choose to send are processed by the service to answer your enquiry, including with an AI assistant. When you are signed in, our server sends your permanent SP Games account ID and display name in a signed token valid for up to one hour, so the chat can recognise you across devices. We do not automatically send payout details, balances or contest entries. Signing out resets the chat identity on this browser. Do not send passwords, sign-in codes or wallet secrets in chat. You can also contact support@streamerplatform.com by email.
The site also stores the current chat account marker (sp_support_subject_v1) in localStorage to reset the chat on sign-out or account changes, and whether the help suggestion was shown (sp_support_hint_v1) in sessionStorage for this tab. JWTs are not stored in either. The widget stores a visitor identifier in this site’s localStorage under torro_widget_visitor_id:<widget key> to continue the conversation across pages and visits. This is browser storage, not a cookie; the current widget sets no automatic expiry for this identifier. You can remove it by clearing this site’s browser data, which may disconnect you from the previous conversation. Clearing browser data does not delete messages held by the service. Contact us to request deletion or information about chat-record retention. Dismissing the cookie notice only records that you have read it; it is not permission for advertising or analytics.
Multiple-account checks
To review potential multiple accounts, we compare payout wallets, invitation relationships, and keyed hashes of IP addresses and random browser identifiers. Raw IP addresses are not stored in the antifraud database. IP and browser signals are kept for up to 90 days since their last observation; invitation and reward records and moderation decisions are retained with contest and audit records under the retention rules above. These signals are visible only to administrators. A match does not automatically cancel rewards: an administrator reviews the evidence. Cookies sp_device and sp_referral are described in the Cookie Policy.