Privacy policy

1. Controller

Fabian Wagenfeld, Friedrich-Wilhelm-Straße 98
32423 Minden, Deutschland
Email: mccurlygames@gmail.com

EmbedAvatar is a free, non-commercial project. We only process the data needed for the service. There is no advertising, no tracking, no analytics and no third-party content (fonts and all files are served from our own server).

2. Visiting the website and server logs

When you open any page, our web server processes technically necessary data: IP address, time, requested address, status code, amount of data transferred and response time. In the logs we store the IP address only shortened (the last byte removed, or for IPv6 everything after the first three blocks). Addresses of overlays, configurations and images are logged without their secret part.

The purpose is secure and stable operation (troubleshooting, defending against attacks). The legal basis is Art. 6(1)(f) GDPR. Logs are deleted after 7 days, system logs after 14 days.

The server is operated by: netcup GmbH, Karlsruhe, Deutschland. We have a data processing agreement with this provider (Art. 28 GDPR).

3. Account

For an account we process: email address, password (only as a secure hash, scrypt), preferred language, optionally a display name, and the times of creation, confirmation and last sign-in. For each sign-in we create a session (random key, stored only as a hash in the database, plus a shortened browser identifier and timestamps, no IP address).

Registration uses double opt-in: the account is only created when you open the link in the confirmation email. Unconfirmed registrations expire after 24 hours.

The legal basis is Art. 6(1)(b) GDPR (user relationship). Sessions end after 90 days at the latest; we keep account data until you delete your account.

4. Signing in with Google or Twitch

If you sign in with Google or Twitch, we receive an identifier of your account with the provider, your email address and whether it is confirmed there. We store no access tokens of the providers and access no other data.

Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and Twitch (Twitch Interactive, Inc., 350 Bush Street, San Francisco, CA 94104, USA) are themselves responsible for the processing during sign-in. Data may be transferred to the USA; according to their own statements, the providers base the transfer on the EU-US Data Privacy Framework. Details: Google privacy policy, Twitch privacy notice.

The legal basis is Art. 6(1)(b) GDPR; signing in via a provider is optional.

5. Avatars, images and overlays

We check uploaded images and re-encode them; embedded metadata (e.g. camera and location data) is removed in the process. We store images, avatar settings and overlays until you delete them or your account. Deleted images are removed from the server within 24 hours.

Please note: images and overlay settings can be accessed by anyone who knows the overlay link or the image address – this is how OBS can load them without signing in. We instruct search engines not to index these addresses. Don't upload anything that must not become public.

The legal basis is Art. 6(1)(b) GDPR.

6. Microphone and voice activation

Audio never leaves your device. Depending on your setup:

• OBS (obs-websocket): the overlay only reads the volume level from OBS via a local connection on your PC (127.0.0.1). None of this reaches our server.
• Control page: the control page measures the volume in your browser and sends only the state “speaking” or “silent” to your overlays via our server.
• Microphone in the browser source or in the preview: measurement happens exclusively in the browser.
• Setup assistant: while you have the setup page open, your overlay sends the level ten times per second and the names of your audio inputs to your open page so you can check the configuration.

Speaking states, levels and input names are neither stored nor logged. For overlays we store, at most every five minutes, when they were last connected and which source was active.

7. Emails

We only send emails needed for the service: confirmation of a registration or new address, password reset, security notices (e.g. password changed) and confirmation of account deletion. We use derzeit keiner – EmbedAvatar versendet keine E-Mails as a processor for sending (Art. 28 GDPR).

We delete the contents of an email (e.g. links) immediately after sending and the sending records after 30 days. The legal basis is Art. 6(1)(b) GDPR.

8. Reports of illegal content

If you report content via the report form or by email, we process the information in the report and – if provided – your email address in order to review the report and reply to you. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 16 DSA and Art. 6(1)(f) GDPR. We delete the information once the case is closed and no retention obligations apply.

9. Cookies and local storage

We only use storage on your device that is technically necessary:

Name	Purpose	Duration
__Host-ea_s (cookie)	keeps you signed in	until sign-out, at most 30 days without use or 90 days
__Host-ea_o (cookie)	protects signing in with Google/Twitch	10 minutes
ea.locale (local storage)	remembers your chosen language	until you delete it

This storage is strictly necessary for the service you requested (Section 25(2) no. 2 TDDDG); consent is therefore not required and there is no cookie banner.

10. Security and backups

All connections are TLS-encrypted. We store passwords, sessions and one-time links only as hashes. The database is backed up every six hours; backups are kept encrypted at a second location of the operator and deleted after about 60 days. Deleted data therefore also disappears from backups after this period at the latest.

11. Retention overview

Data	Deletion
Account, avatars, overlays	immediately on account deletion; images within 24 hours
Sessions	on sign-out, after 90 days at the latest
One-time links (confirmation, password)	after expiry (at most 24 hours) plus 1 day
Server logs	7 days (system logs 14 days)
Email sending records	30 days
Log of administrative actions	2 years
Backups	about 60 days

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) (Art. 21).

In your account you can export all your data as a ZIP file and delete your account yourself at any time. For anything else, write to mccurlygames@gmail.com.

You may also lodge a complaint with a data protection supervisory authority, for example: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf.

13. Minimum age

EmbedAvatar is intended for people aged 16 and over.

14. Changes

We update this policy when the service or the law changes. The version published here applies.

Last updated: 19.10.2026