Privacy Policy

Effective date: 2026-06-18

This Privacy Policy explains how OverlayThing ("OverlayThing", "we", "us") collects, uses, and shares information in connection with the OverlayThing service at overlaything.com and its related subdomains and overlays (the "Service").

1. Who this policy is for, and two important roles

OverlayThing serves two different kinds of people, and the law treats them differently.

Account holders (streamers). If you sign up for OverlayThing and connect your Twitch account, we are the data controller for your personal information. This policy governs how we handle it.

Viewers and audience members. When a streamer runs OverlayThing on their channel, we process information about the people who interact with that channel: chatters, followers, subscribers, people who cheer, send tips, redeem channel points, or raid. For that audience data, the streamer is the data controller and we act as a data processor on the streamer's behalf, under the streamer's instructions and our agreement with them. If you are a viewer and want to exercise rights over your data, contact the streamer whose channel you interacted with. We will support that streamer in responding. See Section 9.

2. Information we collect

2.1 Information from streamers when you connect Twitch

We use "Login with Twitch" (OAuth). When you authorize OverlayThing, Twitch provides us with, and we store:

• Your Twitch user ID, login name, display name, and profile image URL.
• The email address associated with your Twitch account. We request Twitch's email scope so we can contact you about the Service (for example, support and notifications).
• OAuth access and refresh tokens, which we store encrypted at rest. These let us read your channel's event stream and act on your behalf within the scopes you grant.
• The set of scopes (permissions) you granted.

2.2 Channel and event data

To power overlays, alerts, goals, and statistics, we receive and store events from Twitch about your channel, including:

• Follows, subscriptions (including gifted subs and resubs), cheers/bits, raids, channel-point redemptions, hype trains, and moderation events.
• Chat messages from your channel, including the sender's Twitch username, message text, and timestamp. Chat messages are stored in an analytics database to power features such as chat history, watch-time, loyalty points, and statistics.
• Derived and aggregated data: viewer loyalty points, watch-time, leaderboards, session and rollup statistics, and subscriber roster estimates.

2.3 Information you provide

• Configuration you create: overlays, alert variations, commands, timers, counters, quotes, giveaways, media-request settings, and similar.
• Settings such as your PayPal email for tips, time zone, and feature preferences.
• Support requests and bug reports you submit, including any details you choose to include.
• When you request access to the beta or redeem an invite, the email address you provide.

2.4 Tip data

When a viewer sends you a tip through your connected PayPal account, we store the tip amount and currency, the tipper's name and email address as provided by PayPal, and any message they include, so we can show the tip alert and keep your tip history. PayPal processes the payment itself; we handle this tip data as a processor on your behalf.

2.5 Technical information

• A small set of strictly necessary, first-party cookies (a login session cookie and short-lived cookies that secure the Twitch and Fourthwall sign-in flows and the beta invite flow). See the Cookie Policy. We use no tracking cookies.
• Standard server logs (IP address, request metadata) generated when you use the Service.
• Approximate geographic location derived from IP address. We perform this lookup locally using an on-server MaxMind GeoLite2 database. We do not send IP addresses to a third-party geolocation service for this.
• When dashboard pages and overlays load in a browser, the browser fetches web fonts from Google Fonts (fonts.googleapis.com, fonts.gstatic.com) and from the jsDelivr CDN. Those providers receive the requesting browser's IP address as a normal part of serving the fonts. We do not use them for tracking. Because overlays run in your viewers' browsers, this also applies to viewers who load your overlays.

We do not use third-party analytics, advertising, error-tracking, or behavioral tracking cookies or pixels.

3. How we use information

We use information to:

• Provide, operate, and maintain the Service and your overlays.
• Authenticate you and keep your session active.
• Process and display alerts, goals, statistics, loyalty, and chatbot features.
• Process tips you receive through your connected PayPal account.
• Power optional AI features you choose to use (for example, the AI overlay builder and AI-assisted chat moderation/commands). See Section 4.
• Respond to support requests and communicate with you about the Service.
• Detect, prevent, and address abuse, security incidents, and technical problems.
• Comply with legal obligations.

4. AI features

Some optional features send content to third-party AI providers to generate a result:

• The AI overlay/command builder sends your prompt (and, where relevant, a screenshot of the overlay you are editing) to an AI provider to generate a design or command.
• AI-assisted chat features (for example language detection or AI-judged moderation) may send chat message text to an AI provider.

We currently use OpenAI and Cerebras as AI providers. Content sent for these features is processed by those providers to return a result. We send only what is needed for the feature to work. These features are optional and operator-controlled.

5. Who we share information with

We do not sell personal information. We share it with service providers ("sub-processors") who help us run the Service, and only as needed:

We may also disclose information if required by law, to enforce our Terms, or to protect the rights, safety, and property of OverlayThing, our users, or others. If we are involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction; we will note this in an updated policy.

6. Where data is processed

OverlayThing is operated from Canada, and the Service is hosted in Canada. Some of the sub-processors listed in Section 5 may process data in other countries, including the United States. By using the Service, you understand that your information may be processed outside your own country.

7. How long we keep data, deletion, and export

• Streamer account data and configuration: kept while your account is active.
• Channel, event, and chat data: kept to power historical statistics and features while your account is active.
• Backups: encrypted backups are retained on a rolling schedule and then deleted.

Self-service control. You can manage your own data from your OverlayThing dashboard:

• Export. You can download a copy of your data at any time from your account panel.
• Deletion. You can delete your account at any time from your account panel. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain limited information to meet legal obligations or resolve disputes. Encrypted backups containing your data age out on the rolling backup schedule described above.

You can also disconnect Twitch and revoke OverlayThing's access at any time from your Twitch account settings.

8. How we protect data

• OAuth tokens and other secrets are encrypted at rest.
• Backups are encrypted before they leave our infrastructure.
• Access to production systems is restricted.
• We use a CDN with DDoS protection in front of the Service.

No system is perfectly secure, and we cannot guarantee absolute security.

9. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal data, and to object to certain processing.

If you are a streamer (we are the controller): use the export and deletion tools in your account panel, or contact us at [email protected].

If you are a viewer (the streamer is the controller): contact the streamer whose channel you interacted with. We will assist that streamer in fulfilling your request. You may also contact us at [email protected] and we will route your request.

You can manage many choices directly:

• Revoke OverlayThing's access from your Twitch account's connection settings.
• Disconnect optional integrations (PayPal, Fourthwall, Riot, etc.) in your dashboard.
• Stop using optional AI or TTS features.

10. Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. Twitch has its own minimum-age requirements. If you believe a child has provided us personal information, contact [email protected].

11. Third-party services

The Service integrates with third parties (Twitch, PayPal, Fourthwall, Riot, and others). Their handling of your data is governed by their own privacy policies, not this one.

12. Changes to this policy

We may update this policy. When we make material changes, we will update the effective date and, where appropriate, notify you. Continued use of the Service after an update means you accept the revised policy.

13. Contact

Questions about this policy or your data:

• Email: [email protected]

OverlayThing is a free service, currently in beta, operated by an individual in Canada.