Privacy notice

Updated: September 2026. This notice describes the processing of personal data at Cuewerk.

Controller and contact

André Konegen, Schulweg 5a, 27798 Hude, Germany. For questions about privacy and your rights, contact konegen.andre@gmail.com .

Account and usage

We process your name, email address, password hash, session data, widget settings and uploaded media to provide the features you request. The legal basis is Article 6(1)(b) GDPR. Passwords are not stored in plain text. We use necessary session cookies for sign-in; they expire within 30 days. We do not use analytics or advertising trackers. Fonts are loaded from our server.

Language preferences

We store your language preference in a necessary cookie for up to one year. For signed-in users, we also store it in the account so requested emails can be sent in the appropriate language. This preference is removed when the account is deleted.

Unsaved drafts

To help you recover edits, we save widget names and settings locally in your browser. Drafts can no longer be recovered after seven days and are removed the next time you open the editor. Saving, discarding or signing out removes them from this browser. Drafts do not include widget links, passwords or Twitch tokens. They are not available on other devices.

Emails

Verification and password reset emails are sent through ALL-INKL.COM – Neue Medien Münnich. The recipient address and the content of the requested message are processed for this purpose. Queued messages are deleted after successful delivery; failed jobs are kept for no more than 24 hours. Verification and recovery links are valid for one hour.

Optional Twitch connection

When you connect Twitch, you allow our central application to access the required channel events. We store encrypted access and refresh tokens, the channel ID and the display name. Twitch receives the data required for authorisation and technical API requests. Twitch is operated by Twitch Interactive, Inc. in the United States; further information is available in the Twitch privacy notice .

For alerts, we process display names and details such as subscription months, gift subscription counts, Bits or raid size. Viewers' free-text messages are not part of automatic alerts. Events and duplicate detection data are retained for no more than 24 hours. During this period, your event history shows events, live tests, replays and their processing status. Anonymous events remain anonymous. Disconnecting stops automatic Twitch alerts; failed token revocations are retried for no more than 24 hours. Failed removal of technical event subscriptions is retried for up to seven days. Channel and connection IDs stored for this purpose are deleted after successful removal or when that period ends.

Chat highlights

With additional chat permission, we process chat messages, display names, Twitch user and message IDs, and timestamps so you can select individual messages to display on stream. The chat inbox holds no more than 100 messages and is regularly cleared after ten minutes. Messages are limited to 500 characters. A selected message remains stored as a highlight until hidden or for no more than 30 minutes. Technical IDs of received deletions are retained for up to 30 minutes to prevent messages from reappearing. Regular cleanup occurs within one further minute. Received moderation events remove affected messages and highlights. Disconnecting removes the chat inbox and highlights. Chat messages are not stored in the event history.

Widget output and media

A widget link grants access to that widget's output. Anyone who knows it can open the output. You can renew the link at any time. Your stream viewers see the content you display; they do not need an account with us. Media is stored in your workspace and made available only to you and to the widget outputs you authorise.

For connection status, we count active browser sources per widget. We store a random connection ID and the time of last contact for this purpose. Closed connections are removed; abandoned entries become inactive after 45 seconds and are regularly cleared.

Hosting and security

The application runs on a VPS hosted by IONOS in Germany. Connection data is processed to deliver the service. Application logs do not contain widget keys, passwords or Twitch tokens. To limit abusive requests, identifiers are pseudonymised and removed within 24 hours after the limit expires. Security-related administrative actions are logged for 90 days. The legal basis is our legitimate interest in secure and reliable operation under Article 6(1)(f) GDPR.

To resolve errors, we store the associated account, technical error codes, processing states and timestamps for email, Twitch and media errors. Email text, verification links, chat content and credentials are not copied into this diagnostic history. Open cases remain visible until closed. Closed cases and support jobs are regularly cleared after seven days; deleting an account removes its associated diagnostic data.

Deletion and backups

Account data and widget settings are kept until deleted. Deleting an account immediately invalidates its active widget links; associated media files are then removed by regular cleanup. Backups are protected on the same VPS and deleted within 14 days. Deleted content may remain in those backups until then.

Your rights

Under the GDPR, you have rights of access, rectification, erasure, restriction of processing and data portability, subject to its conditions. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. You can lodge a complaint with a data protection authority, in particular the State Commissioner for Data Protection of Lower Saxony. You can export your widget and account data and delete your account in account settings.