Privacy Policy

The data controller for TipPage.com is TipPage.com LTD, a private limited company registered in England and Wales under company number 16850379, with registered office at 128 City Road, London, United Kingdom, EC1V 2NX.

The named data controller is Matthew John Geoffrey Holden. To exercise your data protection rights, make a subject access request, or raise a privacy concern, contact him directly at matt@tippage.com. For general privacy questions you can also reach us at privacy@tippage.com.

TipPage.com LTD is registered with the UK Information Commissioner's Office (ICO) under registration number ZC150903. You can verify this at ico.org.uk.

For tips, overlay settings, bot configuration, and operational data, TipPage.com LTD is the data controller. For content that a Viewer submits to a specific Streamer (tip messages, media requests, donor names, TTS audio), TipPage.com LTD acts as a processor on behalf of that Streamer - the Streamer controls that content for their own channel.

We collect and process the following categories of personal data:

Donation and payment data (from Viewers)

• Display name you provide with your tip
• Tip amount, currency, and payment method (Stripe card or PayPal)
• Message text submitted with your tip
• Media URL and start time if you include a media request
• Payment reference identifiers (order IDs, payment intent IDs)
• A tokenised payer identifier provided by the payment processor (e.g. Stripe card fingerprint, PayPal payer ID, Stripe Link persistent token, or US bank fingerprint) - not your full card number
• Email address you enter at checkout - used to send your receipt, and kept in one-way hashed form for ban enforcement
• Card brand and last four digits as reported by the payment processor (never your full card number) - used only to derive a one-way hash for ban-evasion prevention; we do not retain the digits themselves and they are never shown to Streamers
• A device identifier derived from browser signals when you submit a tip, stored only as a one-way hash, for fraud and ban-evasion prevention

Several of these exist purely so that Streamer bans can't be trivially dodged. They are stored as salted one-way hashes scoped to the individual Streamer - see "How ban enforcement protects your privacy" below for exactly what that means.

Twitch account data

From Streamers and from Viewers who sign in for sub rewards. Viewer sign-ins are scoped per Streamer - signing in on one Streamer's tip page does not grant access to another.

• Twitch user ID, username, display name, profile image URL
• Email address (Streamers only, and only if you grant the scope during sign-in)
• Account creation date (used only for the minimum-account-age check)
• Current subscription tier on the specific Streamer's channel (for sub rewards)
• OAuth access and refresh tokens - encrypted at rest using AES-256-GCM envelope encryption with per-tenant keys

Streamer account configuration

• Branding (display name, colours, logo)
• Payment integration details (Stripe connected account ID, PayPal merchant ID and business email)
• Custom domain records, if configured
• Word filter lists, alert toggles, bot commands, response lists, reward settings
• Twitch IDs of any team members (admins, moderators) invited to help run the account
• Custom bot OAuth tokens (encrypted at rest), if the Streamer has linked their own bot account

Technical data

• IP address - appears in standard HTTP access logs (retained ~30 days) and used transiently for rate limiting. When you submit a tip, a one-way hashed form of the address (scoped to that Streamer, not reversible) is kept with the tip record for ban-evasion prevention; the readable address is not stored with your tip
• Standard server logs (user agent, URL requested, response status, timestamps)
• Session identifiers stored in cookies (see our Cookies Policy)
• Error reports captured by Sentry when something crashes - may include the URL you were on and a short trace. Sensitive data is scrubbed where possible
• Product analytics captured by PostHog on the dashboard (see cookies)

Moderation and safety data

• The original unfiltered text of your name and message (retained for moderation review)
• Records of content filter actions applied to submissions, including the AI's reasoning where AI filtering is enabled
• Ban records if a Streamer bans you, including the reason and the one-way hashed identifiers associated with the banned tip (payment identity, email, device, IP, Twitch account where signed in)
• Where a banned user attempts to tip again, a record of the rejected attempt and the hashed identifiers it carried, which may be linked to the existing ban record

TipPage+ subscription data (Streamers only)

• Subscription status, plan, billing interval, and start/renewal dates
• Stripe customer ID and subscription ID
• Payment method summary (last 4 digits and card brand as reported by Stripe - we do not store full card details)
• Billing history and invoice records

Chat data (via the bot)

When a Streamer enables the bot, it connects to their Twitch chat via EventSub to process commands. We process messages only as needed to respond and apply per-user cooldowns - we do not archive chat history.

Streamers can ban abusive donors from their tip page. For a ban to mean anything, we need a way to recognise a banned person if they try again with a different card, account, or device. We designed this to touch as little personal data as possible:

• Everything is one-way hashed. The identifiers involved (payment identity, checkout email, device identifier, IP address) are stored as salted cryptographic hashes. A hash can be compared for equality, but it cannot be turned back into the original value - not by us, not by anyone.
• Hashes are scoped to a single Streamer. The same person produces a completely different hash on every Streamer's page, so this data cannot be used to follow you from one streamer to another - and we don't.
• If you're never banned, nothing is done with it. For donors in good standing these hashes simply sit alongside the tip record, unused. They are never used for advertising, profiling, analytics, or anything other than checking tips against that one Streamer's ban list.
• We keep only what this purpose needs. No browsing history, no behavioural profile, no data brokers - just the minimum set of hashed identifiers required to stop a banned person from walking straight back in.
• Streamers never see the identifiers. A Streamer's dashboard shows only neutral labels such as "Payment card", "Device", or a masked email like jo***@example.com - never your card number (or any part of it), your full email, or your IP address. The hashes themselves never leave our servers.

If a Streamer has banned you and you attempt to tip them again, the attempt is declined and the identifiers it carried may be linked to the existing ban record so the ban continues to hold; where two ban records turn out to belong to the same person, they may be combined. For card payments this happens before your payment is captured, so you are not charged.

We share data with the following processors, solely for the purposes described:

We do not sell your personal data. We do not share personal data for third-party advertising.

A Streamer (and any admins or moderators they invite) can see:

• Your donor name, tip amount, message text, original (unfiltered) text, and any media you submitted
• If you've signed in for sub rewards: your Twitch display name, username, profile image, and subscription tier

Streamers do not see your payer identifier, card number, billing name, address, or phone number. When a Streamer bans a donor, the ban is placed against the tip itself - the payer identifier behind it is matched by TipPage server-side and is never shown to the Streamer or their team.

Because TipPage is the merchant of record for payments (via Stripe destination charges), Streamers do not see the customer billing details that Stripe or PayPal collect - those stay with TipPage.

Our core infrastructure is hosted in the United Kingdom, where TipPage.com LTD is established. For users in the EU/EEA, transfers of personal data to the UK are covered by the European Commission's adequacy decision for the United Kingdom. Some of the processors listed above are based outside the UK/EEA. Where your data is transferred outside the UK, we rely on one or more of the following safeguards:

• The recipient country has been deemed to provide an adequate level of data protection
• Standard contractual clauses (international data transfer agreement) approved for UK transfers
• The transfer is necessary for the performance of the service you have requested (e.g. payment processing)

Under UK and EU data protection law, you have the following rights:

• Access - request a copy of the personal data we hold about you
• Rectification - request correction of inaccurate data
• Erasure - request deletion of your data, subject to lawful retention grounds
• Restriction - request that processing be limited in certain circumstances
• Data portability - receive your data in a structured, machine-readable format
• Objection - object to processing based on legitimate interest
• Withdraw consent - where we rely on it (e.g. leaderboard display)

To exercise any of these rights, contact our data controller Matthew John Geoffrey Holden at matt@tippage.com. We will respond within one month of receiving your request.

If you are a Viewer and your request is about content you submitted to a Streamer (tip messages, media requests), the Streamer is the controller of that content - we will coordinate with them.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

We implement appropriate technical and organisational measures to protect your data:

• HTTPS/TLS encryption for all data in transit
• AES-256-GCM envelope encryption at rest for all OAuth tokens, Stripe secrets, and PayPal credentials, with per-tenant keys wrapped by a master key stored separately from the database
• HttpOnly, Secure, and SameSite cookie attributes for session tokens
• Parameterised database queries throughout
• Role-based access controls within Streamer accounts (owner, admin, moderator)
• Bot and API-internal endpoints protected by shared secrets

No system is completely secure. If you believe you've found a vulnerability, please email security@tippage.com.

The Service is open to users of all ages. However, paid tips involve financial transactions, and users under 18 should ensure they have appropriate permission before making a payment. The Service is not directed to children under 13 and we do not knowingly collect data from them. If you are a parent or guardian and have concerns, please contact us.

We may update this policy from time to time. Material changes will be indicated by updating the "Last updated" date at the top of this page and, where appropriate, announced in the dashboard. Continued use of the Service after changes constitutes acceptance of the updated policy.

Email privacy@tippage.com for privacy questions, or hello@tippage.com for anything else.

TipPage.com LTD, a private limited company registered in England and Wales (company number 16850379). Registered office: 128 City Road, London, United Kingdom, EC1V 2NX. ICO registration number ZC150903.