Last updated: November 4, 2026
The person responsible for data processing on this website is listed in the Impressum. For privacy-related inquiries contact all.chat.support@gmail.com.
You sign in to All-Chat with Twitch, YouTube (Google) or Kick. For your account and for every platform you connect as a chat source we store:
We do not store an email address from any chat platform. Kick includes your email address in the profile it returns at sign-in; we discard it.
Legal basis: Art. 6(1)(b) DSGVO – performance of a contract (providing the service you signed up for). Records of bans and of your acceptance of the Terms rest on Art. 6(1)(f) DSGVO – our legitimate interest in preventing abuse and in being able to show what you agreed to.
While an overlay or chat view is connected, we receive and process:
Chat messages are not written to our database. They pass through memory and short-lived queues: a replay buffer with the last 500 messages of each overlay, so a reconnecting overlay can catch up, which is deleted five minutes after its last message; an incoming queue that holds the most recent 100,000 messages across all channels and is continuously overwritten (Redis keeps it in an on-disk log, and at current traffic a message stays in it for less than a day); queues that hold the most recent 10,000 chat commands and Twitch poll and prediction events; and a seven-day queue for messages that failed processing so we can fix the fault.
Some features keep data derived from events: the alert log (the sender's platform user ID and name, the event type and amount, and the event's details as the platform sends them, such as a channel point reward with the text the viewer entered) for 30 days; list-overlay leaderboards (platform user IDs, names and scores) until 30 days pass without a new entry; and credit-roll session boards (platform user IDs, names, avatars and event details, including the full message of raids and mystery gifts) until 48 hours pass without a new entry.
We also keep a record of each overlay's stream sessions (start and end, event counts and the total value of paid events) and, for each connected channel, when it was last seen live or offline and its typical streaming days and times.
Legal basis: Art. 6(1)(b) DSGVO for you as the streamer. For the viewers whose messages and events we process, Art. 6(1)(f) DSGVO – the legitimate interest of the streamer and of All-Chat in showing chat and events posted in the streamer's channel to its audience, and in preventing abuse. Most of this chat is public. Some is posted to a narrower audience, such as members-only or unlisted YouTube streams and private Discord channels, and AutoMod holds are messages Twitch has not shown in chat.
To run your overlays and tools we store what you configure:
Legal basis: Art. 6(1)(b) DSGVO. The ambassador showcase rests on your consent (Art. 6(1)(a) DSGVO), which you can withdraw at any time.
Viewers can sign in with Twitch, YouTube or Kick through the browser extension, the participation page or the viewer settings. For each sign-in we keep a session record with the platform user ID, username, display name, avatar and encrypted tokens (Twitch: no extra permissions; YouTube: read-only access and basic profile; Kick: basic profile) and counters of the chat messages you send, for rate limiting; signing out deletes it. We also store the name color, avatar frame, flair and viewer premium status you have. Unlinking a platform deletes its session record, tokens included, and revokes the tokens at the platform.
If you sign in as a viewer with the same platform account that you use as a streamer on All-Chat, we link the viewer session to your streamer account automatically, so your viewer profile carries your premium status.
If you choose to link several platform accounts (e.g. Twitch + YouTube), we create a unified viewer profile that associates your platform identities. This is opt-in only and requires your explicit action.
When you vote in a poll or enter a prediction in a streamer's channel, including by typing a chat command without ever signing in, we create a viewer record for your platform account. It holds only the platform and your platform user ID, not your username. We store your votes and predictions, and your points balance and each points transaction, for that streamer's overlay. If the streamer has turned points on, you earn them under the streamer's rules for watching while signed in to the extension or the participation page (at most one entry per minute), and for subscribing, gifting subscriptions or memberships, cheering bits and sending Super Chats or Super Stickers. Earning points this way creates a viewer record for you too, even if you have never used All-Chat. Points exist only within that streamer's overlay.
Chat messages sent through All-Chat are logged for rate-limiting and abuse detection and automatically deleted after one hour.
Legal basis: Art. 6(1)(b) DSGVO for the features you use. Linking several platform identities rests on your consent (Art. 6(1)(a) DSGVO); you can unlink a platform at any time from the viewer settings, except the one you are signed in with and your last remaining one, which deleting your viewer data removes. Recording participation by chat command, and the points a streamer's rules award automatically, rest on Art. 6(1)(f) DSGVO – the legitimate interest of the streamer and of All-Chat in running the poll, prediction or points game.
The All-Chat browser extension runs on twitch.tv, youtube.com and kick.com. On each channel page you open it asks All-Chat whether that streamer uses All-Chat, which sends us the channel name together with your IP address, even when you are not signed in. It shows the streamer's merged chat without sign-in. Signed in, it also lets you vote, predict and use points, and while you watch it tells All-Chat once a minute that you are watching, so the streamer's points rules can award watch time. When you chat from the extension, your message goes from your browser straight to the platform using the session you are already signed in with; your platform cookies are never sent to All-Chat. The extension contains no analytics or telemetry.
Legal basis: Art. 6(1)(b) DSGVO – providing the extension features you installed it for.
For observability and abuse prevention we record:
Legal basis: Art. 6(1)(f) DSGVO – legitimate interest in maintaining service security and availability.
Premium features are unlocked through a paid membership on Patreon, or granted by us free of charge, for example to beta testers and ambassadors. If you connect your Patreon account to All-Chat, we store:
If you support us on Patreon without connecting All-Chat, Patreon's notifications still reach us; we then store only your Patreon user ID and membership state, so the membership can be matched once you connect.
We do not receive or store your payment details; payments are processed entirely by Patreon. Patreon's membership notifications also contain your email address, name and other profile details; we discard them without storing them. Patreon notifies us via webhooks when your membership changes, and a periodic reconciliation keeps the state current. Disconnecting Patreon in the Settings page deletes the stored tokens, unlinks the membership from your account and ends the premium that came from your subscription.
Legal basis: Art. 6(1)(b) DSGVO – providing the premium features you subscribed to. For the data you provide on patreon.com itself, Patreon, Inc. (US) is an independent controller; see the Patreon Privacy Policy.
If you email us, we use your message and email address to answer you. Our support mailbox is hosted by Google (Gmail).
In our Discord server, the support bot reads messages that mention it, that are posted in its threads or that use its /support command, together with the usernames, the recent messages of the thread and any message you reply to (with its author's username) that it needs for context, and answers using a language model run by an external AI inference provider in Germany acting as our processor. To answer, it can look up our service logs, metrics and system status and pass redacted summaries of them to the model; these can concern your account or overlay. The bot also checks every message posted in the server for spam: if an account posts the same message in three or more channels within ten minutes, the bot bans it and deletes about a day of its messages. The bot keeps short notes to remember recurring problems and can turn a support request into a public issue on our GitHub repository, so do not post anything in a support thread that you do not want to be public. Discord processes your messages under Discord's own privacy policy.
Legal basis: Art. 6(1)(f) DSGVO – legitimate interest in answering support requests; for requests about your account, Art. 6(1)(b) DSGVO.
We use the data we store to:
All traffic to allch.at passes through Cloudflare, Inc. (US), which provides DNS, TLS and protection against attacks as our processor. Cloudflare therefore sees your IP address and the requests you make, including overlay and chat traffic.
No storage system is perfectly secure, but we follow industry best practices to keep your tokens and overlays safe.
To deliver the product we connect to the platforms you add. They receive your channel identifiers and, when we act on your behalf, your tokens and the messages or moderation actions you send:
Every integration remains subject to the platform's own policies and the scopes you approve.
Pages that show chat (the overlay in OBS, the editor preview, viewer pages and the browser extension) load images directly from the platforms and emote providers. Each request transmits your IP address and browser user agent to that provider:
Legal basis: Art. 6(1)(f) DSGVO – legitimate interest in showing chat the way it appears on the platforms. Fallback avatars (shown when a platform avatar is unavailable) and the sample chat on our homepage are served by All-Chat itself and involve no external request.
Besides our hosting and backup providers and Cloudflare (Sections 4.1 and 5.9), these services receive data in the cases below:
A streamer's chat commands can fetch an address the streamer chooses. That request comes from our servers and can include the name of the viewer who used the command and the text they wrote; who receives it depends only on the streamer's configuration. Likewise, custom code in an alert runs in a sandbox in the browser that shows the alert and can contact any address the streamer's code names.
Typography assets originally distributed by Google Fonts are self-hosted on our infrastructure. The fonts used by the All-Chat interface are bundled at build time via Next.js, and fonts selectable for overlay customization are served through a server-side proxy at /font-proxy/*. Your browser only connects to the All-Chat origin; no IP address, user agent, or request metadata is transmitted to Google when fonts are loaded. This aligns with the Landgericht München I ruling on Google Fonts (20 January 2022, Az. 3 O 17493/20).
Legal basis: Art. 6(1)(f) DSGVO – legitimate interest in delivering the visual appearance of the overlay. The font files themselves are licensed under the SIL Open Font License 1.1 or Apache 2.0.
Your use of All-Chat's YouTube integration is also governed by the Google Privacy Policy. This applies only to the YouTube API integration (data flows described in Section 5.1); it does not apply to fonts, which are self-hosted as described in Section 5.5.
We never sell or rent your data. We may disclose information when required by law or to respond to legitimate security incidents.
To understand how the site is used and where to improve it, we run Umami, an open-source analytics tool that we host ourselves. It is cookieless: it sets no cookies and performs no cross-site or cross-device tracking. To count unique visitors it derives a pseudonymous visitor hash that changes every month. The data is stored on our own infrastructure. Like all our traffic, requests to the analytics server pass through Cloudflare (Section 4.1); apart from that, the data is not shared with any third party (unlike Google Analytics or similar services).
For each page view it records:
Your IP address is not stored: it is used only momentarily to derive the country and, with a salt that changes every month, the visitor hash for counting unique visits, after which it is discarded. Public overlay pages (the pages OBS loads as a browser source) are recorded like other page views, tagged as overlay views and with the overlay ID replaced by a placeholder. Analytics run only on allch.at, not on beta.allch.at. You can block the analytics script with any browser content blocker without affecting the site.
The tracker stores nothing on your device. To build the record above it reads your screen size, browser language and the page title, and it checks your browser storage for an opt-out flag (umami.disabled); if that flag is set, it sends nothing. We do not ask for consent under § 25 TDDDG; the processing of the resulting data rests on Art. 6(1)(f) DSGVO – our legitimate interest in measuring and improving the service.
So that the service can be restored after data loss, we keep backups of the database (including account and overlay data, encrypted OAuth tokens and the chat messages and logs retained under Section 6) and of uploaded alert media with Hetzner Online GmbH (Germany), and a second copy with Backblaze, Inc. (US) in its Amsterdam data centre (Netherlands). Both act as processors under Art. 28 DSGVO. The providers only store the backups; we read them only to restore the service. The processing rests on Art. 6(1)(f) DSGVO – our legitimate interest in not losing your data.
You can exercise the following at any time:
Contact us at all.chat.support@gmail.com or use the Settings page. You also have the right to lodge a complaint with your supervisory authority (Aufsichtsbehörde).
If you wrote in a channel that uses All-Chat but have never used All-Chat yourself, you can exercise these rights by contacting us with your platform and username.
We do not use automated decision-making or profiling within the meaning of Art. 22 DSGVO.
For YouTube Data: You can revoke All-Chat's access to your YouTube data via the Google security settings page.
All-Chat uses two essential cookies and browser storage for essential functionality:
We do not use advertising cookies or cross-site tracking. We do use privacy-friendly, cookieless usage analytics (self-hosted Umami) – it sets nothing on your device and recognises returning visitors only by a pseudonymous hash that changes every month; see Section 5.8 for the full description. Fonts are self-hosted (Section 5.5) and do not set cookies. The only third-party cookies that can occur come from Twitch's clip player, which the credit roll embeds as a fallback (Section 5.2).
All-Chat is not intended for children under 16 (the DSGVO minimum age for consent to data processing in Germany). If we discover data belonging to a minor we will delete it from our live systems immediately; copies in backups expire within 60 days (Section 6).
All-Chat itself is hosted on servers located in Germany and Finland, both within the EU (see Section 4.1). Some recipients are outside the EU: Cloudflare (US), Backblaze (US; our backup copy is stored in its Amsterdam data centre), Twitch Interactive, Inc. (US, an Amazon company), Google, YouTube and Google Cloud (US), TikTok (on servers TikTok chooses, which can be outside the EU), Kick (Australia) and Pusher (UK), whose realtime service Kick uses for chat in one of its two modes, Discord (US), Meta (US, beta), GoodGame (Russia, beta), Patreon (US), GitHub (US), ElevenLabs (US, only with your own API key), and the emote, GIF and pronoun services named in Section 5. Picarto (beta) and Altstream (early access) do not state where they are based, so we treat them as recipients outside the EU. An Owncast server (beta) is wherever its operator runs it.
Where a provider is certified under the EU–US Data Privacy Framework, the transfer rests on the EU Commission's adequacy decision (Art. 45 DSGVO). Otherwise, the transfer is necessary to perform the service you requested (Art. 49(1)(b) DSGVO). Fonts are self-hosted on our infrastructure and therefore do not involve any third-country transfer when loaded.
We'll post updates to this page when the policy changes and include a new Last Updated date. Significant changes will be announced inside the dashboard.
Through EventSub we receive chat, channel events (follows, subscriptions, bits and Power-ups, raids, channel point redemptions and chat notices), moderation events (deleted messages, timeouts and bans) and, if you grant the extra permissions, polls, predictions and the moderation log (AutoMod holds and moderator actions). The permissions you grant when adding Twitch as a source include letting the All-Chat bot account read and post in your chat. Optional permissions let All-Chat send chat messages as you, moderate and create clips. We do not access payment data or channel analytics. Disconnecting Twitch in the Settings deletes your stored tokens and revokes them at Twitch. If you sign in with Twitch, you cannot disconnect it.
We read live chat through YouTube's public live chat endpoints or, in the premium official-API mode, the YouTube live chat API. With your permission we read your most recent subscribers for alerts and your subscriber count for goals, and optional permissions let All-Chat send messages and time out or ban chatters. We do not access video content or channel analytics. API usage is subject to YouTube's quota limits. You can revoke access via Google security settings, or disconnect YouTube in the All-Chat Settings, which deletes your stored OAuth tokens and revokes them at Google. Your YouTube sources then keep reading public chat, which needs no token, until you remove them. If you sign in with YouTube, you cannot disconnect it.
TikTok offers no official chat API, so you only enter a TikTok handle and no TikTok login is involved. Any public handle can be added; we do not check that it belongs to you. We read the public LIVE chat and events (gifts, likes, follows, shares, subscriptions, questions, Super Fan joins and boxes, and treasure chests) without accessing videos, followers or other content. Removing the source stops it for your overlays; we keep reading that handle while another All-Chat user has it as a source.
We use Kick's OAuth for sign-in and sources and connect to Kick's realtime service to receive chat. When that service runs in its Pusher mode, our servers use the stored Kick token of the account that linked your channel to subscribe to its chat. Optional permissions let All-Chat send messages and moderate. We do not access channel analytics or payment data. Disconnecting Kick in the Settings deletes your stored tokens and revokes them at Kick; your Kick sources then keep reading public chat until you remove them. If you sign in with Kick, you cannot disconnect it.
When you add the All-Chat bot to a server, we store the server ID, name and icon and read messages, including content and attachments, in the channels you configure. On your instruction, All-Chat can delete messages there and time out, ban and unban members. Chat from your other platforms can be relayed into a Discord channel through a webhook. If you link your Discord account, we store its Discord user ID and username. We do not read direct messages or channels you did not configure. Removing the server from All-Chat makes the bot leave it.
You enter the address of an Owncast server. We connect to it anonymously, read its public configuration and register an anonymous chat user there to receive chat. The server's operator, not All-Chat, controls the data on that server.
We read public chat anonymously using the channel name you enter. No login with these platforms is involved, and we never post or moderate there.
You connect a Facebook Page or an Instagram professional account through Meta. On Facebook we poll live video comments and can delete comments and block users on your instruction. Until Meta has approved All-Chat in its app review, this works only for accounts that Meta lets test our app. We currently do not read Instagram comments: connecting Instagram only stores the account and its tokens. Disconnecting deletes the stored tokens and the Facebook or Instagram sources; to revoke the grant at Meta itself, remove All-Chat from the apps connected to your Facebook account.
Email: all.chat.support@gmail.com
This contact is for users of the official hosted service at allch.at. Self-hosted installations should contact their own administrator.