About this Policy
This Privacy Policy (the “Policy”) explains what personal data of users the BardWay service processes, why and on what basis, where and for how long it is kept and how you can control it.
The Policy covers the whole BardWay service: the website bardway.com, the Twitch extension, the pages for OBS and the chat bot. This version is for users outside Russia, Armenia, Azerbaijan, Belarus, Kazakhstan, Kyrgyzstan, Moldova, Tajikistan, Turkmenistan and Uzbekistan; the other versions open from the region switcher at the top of the page.
The operator and the Service’s servers are in the Russian Federation, so personal data is processed under Russian law, including Federal Law No. 152-FZ “On Personal Data”. The Policy is published at bardway.com/docs/en/privacy and is in force until replaced by a new version.
Who is responsible for your data
Your data is processed by Evgeniy Igorevich Telegin (Телегин Евгений Игоревич), an individual registered in Russia as self-employed under the professional income tax regime (the “operator”, “we”, “us”). The operator decides on the purposes of processing and on the data processed and is personally responsible for how it is processed.
Contact: info@bardway.com. We give a postal address for letters on request to this e-mail. More on the page “Operator information”.
Definitions
- Personal data — any information that relates directly or indirectly to a particular person.
- Processing — any action with personal data: collecting, recording, storing, using, deleting and so on.
- Publication — making data available to anyone, for example by showing it on the website.
- User — a person with a BardWay account: a streamer, an administrator of a streamer’s project or a viewer.
- Platform — a streaming or social platform: Twitch, YouTube, VK.
- Sign-in method — what you use to sign in to your account: e-mail and password, VK ID, Twitch or Google.
- Identity confirmation — linking one Twitch, YouTube or VK account to your BardWay account so that we can show your platform nickname with a “confirmed” badge. On its own it is not a way to sign in and does not create an account. Signing in with Twitch, Google or VK ID, connecting a platform account and merging accounts confirm your identity with that account (a Google account counts as YouTube) if it has not been confirmed yet.
- Connecting a platform — linking a Twitch or YouTube channel to a streamer’s project so that the bot and stream start detection work. When a streamer signs in with Twitch or Google, the Twitch or YouTube channel of that account is connected to their project if no channel of that platform is connected yet.
Whose data we process
- users of the Service: streamers, administrators of their projects and viewers;
- visitors of the website without an account — technical data and cookies;
- viewers who request songs or vote without an account: on the website by a random browser identifier, in the Twitch extension panel by the identifier Twitch provides;
- viewers in a streamer’s chat who use the bot’s commands, and donors — their data comes from the platforms and donation services the streamer has connected;
- people who send complaints, including rights holders and their representatives;
- people who write to us through the feedback form or by e-mail.
What data we process
Account. Your e-mail address, if you have added one: you sign in with it using a password, and confirmation codes and service e-mails are sent to it. A password hash: we do not store your password or write it to logs; we keep only the result of its one-way transformation (Argon2id). The username in the address of your pages (the Service creates it). The display name: by default, the nickname of the platform that confirms your identity, with a badge; for VK this is the first and last name, for YouTube — the Google account name. “Anonymous” if you choose it in the settings or your identity is not confirmed. Visitors of the page of a streamer you requested a song from can see the display name (see “Who can see and receive your data”). Time zone, country, whether you are a streamer. The date and version of the rules you accepted and the date of your consent to the public profile.
Platform accounts. When you sign in with VK ID, Twitch or Google, confirm your identity or connect a platform, the platform, with your permission, gives us the account’s data: its identifier, nickname or display name (for VK — the first and last name from the VK profile, for Google and YouTube — the Google account name) and profile picture. From a Twitch nickname we build the link to the channel. We copy the profile picture to our server in Russia (at most 256 pixels, without metadata) and show this copy; we keep the address of the original picture to refresh the copy. We do not store the e-mail address of the platform account. We also keep track of which account confirms your identity and which accounts are connected as sign-in methods and as platforms.
Platform access tokens. When you sign in or connect a platform, the platform issues access tokens. On the streamer’s instructions the Service uses them to work in the streamer’s channel: the bot replies in the chat, the Service learns when a stream starts, and the Twitch extension checks followers and subscribers for request limits. Tokens are never shown to anyone and are used only by the Service’s programs.
Public profile. What you fill in yourself: first name, last name, country, city, languages, the “About” text, instruments, favorite songs, links. Visitors see the profile only after your separate consent to publication.
Streamer’s project. The song catalog (titles, artists, notes, links, lyrics and chords), the page design (images, title), settings, the request queue and history (who requested which song and when), “Learn a song” voting, song presets, notifications.
Data from chat, the extension and donations. A viewer’s nickname in the platform chat and the command text when they address the bot (for example, to request a song). The viewer identifier Twitch provides when a viewer requests a song in the extension panel — for request limits. From the donation services the streamer has connected (for example, DonationAlerts) — the name the donor entered, the amount and currency of the donation and, from the message, the song title or a voting code.
Donation services connected by a streamer. The identifier and name of the streamer’s account with the service, the link to their donation page and an access token — to receive donations into their project.
Technical data. IP address and browser information (User-Agent) in the records of sign-in sessions. Logs of sign-in and security events: user identifier, IP address, time and result. The country and city the server determines from the IP address. A random anonymous viewer identifier the browser creates for request and vote limits. Cookies and data in browser storage — see the Cookie Policy.
Account activity log. When you accept the rules, give or withdraw your consent to the public profile, change or reset your password, add an e-mail address, remove a sign-in method, merge accounts or confirm your identity (including when it is confirmed on its own — when you sign in, connect a platform account or merge accounts), we record the kind of action, the time, the IP address and browser information (User-Agent). For some actions we also record details: the region and the edition dates of the documents you accepted or of the consent text, the platform that confirms your identity and whether it was confirmed automatically, the sign-in method removed, the identifier of the account merged into yours. Passwords, codes, tokens and e-mail addresses are never written to this log.
Complaints. The complaint text, the page link, the sender’s e-mail (required for rights holders), the account identifier if the sender is signed in, a hash of the IP address (we do not store the address itself), a snapshot of the reported page design and the consent mark. In the form, a rights holder gives the name of the rights holder. A rights holder’s formal notice comes by e-mail and contains the information required by Russian law (Article 15.7 of Federal Law No. 149-FZ): for an individual — full name, passport or other identity document details and contacts, for a representative — a document confirming their authority.
Inquiries. Name, who you are (streamer, viewer, company), topic, the contact for our reply — e-mail or a Telegram or Discord username, as you choose — and the message text from the feedback form or an e-mail.
We do not process special categories of personal data (racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sex life, criminal records) or biometric data. Profile pictures are not used to identify anyone. We do not collect phone numbers, except when someone chooses to give one in a notice or an inquiry. We do not accept payments at the moment.
Why we process data and on what basis
We process data only for the purposes below. For each purpose we name the basis in plain terms.
- Account, signing in and sessions — account data, sign-in methods, session records. Basis: providing the Service under our agreement with you (the Terms of Service).
- Identity confirmation and connecting platforms — platform account data and tokens. Basis: our agreement with you.
- Streamer tools — the catalog, the request queue and history, the bot, the Twitch extension, the pages for OBS, “Learn a song”, donations, presets, notifications. Basis: our agreement with the streamer and the viewer; for chat nicknames and donor data that the Service processes in the streamer’s channel under the streamer’s settings — our legitimate interest in running the tools the streamer has connected, as long as it does not infringe the rights of these people.
- Public profile — profile data. Basis: your separate consent to publication. While the profile is hidden, the data is kept for you under our agreement.
- Region and how the site is shown — the region from your IP address: it determines the language, the price currency, the version of the documents and the sign-in methods available in your country. Basis: our legitimate interest.
- Security — protection against password guessing, spam and abuse, investigating failures and incidents: IP addresses, browser information, logs. Basis: our legitimate interest.
- Proof of consents and account protection — the account activity log: to show that you accepted the rules or consented to the public profile and when you withdrew that consent, and to look into changes to your account that you did not make. Basis: our legitimate interest; the operator has to be able to prove that consent was obtained (Part 3 of Article 9 of Federal Law No. 152-FZ).
- Complaints, moderation and rights holders’ notices. Basis: our legal obligations under Russian law (Article 15.7 of Federal Law No. 149-FZ and Article 1253.1 of the Civil Code of the Russian Federation) and our legitimate interest; the sender’s e-mail — their consent, given with the tick in the form; the details in a rights holder’s formal notice — the sender’s consent, which the notice must contain.
- Service e-mails and replies to inquiries — confirmation codes, password reset and change, linked accounts, moderation decisions. Basis: our agreement with you; replies to inquiries — our legitimate interest.
- Legal requirements — replies to lawful requests of public authorities and courts. Basis: a legal obligation.
We do not use data for advertising or marketing e-mails, do not analyse user behaviour and do not sell data. If such a purpose ever appears, we will ask for your separate consent.
We do not make decisions with legal effects for you by automated means alone. The page design or a profile is hidden automatically after complaints from two different people, but only until a person reviews it; measures are decided by a person.
How we process data
We collect, record, organise, accumulate, store, update and change, retrieve, use, disclose (only in the cases described in “Who can see and receive your data”), restrict, delete and destroy personal data.
Processing is automated, with transmission over the internet. We do not process data without automated means.
Where your data is stored
Your data is stored on servers in the Russian Federation. The data of all users, including users from other countries, is recorded and stored in databases on the servers of the Russian hosting provider Beget in Moscow and Saint Petersburg. Backups and logs are kept there as well. When you use the Service, the data you enter and the technical data of your browser are sent to the operator in Russia.
Beget provides the servers and the mail service for sending e-mails and processes data only as part of these services, on the operator’s behalf. Only the operator has access to the databases and servers.
Who can see and receive your data
- Public pages. A streamer’s page (the song catalog, the page design, the streamer’s name and profile picture) is open to everyone — that is how the Service works. The request queue and history on a streamer’s page are also open to all visitors and show who requested a song: a website viewer’s display name as it is now, on their past requests too (by default, the nickname of their confirmed platform with a badge — for VK this is the first and last name, for YouTube the Google account name; if they chose “Anonymous”, no name is shown), a viewer’s nickname from the chat and the name a donor entered. The home page shows active streamers: name, profile picture and a link to the page. A public profile is visible to everyone only with your consent.
- The streamer and their administrators also see the service identifiers of requesters in the queue and history (for limits and editing requests) and who voted in “Learn a song”. We do not tell the streamer who sent a complaint, except for rights holders: we may tell the streamer the rights holder’s name and the substance of the claim.
- The streamer’s chat and stream. On the streamer’s instructions, the streamer’s bot posts messages in the chat of their channel on the platform: replies to chat commands with the viewer’s nickname taken from the same chat, and messages about requests. If you requested a song on the website, your display name — by default, the nickname of your confirmed platform (for VK — the first and last name, for YouTube — the Google account name) — may appear in the chat of the streamer’s channel on any platform the streamer has connected, including Twitch or YouTube, on the streamer’s stream (the OBS page) and in the Twitch extension panel. If you chose “Anonymous” in the settings, “Anonymous” is shown there. If you do not want your nickname to appear in the chat and on the stream, choose “Anonymous” in the settings.
- Platforms. When you sign in with VK ID, Twitch or Google, confirm your identity or connect a platform, the data comes from the platform to us — we receive it, we do not send it. When the Service, on a streamer’s instructions, calls a platform with the streamer’s token (the bot, stream detection, follower and subscriber checks), it sends the platform identifiers received from that same platform and the text of the bot’s messages — which may contain a website viewer’s nickname as described in the previous item.
- E-mail and messengers. Service e-mails go to the address you gave; if your mailbox is with a foreign mail service, the e-mail is delivered through it. If you chose a reply in Telegram or Discord in the feedback form, we will write to you there at the username you gave, and the conversation will go through the messenger you chose. If you do not want this, choose a reply by e-mail.
- The sender of a rights holder’s notice receives the evidence that the material was posted lawfully and the streamer’s counter-notice with the documents the streamer attached (for example, a licence or an agreement). The streamer decides what to attach.
- The hosting provider Beget — on the operator’s behalf, see “Where your data is stored”.
- Public authorities and courts — only on a lawful request.
Your data reaches the operator in Russia and is kept there. We do not pass it on outside Russia: we do not disclose it to foreign authorities, do not engage anyone in other countries to process it and do not host it on servers outside Russia. Platforms, mail services and messengers outside Russia receive data only in the cases described above: in the messages of the bot that posts to the chat of a streamer’s channel on the streamer’s instructions, in e-mails to the address you gave, and in a conversation through the messenger you chose for our reply. The website and the OBS pages have no third-party counters, advertising or analytics scripts, third-party fonts or widgets; profile pictures are served from our servers. If we ever need to transfer data outside Russia, we will first meet the legal requirements and update this Policy.
How long we keep data
- The account, platform accounts, the public profile and project data — as long as the account exists. You can ask us to delete it by writing to info@bardway.com: the data is deleted within 30 days, except for the account activity log (see below) and information we are required to keep by law.
- Access tokens — as long as the platform account is linked to your account, and a donation service is connected to the project.
- Session records (IP address, browser information) — 30 days after the session ends; a session without activity ends after 7 days. Event logs — 30 days.
- The account activity log — as long as the account exists and 3 years after it is deleted: it proves consents and the acceptance of the rules if they are ever disputed.
- E-mail confirmation codes — 10 minutes, password reset links — 30 minutes; both are stored only as hashes.
- Country and city from the IP address — up to 3 days in the server cache and in a browser cookie.
- Copies of profile pictures — while an account or a preset shows them, then no longer than two days.
- Notifications in your account — 90 days.
- Complaints and decisions on them — up to 1 year from submission. Image files from the snapshot of a page design — until the review is complete.
- Inquiries — as long as needed for our reply, but no longer than 1 year.
- If an account is deleted for a violation with a ban on registering again — the platform account identifier and the reason, while the ban is in force.
- Database backups — 14 days; copies made before maintenance — no longer than 30 days.
When the purpose of processing has been achieved or you have withdrawn your consent and there is no other basis, we stop processing and destroy the data within 30 days. If this cannot be done at once, the data is restricted and destroyed within 6 months at the latest.
Your rights and how to use them
You have the right to:
- find out which of your data we process, why, on what basis, where it came from, how long we keep it and to whom it may be disclosed, and receive the data itself;
- ask us to correct, restrict or destroy your data if it is incomplete, outdated, inaccurate, obtained unlawfully or not needed for the stated purpose;
- withdraw your consent (to the public profile — with the switch on the profile page, to anything else — by e-mail) and ask us to stop processing;
- complain about our actions to Roskomnadzor (the authority protecting the rights of data subjects in Russia, where the operator is located) or to a court;
- contact the data protection authority of your country if its law provides for this.
You can do much of this yourself in the settings: change your display name and profile data, remove sign-in methods and platforms you no longer need, hide your profile. For anything else write to info@bardway.com. To let us make sure the request comes from you, write from the address in your account or give your username and the link to your page; if that is not enough, we will ask for more details. If you believe the law of the country where you live gives you further rights, say so in your request and we will review it.
We reply within 10 working days of receiving a request. This period may be extended by another 5 working days; we will tell you so and explain why. We correct inaccurate data, and destroy data obtained unlawfully or no longer needed, within 7 working days.
How we protect data
- the connection to the website is encrypted (HTTPS);
- passwords are stored only as Argon2id hashes and checked by a separate internal service that cannot be reached from the internet; passwords, codes and tokens do not get into logs;
- confirmation codes and password reset links are stored as hashes and expire; after a password reset all sessions end;
- the number of sign-in attempts, e-mails and complaints is limited, and after a series of failed attempts signing in is blocked for a while;
- bot tokens are stored encrypted; the IP addresses of complaint senders are stored only as hashes;
- only the operator has access to the servers and databases, and this access is protected; the servers are protected by a firewall;
- metadata is removed from copies of profile pictures;
- backups are kept for a limited time on servers in Russia.
If a data breach happens, we will report it to Roskomnadzor within 24 hours and report the results of the investigation within 72 hours, as Russian law requires, and we will warn the users whose data is affected.
Children
The Service is meant for users aged 14 and over, or from a higher age if the law of your country sets one for using such services. Users under 18 may use the Service with the consent of a parent or other legal guardian. If we learn that an account was created by a child below the minimum age, we will delete the account and its data. A parent can write to us at info@bardway.com.
Changes to this Policy
A new version of the Policy is published on this page with its date and applies from publication. We tell you about significant changes in the Service and ask you to read the new version the next time you sign in.
Contact
Send questions about the processing of personal data, requests and withdrawals of consent to info@bardway.com.