Privacy Policy

1. Who we are (controller identification)

Stream Trophy displays PlayStation Network (PSN) trophy statistics and generates overlays for live streams. The controller of the personal data described here is:

• Entity — MARCELO HENRIQUE SANTANA DOS SANTOS DESENVOLVIMENTO DE SOFTWARE LTDA (58.295.820/0001-38).
• Address — Avenida Paulista, 1636, Conj. 4, Pavimento 15, Sala 1504 — Cond. Paulista Corporate, Bela Vista, São Paulo/SP, CEP 01310-200.
• Contact — suporte@streamtrophy.com.
• Data Protection Officer — suporte@streamtrophy.com.

2. Data we collect

• Account data — name, email and avatar provided by your sign-in provider (Google, Discord or Twitch).
• Overlay data — the PSN IDs and settings you configure, and (optionally) an encrypted PlayStation token you provide.
• Usage and security data — IP address, user agent and logs of critical actions (sign-in, subscription changes) kept for security and accountability.
• Subscription data — plan, status and billing dates (payment card data is handled by the payment provider, not by us).

3. Purposes and legal bases (GDPR Art. 6)

• provide and operate the Service — performance of a contract;
• security, fraud prevention and audit logs — legitimate interests;
• analytics and marketing cookies — consent (see our Cookie Policy);
• comply with legal obligations (e.g., tax records for future transactions) — legal obligation.

4. Sharing and sub-processors

We do not sell your personal data. We share it only with the processors (sub-processors) needed to run the Service, each under contract and only as necessary:

• Sign-in providers — Google, Discord and Twitch (OAuth).
• Sony Interactive Entertainment / PSN — queried to fetch trophy data.
• Hosting & delivery — Vercel.
• Cookieless analytics & performance — Vercel Web Analytics and Speed Insights, which measure traffic and technical performance metrics (Web Vitals) in an aggregate, anonymous way (page views, approximate origin, device type, load times), with no cookies, no identification and no cross-site tracking. Legal basis: legitimate interest in understanding usage and improving the Service.
• Database — a managed PostgreSQL provider (e.g., Neon).
• Cache — a Redis provider.
• Payment processor — Stripe, when you subscribe to a paid plan (full card data stays with Stripe, not with us).

This list may be updated as our infrastructure evolves; the date at the top reflects the latest revision.

5. Cookies

We use essential cookies for authentication and security, and — only with your consent — analytics/marketing cookies. Manage your choices anytime via the cookie banner or the Cookie Policy.

6. Retention

We keep your data while your account exists. When you delete your account, personal data is removed or irreversibly anonymized, except records we must retain by law (e.g., transaction/tax records that will apply once billing is enabled).

7. Security

Sensitive secrets (such as the PlayStation token) are encrypted at rest and never exposed in overlay URLs. We apply reasonable technical and organizational measures to protect your data.

8. Your rights (GDPR)

If you are in the EEA or UK, you have the right to access, rectify, erase, restrict and object to processing, and to data portability. You can also withdraw consent at any time.

• Access & portability — export all your data from My account → Privacy & data.
• Erasure — delete your account from the same screen.
• Other requests — email suporte@streamtrophy.com. You may also lodge a complaint with your local supervisory authority.

9. California residents (CCPA/CPRA)

If you are a California resident, you have the right to know, delete and correct your personal information, and to opt out of its sale or sharing. We do not sell or share personal information as defined by the CCPA/CPRA. Exercise these rights via the tools in My account or by contacting suporte@streamtrophy.com; we will not discriminate against you for doing so.

10. International transfers

Your data may be processed in countries other than yours. Where required, we rely on appropriate safeguards (such as the EU Standard Contractual Clauses) for such transfers.

11. Children

The Service is not directed to children under 16 (or the minimum age required in your country). We do not knowingly collect their data.

12. Changes and contact

We may update this policy as the Service evolves; the “Last updated” date above reflects the latest revision. Questions? Contact suporte@streamtrophy.com.