Privacy Policy

Last updated: November 4, 2026

This policy explains how Tepnyx processes personal data when you use tepnyx.com (including the Decider web app), the Decider app for iOS and Android and the Sorty app. We process data under the GDPR, Spanish LOPD-GDD and other applicable laws.

1. Data Controller

Tepnyx
Website: https://tepnyx.com
Contact: soporte@tepnyx.com

2. Services Covered

• Tepnyx website: information, account, contact, giveaway search, online wheel and user panels.
• Decider web: creating, running, verifying and resolving giveaways, including giveaways from a Twitch, YouTube or Kick live chat.
• Decider for iOS and Android: creating and entering giveaways, profile, followers, likes, comments, mentions, private messages, notifications and the wheel.
• Premium: advanced features, subscription, preferences and customization.
• Decider Live: stream alerts shown in OBS (follows, subscriptions, bits, channel points, KICKs, Super Chats, members and raids from Twitch, Kick and YouTube, and Ko-fi tips if you connect it), stream widgets (giveaway, goal, subathon, latest events and on-screen chat), with your own files and filters for what viewers write.
• Sorty for iOS and Android: photo gallery cleanup (screenshots, duplicates, dark, blurry and receipts) analysed on the phone itself; see section 11.

3. Data We Collect

• Account: username, email address, encrypted password, internal identifiers, optional profile image and preferences. If you sign in with Google or Apple, they give us your email address (with Apple it may be a relay address that hides yours), your name, with Google your profile picture, and an account identifier; we never receive your password or access any other data in that account.
• Date of birth: in the app and on the website, once, to know whether the account must use the limited mode for under-13s and to lift it when they turn 13. It's never shown to anyone.
• Country: the country you set in the app or on the website when you start using your account, and when you last changed it (it can only be changed once a month). To suggest it we use the approximate country of your connection that our network provider tells us and your device's or browser's language, without storing them. It isn't shown on your profile; the Tepnyx team sees it in its admin panel.
• Account limits: if we moderate an account, which actions are limited, the reason and the dates.
• Social activity on Decider: who you follow, likes, comments, mentions, private messages with other users, blocks and reports.
• Communications: messages sent through forms, support or email.
• Giveaways: creator data, rules, requirements (including the countries a giveaway is limited to), participants, verification status, winners, history, audit records and the winner message the creator writes for the live chat.
• Giveaway review: the score and signals of the automatic review against fake giveaways, where each giveaway shows, the Tepnyx team's decisions and, if you won a giveaway, your answer to whether you got the prize (see section 10).
• Usage and device: visited pages, service events, errors, app version, operating system, browser, language, settings and required technical data.
• Cookies and local storage: consent, session, preferences, wheel settings and temporary functional data.
• Premium and payments: subscription status, plan, dates, premium preferences and payment history; for App Store or Google Play purchases, the purchase identifier, to tie the subscription to your account. We do not store card data.
• Notifications: mobile push notification tokens when you enable them.
• Connected social accounts: the account's identifier, name, picture, follower count and the access tokens the platform gives us (see section 4).
• Decider Live: the files you upload for your alerts (images, GIFs, videos and sounds) with their name and size, your alerts and your filters. To show an alert we process the name, picture, amount and message of whoever triggers it (see sections 4 and 8); the filters are applied when it shows, without storing anything else.
• Account verification: full name or company name, aliases, account type (individual or business), reason for the request, online presence links and, optionally, an identity document (national ID, passport, tax ID or other). This data is processed solely to review and resolve the verification request.

4. Social Integrations and Third-Party Data

When you connect a social platform, we use the permissions you grant only to verify giveaway requirements, identify the connected account and provide the requested feature. We do not sell this data or use it for advertising.

4.1 YouTube (Google)

• We use YouTube API Services. By connecting your channel you agree to the YouTube Terms of Service, and Google processes your data under the Google Privacy Policy.
• We read your channel's basic information (identifier, name, picture and subscriber count) to know which channel is yours.
• If you're a participant, when a winner is picked we check your subscriptions (only whether you're subscribed to the creator's channel) and your comments on the videos set as requirements.
• If you're a creator, we read your live chat for live-chat giveaways and, only when you use it, post in that chat the message announcing the winner.
• If you use Decider Live, while your overlay is open in OBS we look for your active broadcast and read its chat to show on screen the Super Chats, Super Stickers, new members, member milestones and gifted memberships: the name, picture, amount and message of whoever sends them. Only you (and your stream) see them, and they're deleted after 30 days.
• If you use Decider Live's on-screen chat, while it's open in OBS we also pass that chat's messages (name and text) on to OBS, and take off the ones a moderator deletes or from someone banned. We don't store them: they show on your stream and are gone.
• If you connect Ko-fi to Decider Live, Ko-fi tells us about every tip, membership or order on your page: if it's public, the name and message of whoever sends it, and always the amount and currency. We use Ko-fi's verification token to check the notice comes from Ko-fi; it's kept only for that and deleted when you disconnect. The alerts are deleted after 30 days.
• YouTube data about people who haven't connected their account to Decider (for example, someone entering a giveaway by writing in the chat) is anonymized 30 days after we get it.
• You can ask us to delete the data we got from YouTube through the contact form or at soporte@tepnyx.com; we do it within 7 days.
• We don't create, edit or delete videos, playlists, comments or channel settings, and we don't use this data for advertising. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• You can revoke access at any time at myaccount.google.com/permissions or by disconnecting YouTube in Decider; disconnecting deletes the tokens.

4.2 Twitch

• We read your Twitch identity (identifier, name, picture and account email) to know which account is yours.
• If you're a creator, with your permission we look up who follows your channel, who is subscribed and who your VIPs and moderators are, only to check the winner's requirements; we read your live chat for live-chat giveaways and, when you use it, send on your behalf the message announcing the winner.
• Use of Twitch is also subject to its terms and privacy policy.

4.3 TikTok

• When you connect your account we read your TikTok identity (identifier, username, display name and picture) to know which account is yours and which one you enter giveaways that ask for TikTok with.
• If you're a creator and you allow it, we read the comments on your own TikTok videos, only to check whether the winner commented on the video the giveaway asks for. We don't keep those comments: only the result of the check.
• TikTok doesn't allow checking whether someone follows an account, so the creator checks that requirement by hand.
• You can withdraw access at any time from your TikTok settings or by disconnecting TikTok in Decider; disconnecting deletes the tokens. Use of TikTok is also subject to its terms and privacy policy.

4.4 Kick

• When you connect your account we read your Kick identity (identifier, name, picture and the account's email) and your channel's name, to know which account is yours and which one you enter giveaways that ask for Kick with. We keep the access tokens Kick gives us while it stays connected.
• If you're a participant, when the winner is picked we look up on Kick's website your public standing in the giveaway's channel (whether you follow it and since when, whether you're subscribed and whether you're a VIP or moderator), only to check the requirements. If the giveaway asks for writing in the Kick chat, we check your messages in that chat since the giveaway started.
• If you're a creator and connect your channel with creator permissions, Kick tells us who starts following you, about new, renewed and gifted subscriptions, and when you start and end a stream. For each follower and subscriber we keep their Kick identifier and name, and when the subscription ends, while you keep Kick connected; ended subscriptions are deleted a month later.
• Only while you have the Kick chat panel open or an open giveaway that asks for writing in your chat, Kick sends us your chat's messages (author, badges and text). We keep them for 7 days and then they're deleted automatically. If a giveaway that asks for writing in your chat has no winner yet, we keep the messages written while it was open until you pick one, at most 30 days after it ends. When you use it, we send on your behalf the message announcing the winner in your chat.
• You can disconnect Kick in Decider at any time: we revoke access, delete the tokens and stop receiving your channel's notifications. Use of Kick is also subject to its terms and privacy policy.

4.5 Discord

• When you connect your account we read your Discord identity (identifier, username, display name and picture) to know which account is yours and which one you enter giveaways that ask for Discord with. We don't keep the access token: we revoke it as soon as we've read your identity.
• If you're a creator and you add the Decider bot to your server, the bot can view channels, read message history, create an invite to the server and post messages. We use it to check the winner's requirements (whether they're in the server, their roles, whether they boost it, how long they've been a member, whether they reacted to a message or wrote in a channel or, if the giveaway asks for it, a keyword: for that the bot reads the text of that channel's messages since the giveaway started, only when checking the winner and without keeping it) and, if you turn it on, to post in the channel you choose that you've gone live. We don't keep the messages or reactions: only the result of the check.
• If you turn on alerts, Twitch and Kick notify us when you start and end a stream, and YouTube when you publish a video or go live (public information), so we can post and update those alerts. You can remove them at any time from the Decider Bot page.
• If you turn on community roles, we use your Twitch or Kick account to check which Tepnyx users with that account and Discord connected subscribe to or follow you, to give or take that role in your server. We only keep who the bot gave it to, so it can take it back.
• If you turn on giveaway announcements, the bot posts your public giveaways and their winners; if the winner connected Discord in Tepnyx, it mentions them.
• From an announcement you can enter with the “Enter” button (with the Tepnyx account that has that Discord connected) or ask “Remind me”: we keep your Discord identifier to send you a direct message an hour before the end, and delete it afterwards. If you win a giveaway and have Discord connected, the bot tells you by direct message.
• In Discord quick giveaways (/draw) we keep the Discord identifier of whoever presses “Enter”, to pick the winner and allow rerolls; it's deleted a month after the giveaway ends. To check the requirements we use the role and server join date Discord sends us when the button is pressed. Draws among a message's reactions or replies read who reacted or replied at that moment and keep nothing.
• A Discord account's age is worked out from its identifier, without looking anything else up.
• Decider Bot's server features (turned on by whoever manages the server, from tepnyx.com). Through the bot's always-on connection, Discord tells us who joins the server and who writes in which channel, but not what messages say. We use it only for the welcome (and its automatic role) and for levels: for each person and server we keep their XP, level, how many messages have counted and when the last one did.
• Moderation: for warnings a moderator gives with /warn we keep the server, who was warned, who warned, the reason and the date, for 12 months. The message filter (AutoMod) is applied by Discord with the rules the bot sets up: we don't see blocked messages.
• Suggestions and tickets: for each suggestion sent with /suggest we keep its text, author and status for 12 months; for each ticket, who opened it, its thread and when it was closed (up to 90 days after closing). /poll's polls belong to Discord and we keep nothing.
• If whoever manages the server removes it from their list in Decider or turns levels off, its settings and the whole server's XP are deleted.
• You can disconnect Discord in Decider at any time, and remove the bot from your server in its Discord server settings. Use of Discord is also subject to its terms and privacy policy.

5. Purposes and Legal Bases

6. Providers and Disclosures

We do not sell or rent personal data. We may share limited data with:

• Supabase: authentication, database, file storage and server functions.
• Google (Firebase): website hosting and push notifications to the app.
• Stripe: Premium payments on the web.
• Apple App Store and Google Play: Premium purchases, renewals, cancellations and refunds on iOS and Android.
• Brevo: service emails (verification codes, contact replies and the emails the Tepnyx team writes to you).
• Google (Cloud Translation): automatic translation of the emails the Tepnyx team sends you, so they reach you in your language. It only gets the email's text (subject, message and button), not your email address or account data.
• Cloudflare (Turnstile): anti-bot check on the website's sign-up, username sign-in and contact form. It analyses technical browser and connection data (such as the IP address) only to tell people from bots; it uses no tracking or advertising cookies.
• Cloudflare (R2): storage and delivery of the files you upload to Decider Live, so they show and play in your alerts.
• GIPHY: the GIF and sticker search in Decider Live. We search from our server (GIPHY doesn't get your account data); the GIFs you choose load from GIPHY in your panel and in OBS.
• KLIPY: the other GIF and sticker search in Decider Live. Under KLIPY's terms the search runs from your browser, so KLIPY gets your IP address and what you search for, but not your account data; the GIFs you choose load from KLIPY in your panel and in OBS.
• Openverse: the free (public domain) sound search in Decider Live. We search from our server; listening to one in your panel loads it from where it's published (for example, Freesound), and the one you choose is copied to your files.
• BetterTTV and 7TV: the emotes in Decider Live's on-screen chat. OBS asks them directly with your channel's public id; they don't get your account's or your viewers' data.
• Sentry: app error reports so we can fix them (technical data about the error and device).
• Google/YouTube, Twitch, TikTok, Kick and Discord: connecting accounts and checking requirements, with your authorization. Google and Apple also if you choose to sign in with your Google or Apple account.
• Authorities or third parties: when required by law or necessary to protect rights, safety or prevent fraud.

7. International Transfers

Some providers may process data outside the European Economic Area. Where this happens, we use appropriate mechanisms such as adequacy decisions, standard contractual clauses or other safeguards recognized by applicable law.

8. Retention

9. Identity Verification

The account verification system is designed to confirm that an account holder is who they claim to be, protecting the community from impersonation. When you submit a verification request:

• You provide personal data and, optionally, an identity document (national ID, passport, tax ID or other).
• The document is stored in a private, encrypted storage area accessible only to Tepnyx's review team.
• The document is deleted automatically as soon as the request is resolved, without exception.
• The remaining request data (name, reason, links) is retained for up to 12 months for potential claims or internal audits.
• Consent for this processing is given when submitting the request and may be withdrawn by requesting deletion of the request before it is resolved.
• We do not share identity documents with third parties except where expressly required by law.

10. Giveaway Review and Fraud Prevention

To protect entrants from fake giveaways, Decider automatically reviews every published giveaway: when it's created or edited, when it's reported and once a day.

• What it looks at: the age, followers and connected platforms of the creator's account; reports received by the giveaway and the creator; whether they have limits; whether any of their giveaways were removed or several ended without a winner; what the winners of their giveaways said about the prize; the giveaway's text (typical scam phrases, external links, prizes worth a lot for the account's size); whether the picture or description match another creator's, and whether many entrants are brand-new accounts.
• What can happen: the giveaway may show less in the feed and in search, or only to the creator's followers. It can always be opened with its link and from the creator's profile. Those with the most signals are reviewed by a person on the Tepnyx team, who may approve them, add a visible warning that they might be fake, hide them or remove them. The warning is only ever added by a person. Verified accounts are never limited automatically.
• What the creator sees: in the giveaway's settings, where it shows and the simple rules that affect it (for example, that the account is less than 30 days old or that the prize doesn't say what it is). We don't show the score or the other signals, so they can't be dodged.
• Your rights: it isn't a decision with legal effects on you, but you can ask for a person to review it, give your point of view and object through the contact form.
• Prize confirmation: if you win a giveaway, about 7 days later the app and the website ask whether you got the prize. We keep your answer and its date. The creator doesn't see it; it's used only in this review.
• Entrants' country: in giveaways limited to countries, when you enter we check your account's country; we don't keep anything else for it.

11. Sorty

Sorty is an app for cleaning up your photo gallery. It has no accounts: we don't ask for your email, name or any other data to use it.

• Your photos never leave the phone. Sorty analyses them on the device itself to find screenshots, duplicate or burst photos, dark and blurry photos, and receipts. We don't upload photos, thumbnails, file names or their location to any server, ours or anyone else's.
• Receipt text: to recognise a receipt, Sorty reads the text of some photos with the system's text recognition (Apple Vision on iOS; Google ML Kit on Android), which works offline. The text is neither stored nor sent: only whether the photo is a receipt is kept.
• Data kept on the phone: so as not to repeat the analysis, Sorty keeps in a local database numbers computed from each photo (fingerprints to compare similar photos, brightness, sharpness and the classification result), with no images or text, along with your preferences (theme, language and statistics). They're deleted when you uninstall the app.
• Google ML Kit (Android only): Google's image and text recognition models run on the phone. Under its terms, ML Kit may send Google performance and usage metrics for those features and technical device data, never the photos or their content. More in the ML Kit terms.
• Deleting: Sorty never deletes anything on its own. What you choose is deleted after you confirm it in the system's own dialog. On iOS photos go to “Recently Deleted” for 30 days; on Android deletion is permanent.
• Usage statistics: to know whether the app works well and how many people use it, Sorty sends our server (Supabase) anonymous statistics: when it opens and closes, the kind of photo access you grant, how many photos were analysed and how many of each kind were found, how long it took, how many photos and MB were deleted, and failures (their kind, without their message). They come with the app version, the operating system and its version, the language and a random identifier created when the app is installed, which isn't linked to you, your device or any account. We don't keep your IP address with them. They're kept for 400 days.
• Turning them off: you can turn the statistics off at any time in Sorty's settings; from then on the app sends nothing. The legal basis is our legitimate interest in keeping the app working and improving it, with this right to object always at hand.
• Photo permission: Sorty only analyses the photos you give it access to. You can give it access to all of them, only some, or withdraw it in the system settings.

12. Security

We apply encryption in transit, access controls, authentication, secure token storage, security logs, backups and technical reviews. Even so, no Internet-connected system can guarantee absolute security.

13. Your Rights

You may exercise rights of access, rectification, erasure, objection, restriction, portability and withdrawal of consent through the contact form or by writing to soporte@tepnyx.com. We will respond within 30 days. If you are in the EU, you may also complain to the competent data protection authority, including the Spanish Data Protection Agency.

14. Minors

Decider is not directed to children under 13. The app and the website ask accounts that don't have it yet for the date of birth; if someone says they're under 13, their account works in a limited mode: they can't comment, like, follow, send messages, connect other networks, request verification or buy paid plans, and they only create and enter giveaways by names by invitation. The limits are lifted automatically when they turn 13. If your country requires an older age to consent to the processing of your data (14 in Spain), you need permission from a parent or guardian. If we learn that we process a minor's data without a valid basis, we'll delete or block it as soon as possible; you can tell us at soporte@tepnyx.com.

15. Cookies

The use of cookies, localStorage and similar technologies is explained in the Cookie Policy.

16. Changes

We may update this policy to reflect legal, technical or product changes. Relevant changes will be communicated through the website, app or email where appropriate.