Privacy policy
Last updated: 24 September 2026
This Privacy Policy describes how GString Bot ("we", "us" or "our") collects, uses, and protects your information when you use our website, dashboard, and bot service (collectively, "the Service"). By using the Service, you agree to the collection and use of information in accordance with this policy.
1. Information we collect
1.1 Information from platform sign-in (Twitch and Kick)
When you log in to the Service using Twitch or Kick OAuth, or link an additional platform account, we receive and store the following information from that platform account:
• Platform user ID (unique identifier)
• Username and display name
• Profile picture URL
• Account type and broadcaster status (Twitch)
When you authorise the bot to operate on your Kick channel, we also store the OAuth access and refresh tokens needed to act on your behalf. These tokens are encrypted at rest (AES-256-GCM) and are deleted when you unlink the platform or delete your account.
1.2 Channel and bot settings
When you configure the bot through the dashboard, we store your preferences including:
• Whether translation is enabled or disabled for your channel
• Whether the bot has joined or left your channel
• Command permissions (who can use !ask, mod-only settings, etc.)
• Custom AI prompt configurations
• Moderator status of the bot in your channel
• Per-channel blocked-user and whitelist entries (usernames you add)
• If you connect a Discord server: the server's ID, name, and icon, plus your relay group and relay channel configuration
1.3 Chat messages
The bot reads messages in real time from Twitch and Kick chat channels where it is active, and from Discord channels you have configured for relay. To translate a message or answer a command, the bot sends the message text to the AI provider for the model configured for that channel (see Section 3.1).
Translation records. When the bot detects a chat message in a language other than English, or an English message it may translate for a channel that translates English chat, it stores a record of what it decided: the channel, the chatter's platform user ID and username, the original message, the detected language, the translation if one was made, the model used, and whether the translation was posted or why it was skipped. We use these records only to measure and improve translation and language-detection quality; they are not shown in the dashboard. Translation records are automatically deleted after 30 days, and straight away if the channel's account is deleted. English chat the bot does not translate is not stored, and Discord relay messages are translated and forwarded without being stored.
Reply context. If you turn on reply context, the bot keeps recent eligible messages in memory for up to two minutes, so a reply can be translated alongside the message it answers. These are never written to our database.
Moderation. A message that triggers our blocked-word safety filter is not translated, and an alert containing the message text is sent to a private, operator-only moderation channel.
1.4 Live captions audio (opt-in)
Live captions are off unless you turn them on and open the capture page. While a capture session is running, that page streams your microphone or stream audio to Soniox, our speech-recognition provider, which returns a transcript and, if you have asked for it, a translation of that transcript. We use the returned text to render your overlay.
We do not record or store your audio, and we do not store caption transcripts: both exist only for the length of the session. We do store the number of caption minutes a channel has used, so the feature can be metered. Closing the capture page ends the session and the streaming of audio.
1.5 Diagnostic and usage data
We collect operational data to monitor and improve the Service:
• Usage statistics — counts of messages processed and translations performed, aggregated per channel and per hour (no message content)
• API usage metrics — per-request metadata for calls to our AI providers, such as model, token counts, and latency (no message content); automatically deleted after 90 days
• Error logs — technical error details, which may include the channel name and the username associated with the message that triggered the error; automatically deleted after 90 days
• Website analytics — page views and page-load performance, collected with Vercel Web Analytics and Speed Insights. These do not use cookies and do not identify you across websites.
• Error reports — when the website or dashboard hits an error, technical details of the error are sent to Sentry, tagged with your internal account ID if you are signed in. A replay of the affected page, with all text masked, may be attached. When the bot hits an error, the error details are sent to Sentry too; like our error logs, they may include a channel name or a chatter's username, but not chat messages.
• Activity and audit logs — records of configuration actions taken in the dashboard and admin panel (who changed what, and when), kept for security and accountability
1.6 Cookies and session data
We use essential cookies strictly necessary for the Service to function:
• Session cookies — used to maintain your authenticated session after logging in with Twitch or Kick. These are encrypted and expire when your session ends or after a set period.
We do not use tracking cookies, advertising cookies, analytics cookies, or any third-party cookies. Our website analytics (Section 1.5) work without cookies. We do not use Google Analytics, Facebook Pixel, or any advertising or cross-site tracking service.
2. How we use your information
We use the information we collect solely for the following purposes:
• Authentication — to verify your identity and provide access to the dashboard
• Bot operation — to join your Twitch or Kick channel, read chat messages, and send translations
• Settings management — to apply your configured preferences and command permissions
• Service improvement — to monitor performance, fix bugs, and improve translation quality
• Communication — to respond to your inquiries or support requests
We do not use your information for:
• Advertising or marketing purposes
• Selling or renting to third parties
• Profiling or behavioural tracking
• Training AI models. We do not train AI models on your data. Translation records (Section 1.3) are used only to tune our own translation and language-detection settings. How each AI provider handles data sent through its API is governed by its own terms, linked in Section 3.1.
3. How we share your information
We do not sell, rent, trade, or otherwise share your personal information with third parties for their own purposes. Your information may be shared only in the following limited circumstances:
3.1 Third-party service providers
The Service integrates with the following third-party services that may process your data as part of providing functionality:
• Twitch (Amazon) — for authentication and chat integration. Your Twitch data is governed by Twitch's Privacy Notice.
• Kick — for authentication and chat integration if you sign in with or link a Kick account. Your Kick data is governed by Kick's Privacy Policy.
• Discord — if you connect a Discord server for the relay feature, and for the operator-only moderation and error channels described in Sections 1.3 and 1.5. Subject to Discord's Privacy Policy.
• AI providers — for message translation and AI responses. Each message goes only to the provider of the model configured for that channel, which may be one of: OpenAI (our default), Anthropic, Google (Gemini), Groq, DeepSeek, xAI (Grok) or OpenRouter, which passes the request to the company that hosts the chosen model. Each is subject to its own privacy policy, linked here.
• Soniox — for speech recognition, and only while a live-captions capture session you started is running. Your audio is streamed to Soniox for transcription; see Section 1.4. Subject to Soniox's Privacy Policy.
• Hosting and monitoring — Railway hosts the bot and our database; Vercel hosts the website and dashboard and provides the website analytics in Section 1.5; Sentry receives the error reports in Section 1.5.
3.2 Legal requirements
We may disclose your information if required to do so by law or in the good faith belief that such action is necessary to: (a) comply with a legal obligation; (b) protect and defend our rights or property; (c) prevent or investigate possible wrongdoing in connection with the Service; (d) protect the personal safety of users of the Service or the public; or (e) protect against legal liability.
3.3 Business transfers
If the Service is involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.
4. Data storage and security
Your account data and channel settings are stored in a secured database. We implement reasonable technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:
• Encrypted connections (HTTPS/TLS) for all data transmission
• Secure, encrypted session cookies for authentication
• Access controls limiting who can access the database and administrative functions
• Regular security reviews of the codebase and infrastructure
However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.
5. Data retention
We retain your data for the following periods:
• Account data (platform IDs, usernames, profile pictures) — retained as long as you have an active connection to the Service
• OAuth tokens (Kick bot authorisation) — retained while the platform is linked; deleted when you unlink it or delete your account
• Channel settings (bot configuration, preferences, Discord relay setup) — retained as long as your account exists, even if the bot is removed from your channel, in case you re-add it
• Translation records (see Section 1.3) — automatically deleted after 30 days. Other chat messages are not stored.
• API usage metrics — automatically deleted after 90 days
• Error logs — automatically deleted after 90 days
• Usage statistics (aggregated counts, no message content) — retained as long as your account exists
• Session cookies — expire automatically when your session ends or after a set period
You can delete your account and all associated data yourself at any time from the dashboard (Account → Delete account). This immediately removes the bot from your channels and erases your account data, settings, Discord connections, usage records, and the translation records for your channels. You may also request deletion by contacting us (see Section 13); we will act on valid requests within 30 days, except where we are required to retain data for legal or legitimate business purposes (for example, security audit records).
6. Your rights
Depending on your location, you may have certain rights regarding your personal information. These may include the right to:
• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate personal data (note: most profile data is synced from your Twitch or Kick account, so updating your profile there will update your data with us)
• Deletion — request deletion of your personal data from our systems
• Data portability — request a copy of your data in a structured, machine-readable format
• Objection — object to our processing of your personal data in certain circumstances
• Withdrawal of consent — withdraw your consent to our processing at any time by disconnecting the bot and logging out
You can exercise the deletion right yourself at any time from the dashboard (Account → Delete account). To exercise any other right, please contact us through our Discord server. If you chatted in a channel that uses the bot and want the translation records of your messages deleted before they expire, contact us the same way with your username. We will respond to your request within 30 days.
7. Children's privacy
The Service is not intended for users under 13 years of age, or under the minimum age required by any platform you connect to it (Twitch, Kick, or Discord). We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without parental consent, we will take steps to delete that information as quickly as possible. If you believe we may have collected information from a child under 13, please contact us immediately through our Discord server.
8. International data transfers
Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country. By using the Service, you consent to the transfer of your information to these countries. We take steps to ensure that your data receives an adequate level of protection in the jurisdictions in which we process it.
9. Changes to this privacy policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of the updated policy.
10. Do Not Track signals
Some browsers include a "Do Not Track" (DNT) feature that signals to websites that you do not want your online activity tracked. Since we do not engage in any tracking of users across third-party websites, no change in behaviour occurs when a DNT signal is received.
11. California privacy rights
If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA). These include the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell your personal information. To exercise your California privacy rights, please contact us through our Discord server.
12. European privacy rights (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have certain rights under the General Data Protection Regulation (GDPR). The legal basis for our processing of your personal data includes:
• Consent — you have given consent for processing by logging in and enabling the bot
• Contract performance — processing is necessary to provide the Service you have requested
• Legitimate interests — processing is necessary for our legitimate interests, such as improving the Service and ensuring security
You have the right to lodge a complaint with your local data protection authority if you believe we have not complied with applicable data protection laws.
13. Contact us
If you have any questions about this Privacy Policy, want to exercise your data rights, or need to report a privacy concern, please reach out to us on our Discord server.