Privacy Policy
This policy explains what cbAlerts collects, why, and what control you have. We collect as little as possible: we do not run advertising, and we do not sell or share your data with anyone for marketing.
What we collect
Account information
- Email address. Used to sign you in, confirm your account, and send password resets. Nothing else.
- Password. Stored only as a scrypt hash with a unique salt. We cannot read or recover it.
- Invite code used at signup.
- Sign-in timestamps and the browser user agent of active sessions, for security.
Chaturbate credentials
If you connect your room, we store your Chaturbate username and Events API token. The token is encrypted with AES-256-GCM before it is written to the database. It is never sent to your browser or included in your overlay page. It is used solely to read events from Chaturbate's API on your behalf.
Alert settings and uploads
Your rules, colours, layout and any images or sounds you upload. Uploaded files are stored with our storage provider and served from a random, unguessable URL.
Event data
When a tip or follow happens, we briefly store the viewer's username and the tip amount so your overlay can display it. These records are automatically deleted after a few hours. We do not build profiles of your viewers and we do not retain chat messages or private messages.
Payments
We record the invoice amount, its status, and the Litecoin transaction ID. We do not collect your name, billing address, or card details, because there are none. We do not know your wallet's identity beyond the public blockchain record.
Technical logs
Our hosting providers keep standard request logs, including IP addresses, for security and abuse prevention. We use IP addresses for rate limiting on sign-in and registration.
What we do not collect
- No advertising or third-party tracking cookies. The only cookies we set keep you signed in and protect against cross-site request forgery.
- No analytics products that profile you across other sites.
- No viewer chat logs or private messages, even though the API scope can expose them.
- No payment card data.
Who we share with
We share data only with the providers needed to run the Service:
- Hosting and database providers, to store and serve your account and settings.
- Email provider, to deliver confirmation and password reset emails.
- Public blockchain data, which we read to confirm Litecoin payments. We only read it; we publish nothing.
We will disclose data if legally required, and we will tell you unless we are prohibited from doing so.
How long we keep it
- Account and settings: until you delete your account.
- Tip and follow events: a few hours, then permanently deleted.
- Sessions: 30 days, or until you sign out.
- Invoices: retained as financial records.
- Unused uploads: removed automatically once no longer referenced by your settings.
Your rights
You can ask us to give you a copy of your data, correct it, or delete your account and everything in it. Email privacy@cbalerts.net from your account address and we will action it within 30 days.
Disconnecting your Chaturbate account from the dashboard stops all event collection immediately.
Security
- All traffic is served over HTTPS.
- Passwords are hashed with scrypt; session tokens are stored only as hashes.
- API tokens are encrypted at rest.
- Rate limiting protects sign-in, registration and password reset.
No system is perfectly secure. If we discover a breach affecting your data, we will notify you promptly.