Privacy Policy

Last updated: October 8, 2026

This policy explains how Tepnyx processes personal data when you use tepnyx.com (including the Decider web app) and the Decider app for iOS and Android. We process data under the GDPR, Spanish LOPD-GDD and other applicable laws.

1. Data Controller

Tepnyx
Website: https://tepnyx.com
Contact: soporte@tepnyx.com

2. Services Covered

• Tepnyx website: information, account, contact, giveaway search, online wheel and user panels.
• Decider web: creating, running, verifying and resolving giveaways, including giveaways from a Twitch or YouTube live chat.
• Decider for iOS and Android: creating and entering giveaways, profile, followers, likes, comments, mentions, private messages, notifications and the wheel.
• Premium: advanced features, subscription, preferences and customization.

3. Data We Collect

• Account: username, email address, encrypted password, internal identifiers, optional profile image and preferences. If you sign in with Google or Apple, they give us your email address (with Apple it may be a relay address that hides yours), your name, with Google your profile picture, and an account identifier; we never receive your password or access any other data in that account.
• Date of birth: in the app, to check the minimum age (13). It's never shown to anyone. If someone says they're under the minimum age, we don't keep their date — we only mark the account as blocked.
• Social activity on Decider: who you follow, likes, comments, mentions, private messages with other users, blocks and reports.
• Communications: messages sent through forms, support or email.
• Giveaways: creator data, rules, requirements, participants, verification status, winners, history and audit records.
• Usage and device: visited pages, service events, errors, app version, operating system, browser, language, settings and required technical data.
• Cookies and local storage: consent, session, preferences, wheel settings and temporary functional data.
• Premium and payments: subscription status, plan, dates, premium preferences and payment history; for App Store or Google Play purchases, the purchase identifier, to tie the subscription to your account. We do not store card data.
• Notifications: mobile push notification tokens when you enable them.
• Connected social accounts: the account's identifier, name, picture, follower count and the access tokens the platform gives us (see section 4).
• Account verification: full name or company name, aliases, account type (individual or business), reason for the request, online presence links and, optionally, an identity document (national ID, passport, tax ID or other). This data is processed solely to review and resolve the verification request.

4. Social Integrations and Third-Party Data

When you connect a social platform, we use the permissions you grant only to verify giveaway requirements, identify the connected account and provide the requested feature. We do not sell this data or use it for advertising.

4.1 YouTube (Google)

• We use YouTube API Services. By connecting your channel you agree to the YouTube Terms of Service, and Google processes your data under the Google Privacy Policy.
• We read your channel's basic information (identifier, name, picture and subscriber count) to know which channel is yours.
• If you're a participant, when a winner is picked we check your subscriptions (only whether you're subscribed to the creator's channel) and your comments on the videos set as requirements.
• If you're a creator, we read your live chat for live-chat giveaways and, only when you use it, post in that chat the message announcing the winner.
• We don't create, edit or delete videos, playlists, comments or channel settings, and we don't use this data for advertising. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• You can revoke access at any time at myaccount.google.com/permissions or by disconnecting YouTube in Decider; disconnecting deletes the tokens.

4.2 Twitch

• We read your Twitch identity (identifier, name, picture and account email) to know which account is yours.
• If you're a creator, with your permission we look up who follows your channel, who is subscribed and who your VIPs and moderators are, only to check the winner's requirements; we read your live chat for live-chat giveaways and, when you use it, send on your behalf the message announcing the winner.
• Use of Twitch is also subject to its terms and privacy policy.

4.3 TikTok

• When you connect your account we read your TikTok identity (identifier, username, display name and picture) to know which account is yours and which one you enter giveaways that ask for TikTok with.
• If you're a creator and you allow it, we read the comments on your own TikTok videos, only to check whether the winner commented on the video the giveaway asks for. We don't keep those comments: only the result of the check.
• TikTok doesn't allow checking whether someone follows an account, so the creator checks that requirement by hand.
• You can withdraw access at any time from your TikTok settings or by disconnecting TikTok in Decider; disconnecting deletes the tokens. Use of TikTok is also subject to its terms and privacy policy.

5. Purposes and Legal Bases

6. Providers and Disclosures

We do not sell or rent personal data. We may share limited data with:

• Supabase: authentication, database, file storage and server functions.
• Google (Firebase): website hosting and push notifications to the app.
• Stripe: Premium payments on the web.
• Apple App Store and Google Play: Premium purchases, renewals, cancellations and refunds on iOS and Android.
• Brevo: service emails (verification codes and contact replies).
• Cloudflare (Turnstile): anti-bot check on the website's sign-up, username sign-in and contact form. It analyses technical browser and connection data (such as the IP address) only to tell people from bots; it uses no tracking or advertising cookies.
• Sentry: app error reports so we can fix them (technical data about the error and device).
• Google/YouTube, Twitch and TikTok: connecting accounts and checking requirements, with your authorization. Google and Apple also if you choose to sign in with your Google or Apple account.
• Authorities or third parties: when required by law or necessary to protect rights, safety or prevent fraud.

7. International Transfers

Some providers may process data outside the European Economic Area. Where this happens, we use appropriate mechanisms such as adequacy decisions, standard contractual clauses or other safeguards recognized by applicable law.

8. Retention

9. Identity Verification

The account verification system is designed to confirm that an account holder is who they claim to be, protecting the community from impersonation. When you submit a verification request:

• You provide personal data and, optionally, an identity document (national ID, passport, tax ID or other).
• The document is stored in a private, encrypted storage area accessible only to Tepnyx's review team.
• The document is deleted automatically as soon as the request is resolved, without exception.
• The remaining request data (name, reason, links) is retained for up to 12 months for potential claims or internal audits.
• Consent for this processing is given when submitting the request and may be withdrawn by requesting deletion of the request before it is resolved.
• We do not share identity documents with third parties except where expressly required by law.

10. Security

We apply encryption in transit, access controls, authentication, secure token storage, security logs, backups and technical reviews. Even so, no Internet-connected system can guarantee absolute security.

11. Your Rights

You may exercise rights of access, rectification, erasure, objection, restriction, portability and withdrawal of consent through the contact form or by writing to soporte@tepnyx.com. We will respond within 30 days. If you are in the EU, you may also complain to the competent data protection authority, including the Spanish Data Protection Agency.

12. Minors

Decider is not directed to children under 13 and we don't allow them to use it. The app asks for the date of birth before creating an account, and from accounts that don't have it yet; if someone says they're under the minimum age, the account is blocked. If your country requires an older age to consent to the processing of your data (14 in Spain), you need permission from a parent or guardian. If we learn that we process a minor's data without a valid basis, we'll delete or block it as soon as possible; you can tell us at soporte@tepnyx.com.

13. Cookies

The use of cookies, localStorage and similar technologies is explained in the Cookie Policy.

14. Changes

We may update this policy to reflect legal, technical or product changes. Relevant changes will be communicated through the website, app or email where appropriate.