This is an incomplete draft for owner and legal review before public launch.
The backend stores your permanent Twitch ID, login, display name, profile image URL, account timestamps, and character data. Encrypted Twitch tokens and server-side sessions support authentication. The browser receives an opaque HttpOnly session cookie and a CSRF cookie.
Account data supports sign-in, shared fighters and summon progress. The live game can display character names and gameplay on stream. No email permission is requested.
The operator must add the legal operator identity and contact address, jurisdiction, subprocessors and hosting locations, retention periods, deletion/export procedure, user rights, age requirements, and incident contact. Backups and logging policies must be documented after hosting is selected.