Privacy

What the overlays hold

The settings you set and the state a tool needs to keep working across a reload. A clock holds its count. A wheel holds its slices. An inbox holds the questions sent to it.

Entrant names from chat

When you open a keyword and viewers enter by typing it, those names are held in your browser for that session and purged at the end of it. No chat log is kept, no chatter history is built, and nothing is written to a profile.

Snoot submissions

A submission carries the text sent and the name shown with it. We also record the IP address it came from. The streamer who owns the form never sees that address: they see an anonymous viewer id, so they can block someone without learning who they are. We keep the address with the submission for as long as the submission exists, and use it only to stop abuse, as described below.

Security records

When you visit the MXNGOWARE dashboard, Subtick or Snoot pages (including a Snoot form you were sent), a small script records the visit, whether or not you are signed in. For each visit we keep:

• your IP address, and the country and network provider it belongs to, as reported by Cloudflare;
• the IPv4 and IPv6 addresses your browser reports for itself, which it looks up with ipify, a public IP-address service;
• a random device identifier, stored in a cookie named mx_did and in your browser's storage;
• a fingerprint: a one-way hash of characteristics of your browser and device, such as screen size, time zone, language, graphics hardware and how text is drawn;
• your browser's name and version, the page you visited and when;
• your MXNGOWARE account, if you are signed in.

We use these records for one purpose: keeping MXNGOWARE and the people who use it safe. That means finding out who is behind harassment, spam or attacks, and enforcing blocks so a blocked person cannot simply come back. They are not used for advertising or analytics, and they are not sold or shared for marketing. OBS overlays do not run this script.

Only the owner of MXNGOWARE can see these records. Records of visitors who have not been blocked are deleted after 90 days.

If you are blocked

A block can cover an account, IP addresses and devices. While a block stands we keep the security records tied to it. If a blocked device shows up on a new network, that network's address is added to the block automatically for 30 days. If a device that is not blocked uses a network tied to a blocked person, it is flagged for review and what it sends through Snoot may be held back, not published, for up to 30 days. When you open the notice page, the device identifier and address you are using are added to the block's record. If you send an appeal, we keep what you wrote and any contact details you gave. After a block is lifted, its records are deleted within a year.

Your overlay link

The link is the thing that identifies your setup. Anyone with it can load the overlay, so do not publish it and do not show it on stream.

Your account

You sign in with Twitch, Google or both. From Twitch we keep your user id, login name, display name and profile picture. From Google we keep your account id, email address, name and picture. Twitch sign-in doesn't give us an email address, so a Twitch-only account has none. We also keep a record of each signed-in browser (when it signed in and the browser's name) so you and we can sign it out.

If you had an account on the older Snoot site (snoot.mxngostack.com), it has been moved into MXNGOWARE: your forms and responses are kept, and your Google sign-in opens the same account here.

Email

We only send optional email to people who said yes, and we ask separately for two kinds: product updates (a new tool, or a change to a tool you use) and offers and news (Pro opening, discounts, events). Both start off. We ask once after you sign in, and you can change either one any time in Settings, Notifications. Every optional email has an unsubscribe link that works without signing in.

When you say yes or no, we keep a record of it: which kind, the address it was for, the exact wording you were shown, where you did it and when, because the law asks us to be able to show your permission. If the address on your account changes, an earlier yes doesn't carry over to the new one.

Some email doesn't need a yes: sign-in and security notices, removal-of-service notices from notices@mxngoware.com, and replies when you ask us something. We don't sell or share your address.

Who else handles data

• Cloudflare runs our hosting, databases and network security, and sends our email. Every request to MXNGOWARE passes through Cloudflare, which also keeps its own short-lived request logs.
• Google (Firebase) held accounts on the older Snoot site and still serves that site's sign-in page while accounts finish moving over.
• Twitch and Google handle sign-in when you choose them.
• ipify answers your browser's request for its own IP address; it sees that address.

We share information with others only when the law requires it, for example a valid request from the police, or when it is needed to protect someone's safety.

Where your data is

MXNGOWARE is run from Ontario, Canada, for people in Canada and the United States. Our data is stored and processed by Cloudflare, which runs servers in many countries, so it may be handled outside the country you live in. We follow Canada's privacy law (PIPEDA) and give the same access, correction and deletion rights to everyone, wherever they live.

Who can use MXNGOWARE

MXNGOWARE is not meant for children under 13, and an account needs a Twitch or Google account, which have their own age rules.

When Pro opens

Payment will be handled by a payment provider rather than by MXNGOWARE. When that exists, this page says what is held, for how long, and how to get rid of it.

Asking about your data

Use the Contact page to ask what we hold about you, to have it corrected, or to have your account removed. We will answer. Security records about a block that still stands may be kept while it stands, because deleting them would undo the block.