Privacy policy
Last updated: October 2026
Controller
—1. Overview
This policy describes which personal data we process when you use the JilTV website, our API or the browser extension, why, on what legal basis, and what rights you have. Personal data is any information that identifies you directly or indirectly, such as your IP address or Twitch name.
We have not appointed a data protection officer because we are not legally required to. Send any questions to the address above.
2. Hosting
Our API, database and image processing run on servers at a hosting provider in Germany. The servers are located in Germany. We have a data processing agreement with the provider under Art. 28 GDPR; it processes data only on our instructions.
The legal basis is Art. 6(1)(b) GDPR where processing is needed to provide your account, and otherwise Art. 6(1)(f) GDPR (our legitimate interest in reliable operation).
3. Cloudflare (delivery, protection, storage)
The website itself is served by Cloudflare Workers; emote images are stored in Cloudflare R2 and delivered through Cloudflare's network. All requests to JilTV also pass through Cloudflare, which blocks attacks and abuse (firewall, DDoS protection). The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.
Cloudflare processes your IP address, the requested address, browser details and the time of the request. This is technically necessary to deliver the site and protect it from attacks (Art. 6(1)(f) GDPR). We have a data processing agreement with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework, so transfers to the USA are covered by the European Commission's adequacy decision (Art. 45 GDPR), supplemented by standard contractual clauses.
4. Server logs, abuse protection and errors
Our server writes no access logs with IP addresses. To prevent abuse (such as mass uploads or sign-in attempts) we count requests per IP address or account in short time windows. These counters exist only in memory and delete themselves when the window ends, after one hour at most (Art. 6(1)(f) GDPR).
If an error occurs on our server, a technical error report may be sent to Sentry (Functional Software, Inc., 45 Fremont Street, San Francisco, CA 94105, USA). It contains the error message and technical details from the program, but no IP addresses, cookies or sign-in data. Sentry is certified under the EU-US Data Privacy Framework. The legal basis is our legitimate interest in error-free operation (Art. 6(1)(f) GDPR). Error reports are deleted after 90 days.
5. Signing in with Twitch and profile pictures
To get an account you sign in through Twitch (Twitch Interactive, Inc., 350 Bush Street, San Francisco, CA 94104, USA). Twitch sends us your Twitch ID, login, display name and profile picture address, which we use to create your account and keep it up to date (Art. 6(1)(b) GDPR). We never see your Twitch password. Twitch's privacy policy applies to signing in at Twitch.
Profile pictures are loaded directly from Twitch's servers, so your browser sends your IP address to Twitch (Art. 6(1)(f) GDPR; our interest is showing current profile pictures without keeping copies).
Without an account you can browse, search and download emotes.
7. Account and content
We store what you create on JilTV in order to provide its features (Art. 6(1)(b) GDPR):
- Profile: name and picture from Twitch, your bio, worn paints, badges and avatar decorations. Profiles are public.
- Emotes: image files in all sizes, the original, name, tags, editor settings, versions and contributors (credits). Anyone can see and download public emotes; private ones only you.
- Emote sets, channels, editor roles and invitations, favorites, notifications and the activity history of your channels.
- Sessions: browser type (user agent) and sign-in time per device for the device list in your settings.
- Developer apps and API keys, if you create any.
- Imports from 7TV: the ID of the imported channel and the result of the import.
8. Reports and moderation
When you report content, we store the report with its reason, description, time and your account so we can review it. Moderator decisions (such as rejections, bans and appeals) are logged with their reasons so they can be traced and appeals can be handled.
The legal bases are our obligations as a hosting provider under the Digital Services Act (Art. 6(1)(c) GDPR) and our legitimate interest in a safe platform (Art. 6(1)(f) GDPR). The person whose content you report is not told who reported it. For rejected emotes we keep a checksum of the file as long as the rejected emote is stored, so the same file cannot be uploaded again.
9. Browser extension
The extension loads the emotes of the Twitch channel you are watching. To show paints, badges and personal emotes it sends the login names of visible chatters to our API. Chat messages are never sent and none of this is stored permanently; answers are cached for five minutes at most. The extension keeps your settings only in your browser.
If you turn them on in the extension's settings, it also loads emotes from 7TV, BetterTTV and FrankerFaceZ directly from their servers; your browser sends your IP address and the channel to these providers. Their own privacy policies apply.
The legal basis is Art. 6(1)(b) GDPR (you use the extension to see this content).
10. Payments (Supporter)
Supporter subscriptions are handled by Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). You enter payment details directly at Stripe; we never see them. We store the Stripe customer and subscription IDs, the subscription status, the end of the billing period and the number of paid months (Art. 6(1)(b) GDPR). Tax-relevant records are kept for the legally required periods, up to ten years (Art. 6(1)(c) GDPR, § 147 AO).
Stripe is itself responsible for payment processing and also checks payments to prevent fraud. Stripe may transfer data to Stripe, Inc. in the USA, which is certified under the EU-US Data Privacy Framework. Stripe's privacy policy applies in addition: https://stripe.com/privacy
If you cancel through "Cancel contracts here", we store your name, email address, Twitch name and the type, date and reason of the cancellation to carry it out and confirm it to you. We keep these details as proof for three years (Art. 6(1)(b) and (c) GDPR, § 312k BGB).
11. Contact by email
If you write to us, we process your email address and message to reply (Art. 6(1)(b) or (f) GDPR). We delete the message once the request is settled and no retention obligation applies.
12. Retention and backups
We keep account data while your account exists. When you delete your account under Settings → Account, we immediately remove channels, sets, editor roles, favorites, cosmetics, developer apps, sessions and billing data, unless the law requires us to keep it. Your emotes stay online as "deleted user" unless you choose to delete them too.
Prepared downloads (GIF/PNG) are deleted after seven days. Sessions expire 30 days after signing in.
We back up the database, encrypted, at a separate storage provider so data can be restored after an outage (Art. 6(1)(f) GDPR). Deleted data stays in these backups until it is overwritten after about a month; backups are only used for restoring.
13. Status page
Our status page is run by Better Stack (Better Stack, Inc., USA) and is an external link. Only when you open it does Better Stack process your IP address and browser details; Better Stack's privacy policy applies. The availability checks themselves process no visitor data.
14. Obligation to provide data, no automated decisions
You are not obliged to give us data. Without signing in with Twitch you cannot create an account, and without the technically necessary data (such as your IP address) the site cannot be delivered.
We make no solely automated decisions with legal or similarly significant effects (Art. 22 GDPR). Automatic checks on upload (such as file format and size) only decide technical validity; people decide about content.
15. Your rights
You have the following rights:
- Access to your data (Art. 15 GDPR). Download a complete copy under Settings → Account.
- Rectification of inaccurate data (Art. 16 GDPR).
- Erasure (Art. 17 GDPR), also yourself under Settings → Account.
- Restriction of processing (Art. 18 GDPR).
- Data portability in a machine-readable format (Art. 20 GDPR).
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR).
- Complaint to a data protection authority (Art. 77 GDPR), for example the one where you live or the one responsible for us.
Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.
Write to the address above for any request.
16. Changes
We update this policy when JilTV or the law changes. The version published here applies.