Privacy Policy

Last updated: August 4, 2026

Hunt Assist ("we," "us," or "our") operates the Hunt Assist service ("Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

1. Information We Collect

1.1 Information from Twitch OAuth

When you sign in with Twitch, we collect:

Twitch User ID — your unique identifier on Twitch, stored as provider_uid
Twitch Username — your login name (e.g., your_channel)
OAuth Tokens — access and refresh tokens used to communicate with Twitch's API on your behalf

We request the channel:read:redemptions and channel:manage:redemptions scopes (channel point redemption events and management). We do not collect your Twitch email address, profile picture, or other Twitch profile data.

1.2 Streamer Information

If you register as a streamer, you provide:

Username — your chosen display name within Hunt Assist
Channel Point Cost — how many channel points a loadout redemption costs (default: 100)
Slot Configuration — your preferred equipment loadout limits
Blocked Items — items you have blocked from appearing in your loadout catalog

This information is publicly visible to viewers of your channel page and overlay.

1.3 Viewer and Loadout Information

When a viewer submits a loadout during a stream session, we store:

Loadout Data — the equipment configuration the viewer selected, plus an optional title
Submitter Identity — for viewers who share their Twitch identity (via the channel page or the extension's optional identity sharing), their Twitch user ID and username; for everyone else, an opaque anonymous identifier that cannot be resolved to a person
Token Balance — a token balance keyed to the viewer's Twitch user ID for the stream session (tokens are only available to viewers who share their identity)

Viewers who verify their identity on a channel page also have a lightweight identity record (Twitch user ID and username) stored so we can recognize them across channels, along with signed identity cookies that expire after 24 hours. A viewer can remove this record at any time using the "Disconnect from Twitch" action on a channel page.

Loadout and balance data is tied to the stream session in which it was created.

1.4 Automatically Collected Data

Overlay Access Token — a unique token generated for each streamer to secure their OBS overlay
Session Timestamps — when sessions start and end
Redemption Records — channel point redemption events for audit purposes
Rate-Limit Data — a short-lived in-memory marker (expires after ~30 seconds) used to enforce submission limits; it is not retained

2. How We Use Your Information

We use collected information to:

Authenticate you via Twitch OAuth and maintain your session
Display your channel overlay with current loadout submissions
Process channel point redemptions for loadout requests
Serve the Twitch extension, including loadout submissions, token balances, and queue state
Broadcast real-time loadout updates via ActionCable (WebSocket)
Enforce streamer-configured limits (max loadouts, pending queue size, per-user caps, submission rate limits)
Block specific items from appearing in the catalog upon streamer request
Run raffles and priority-token draws when a streamer enables them

3. How We Store and Share Your Information

Information is stored on our own servers. We do not sell or rent your personal information, and we do not use advertising trackers.

We share information only in these limited cases:

Service Providers — vendors that help us operate the Service (such as our hosting provider). They are required to protect your data and may use it only for the purpose we engage them for.
Twitch — Twitch hosts the extension iframe, processes OAuth, and delivers channel point redemption and stream events to us. See §4 (Third-Party Services) below.
Legal Compliance — when required by law, regulation, or a valid legal request.
Your Consent — when you explicitly authorize us to share your information.

4. Third-Party Services

Twitch

We use Twitch for authentication. When you sign in, you are redirected to Twitch's OAuth portal. We exchange an authorization code for tokens that allow us to:

Read channel point redemption events for your channel
Identify your Twitch account
Receive EventSub webhook events for your channel (redemptions, stream online/offline)

Twitch's use of your data is governed by Twitch's Privacy Policy.

Twitch Extension

The Twitch extension runs inside Twitch's iframe and communicates directly with our servers. It uses a Twitch-issued token and, when the viewer opts in, the viewer's Twitch user ID. Anonymous extension users are identified only by an opaque identifier that Twitch guarantees cannot be resolved to a person.

WebSocket Transport

Real-time updates are delivered through ActionCable (Rails WebSocket). This data travels directly between our server and your browser and is not stored by third parties.

5. Data Retention

Data Type	Retention
TwitchAccount (tokens, IDs)	Until you revoke access or delete your account
Streamer profile	Until you delete your account
Viewer identity records (TwitchUser)	Until the viewer disconnects via a channel page
Stream sessions	Until your account is deleted
Loadout submissions	Until the related stream session is deleted (on account deletion); completed loadouts stay viewable on the dashboard until then
User balances and priority tokens	Until the related stream session is deleted (on account deletion)
Verification codes	Expired, unused codes are purged automatically; used codes are retained for audit

Redemption audit records may be retained longer for dispute resolution.

6. Data Security

We protect your data by:

Storing OAuth tokens encrypted at rest
Using HTTPS for all connections
Generating secure random overlay tokens (24-character alphanumeric)
Validating Twitch EventSub payloads to prevent spoofing

No security measure is infallible. While we strive to protect your data, we cannot guarantee absolute security.

7. Your Rights

Depending on your location, you may have the right to:

Access — request a copy of your personal data
Correction — request correction of inaccurate data
Deletion — request deletion of your account and associated data
Objection — object to certain processing activities

To exercise any of these rights, contact us at the email below. We will respond within 30 days.

California residents have additional rights under the CCPA. European Economic Area residents have rights under the GDPR.

8. Children's Privacy

Our Service is not intended for users under 18 years of age. We do not knowingly collect data from minors.

9. International Data Transfers

Hunt Assist is hosted in the United States. If you are located outside the US, your data will be transferred to and processed in the US, which may have different data protection laws than your country.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date.

11. Contact Us

If you have questions about this Privacy Policy, contact us:

Email: support@hunt-assist.xyz
Website: https://hunt-assist.xyz

← Back to Hunt Assist