Contact about your privacy
For privacy questions or requests, send a private message to phanvesta on Discord. You can ask about your information, request a copy or correction, or request deletion. If you do not use Discord or cannot send a private message, email info@cavesta.com. Both routes are available for questions and complaints.
Tell us your community name and what you need help with. Use a private message, not a public server channel. Please do not send passwords, sign-in codes, recovery codes or identity documents. Before sharing or removing account data, we will confirm that the account belongs to you; a matching Discord username alone is not proof of ownership.
What we use, and why
When you sign in through a connected platform, we receive its account identifier, name, profile image and, where provided, email address. We store the credentials needed to maintain that connection. The platform does not receive your Twitch or Google password.
We store your votes, predictions, points, streaks, badges, challenges and supporter access to run the features you use and keep results consistent. We also keep account preferences and limited moderation and security records to protect the community and prevent duplicate rewards or misuse.
We process account and participation information to provide the service you request under our Terms of use. Security, moderation and preserving reliable results serve our legitimate interests in keeping the community safe and preventing abuse. Optional analytics uses your consent, which you can withdraw at any time.
Your YouTube connection
Cavesta Voting uses YouTube API Services when you choose “Continue with YouTube” or connect YouTube in Account settings. With your permission, we request your selected channel's basic details and store its channel ID and channel name to identify your account and verify that the channel belongs to you. We also store the sign-in tokens returned by Google with that connection. This YouTube sign-in does not request your Google email address or Google profile photo.
Your channel name appears in your connected-account settings. If YouTube is your first sign-in method, it can also be used as your community name, which is public. Separately, you can choose whether to show your connected YouTube name under “Also known as” on your profile. Authorised staff can inspect connected names for account support, security and moderation.
The permission Google shows is read-only access to your YouTube account. Our connection uses it to look up your channel, not to read your videos, playlists or subscriptions. It cannot upload, edit or delete YouTube content. We do not sell Google user data or use it for advertising or training AI models. Our use of that data is subject to the Google API Services User Data Policy, including its Limited Use requirements.
You can disconnect YouTube in Account settings after verifying your primary account. If YouTube is your primary sign-in, first save a recovery code or connect another working sign-in method. Disconnecting removes the local connection and channel name, signs out existing sessions and requests revocation at Google. If Google is temporarily unavailable, we retry; the credentials and channel identifier needed for that request are kept for no more than seven days. A failed confirmation is not reported as successful revocation. Google may revoke other permissions granted to this app at the same time.
We regularly check YouTube authorization and refresh the channel details. If authorization ends, we remove the stored YouTube API data. Details that cannot be refreshed are removed within 30 days. You can also revoke permission in your Google account settings. Your independently chosen community name, votes, predictions and points remain. Save your recovery code before revoking access: without a code or another connected account, we may not be able to identify your existing Soul.
Recovery codes are optional, shown once and stored only as a one-way hash. A code grants access to your existing account after its YouTube connection has been removed and is used once. A replacement invalidates the previous code. Recovery cannot restore a deleted account or bypass a ban. For account deletion, use Account settings. For help with other stored information, contact us privately on Discord or by email.
YouTube features are also subject to the YouTube Terms of Service and the Google Privacy Policy.
What other people see
Your community name and participation can appear in community features such as leaderboards and live vote displays. Your email address and sign-in credentials are not shown to other members.
In Account settings, you can control your public voting history, individual scores and favourite genres. You choose separately which connected names appear under “Also known as”. Knights and Bloodqueen can inspect connected names for moderation even when you hide them from other members.
Live voting information may also appear on Cavesta's stream through the voting overlay. Hiding information later does not remove copies already captured in a stream or recording.
Analytics is optional
Usage analytics is off by default. During your first welcome tour, “Help shape this platform” offers a choice between “Allow usage analytics” and “Not now”. You can also change it later under “Help improve this platform” in Account settings. If you enable it, we send selected usage events to PostHog in the EU: for example, opening a page, completing a vote or returning for another session. A random identifier helps us connect those events. It is not your public account name.
The usage information we send does not include your name, email, individual scores or sign-in tokens. We do not use PostHog session recordings or automatic click recording. These measurements help us understand which features people use.
You can switch analytics off at any time in Account settings. Voting and rewards work either way. Switching it off stops new optional measurements and removes your current analytics identifier here; it does not automatically delete events already received by PostHog. We cannot promise automatic deletion after 12 months. To ask about historical events, contact us. Once an identifier has been removed, we may no longer be able to reliably connect older events to your account; we will explain any limitation when handling your request.
Who helps process your information
We use service providers to keep the website available, save your votes, connect your account and, if you choose, measure how the platform is used.
Signing in or playing an embedded stream or video connects you to the relevant platform. It can receive connection information such as your IP address. YouTube players on our home and game pages load after you click to play.
Service providers & their privacy notices
- Vercel — website delivery and operational security.
- Supabase — account and participation storage, and live updates.
- Twitch and YouTube/Google — account connections and embedded media.
- PostHog — optional usage analytics through its EU service.
We use Vercel and Supabase to deliver the account features and store the information needed for them, including your connected YouTube identity. PostHog receives only the optional usage events described above, not your YouTube connection credentials. These providers have their own privacy terms and may use service providers outside the European Economic Area. Contact us if you need details about the processing of your information or applicable transfer safeguards.
Cookies & browser storage
We use necessary sign-in and security cookies to keep your session and account connections working. Browser storage also remembers interface choices. These are separate from optional analytics.
With analytics enabled, temporary browser-tab storage helps avoid counting the same event repeatedly. Your analytics preference is saved with your account. Withdrawing consent clears this analytics storage on the device where you change it and blocks later event delivery from other devices. Older analytics cookies are not treated as consent.
A stream or video provider may use its own cookies or storage once you load its player. The platform's analytics switch does not change the settings on those external services.
Keeping & deleting your data
Account information is kept while you use your account. When you delete your account, we remove its name, email, profile image, connected accounts, recovery code and sessions. Names in your community-name requests are removed too. You permanently lose access to that account and its points, badges and progress. Signing up again creates a new account; it does not restore the deleted one.
Votes, predictions and reward history remain so that existing results do not change. Internal account references and some moderation records also remain. Removing your public identity therefore does not mean every historical record becomes fully anonymous.
Participation history currently has no automatic expiry. Recent-activity views use a 30-day window, but that is not a promise that every underlying record is deleted after 30 days. Expired security records and external service logs have separate cleanup and retention rules.
We retain participation history to preserve completed results and earned rewards, and limited moderation records to prevent repeat abuse. Requests about retained records are handled individually: we assess what can be removed or separated from your identity and explain what must remain and why. Turning analytics off or deleting your platform account does not trigger automatic deletion of historical PostHog events.
Your rights
Depending on the circumstances, you can request access to your personal data, correction, deletion, a portable copy or restriction of its use, and object to processing based on legitimate interests. You can withdraw analytics consent without losing access to voting or rewards.
Send your request privately to phanvesta on Discord or to info@cavesta.com by email, including your community name and the information or action you are requesting.
We will respond without undue delay and normally within one month. We may need to confirm that the account is yours. If a request needs more time or cannot be fully granted, we will explain why and what happens next. You can also raise a concern with your local data protection authority.
Manage your choices
Visit Account settings to change your profile visibility, choose which connected names to show, switch usage analytics on or off, or delete your account.
Reading this notice or signing in does not mean giving up your privacy rights. Optional usage analytics remains a separate choice.
