Privacy Policy
What we collect, why, and how to get rid of it. Written for UK GDPR, in plain English.
1. Who we are
Streambar is run by Streambar Ltd, a company registered in England and Wales, company number 17307791, registered office 66 Paul Street, London, England, EC2A 4NA. Email: hello@streambar.live. Streambar Ltd is the data controller for the information described here.
2. What we collect
- Account details — your email address, whether you have verified it, and a hash of your password, held by our authentication provider (Supabase). We never store or see the password itself.
- Your overlay settings — the messages you write, your logo, your colours, layout, font and text choices, timings and plan.
- Billing records, if you subscribe — your Stripe customer and subscription identifiers, your plan, the billing interval, the next renewal date and whether the founding rate applies. Never your card number: Stripe takes the payment on its own page and we only learn that it succeeded or failed.
- Technical logs — IP address, browser and device type, and timestamps of requests, generated automatically when you use the panel or your overlay loads.
- Product analytics — a small number of named events about how the control panel is used: signing up, your first save, copying your overlay URL, downloading the OBS scene, an overlay connecting, and plan changes. This runs in the control panel only, never on the overlay page your viewers see.
- Your referral code, and who referred you — every account gets a short code it can share. If you signed up through someone else's link, we store which account that was.
- Overlay connection times — when your overlay last connected to us. It is how we can tell whether OBS is set up correctly when you ask for help.
- Your logo file, if you upload one — see “Your logo is on a public URL” below.
- Notes we write about your account — if our staff change your plan or status by hand, or mark an account as one of our own demos, we record who did it, what changed, and why.
3. A few Streambar specifics
These are the bits that are particular to how Streambar works, rather than the usual privacy boilerplate. They matter more than the rest of this page.
Your overlay URL is a secret
Your overlay address (/o/…) contains a long random token. That token is the permission: anyone who has the full URL can watch your overlay, so treat it like a password — do not put it in a screenshot, a stream, or a public Discord. If it gets out, email hello@streambar.live and we will issue you a new one. There is no self-serve button for that yet.
Your logo is on a public URL
A logo you upload is stored with Supabase Storage and served from a public URL containing a random path. It is not listed anywhere and not linked from anywhere but your overlay, but anyone who has the exact address can view the image without signing in. Please do not upload anything you would mind a stranger seeing. Deleting your account removes the file.
Payments
Stripe handles every payment on its own checkout page and in its customer portal, under Stripe's privacy policy. Stripe sends us the outcome and the identifiers above; it keeps the payment records the law requires it to keep. Stripe may email you receipts and payment-failure notices directly.
Referrals
Your account has a referral code, shown in your panel as a link. If someone signs up through it, we store the fact that your account referred theirs. We do not tell you who they are, and we do not tell them anything about you. There is no reward scheme attached — today it only tells us how people find Streambar.
Product analytics
We use PostHog, hosted in the EU at eu.i.posthog.com, and only in the control panel. It records the named events listed above — not everything you click, and not what your messages say. The overlay page loads no analytics at all, so nothing about your viewers reaches us or PostHog.
When our staff change your account
Occasionally we need to change a plan or an account status by hand — a support fix, or a comp. Every one of those is written to an internal audit log with the staff member's email address, what it was before, what it became, and a written reason. You can ask us for the entries about your account.
Waitlist and capacity
While Streambar is small we cap how many accounts can exist. If we are at that cap, sign-up is declined with a message and no account is created — we do not keep your email address in that case unless you separately ask to join a waitlist.
Where your data is stored
Your account, your overlay settings and your logo live in our Supabase project in Frankfurt, Germany (AWS eu-central-1). The server that runs the panel and serves your overlay is a DigitalOcean droplet in London (LON1), and its logs stay there. Product analytics are on PostHog's EU cloud. Stripe processes payments under its own policy, which may involve the United States; see “International transfers” below.
4. How we use it
To run the service and show your overlay; to take payment for a paid plan; to keep accounts secure and investigate abuse; to understand which parts of the panel people actually use so we can improve it; and to email you about your account (verifying your address, sign-in and password resets, billing, changes to these policies, service problems). We do not sell your data, and we do not send marketing email without asking.
5. Lawful basis
- Contract — running the overlay, your account and your subscription, which is what you signed up for.
- Legal obligation — keeping the billing records tax and accounting law require.
- Legitimate interests — security, abuse prevention, and product analytics, balanced against your privacy.
- Consent — where the law requires it, for example non-essential cookies. You can withdraw consent at any time.
6. Processors we use
- Supabase — authentication, database and file storage: your account, your overlay settings and your logo. Frankfurt, Germany (AWS
eu-central-1). - Stripe — payments, subscriptions and the customer portal. Card details go to Stripe, never to us.
- Resend — delivery of the emails our authentication provider sends: the verification link and password resets.
- PostHog — product analytics, in the control panel only, on their EU cloud (
eu.i.posthog.com). It is never loaded on the overlay page. - DigitalOcean — the server that runs the panel and serves your overlay, and its logs. London (
LON1). - Cloudflare — DNS for our domains.
Each acts on our instructions under a data-processing agreement.
7. Cookies and local storage
In the control panel your browser stores a few things: your session, so you stay signed in; your light/dark choice; the email address you last signed in with, so the sign-in screen can fill it in for you; and, if you arrived through a referral link, that referral code, until the moment you create an account. The first is essential to the service; the others are conveniences. PostHog also sets an analytics ID (local storage and a cookie) for the events described above.
The overlay page sets nothing: no cookies, no storage, no analytics, no tracking of your viewers. Like any web page, the browser may cache its files and fonts.
8. How long we keep it
Account and overlay data: for as long as your account exists. When you delete your account (Settings → Delete account) it is removed from our live systems immediately, along with your logo file; copies in routine backups expire within 30 days. Technical logs: up to 30 days. Stripe keeps the payment records it is legally required to keep, under its own policy. Analytics events are aggregated and kept in a de-identified form.
9. Your rights
Under UK GDPR you can ask for access to your data, correction of it, deletion, a portable copy, restriction of processing, or object to processing based on legitimate interests. Most of it you can do yourself in the panel — including deleting the account outright; otherwise email hello@streambar.live and we will respond within one month.
If you are not happy with how we handle it, you can complain to the UK's Information Commissioner's Office at https://ico.org.uk/make-a-complaint/.
10. International transfers
Your account and overlay data are held in the UK and the EU (London and Frankfurt, above); the EU is covered by the UK's adequacy regulations. Where a processor stores or processes data outside the UK and EU — Stripe and PostHog may, for their own operations — the transfer is covered by the UK International Data Transfer Agreement or standard contractual clauses with the UK Addendum, plus any extra safeguards needed.
11. Children
Streambar is for people aged 18 and over. We do not knowingly collect data from children; if you believe a child has an account, tell us and we will delete it.
12. Changes to this policy
If we change anything significant we will update the date above and email the address on your account.
13. Contact
hello@streambar.live, or by post to Streambar Ltd, 66 Paul Street, London, England, EC2A 4NA. See also our Terms of Service.