Extension Privacy Policy

This Extension Privacy Policy applies to the Rock Paper Scissors Championship League! Twitch Extension (the "Extension"), engineered and operated by Canon Evnt, LLC ("Canon Evnt", "we", "us", or "our"). This document describes how our Extension Backend Service (EBS) and frontend views collect, process, and protect user data when broadcasters and viewers interact with the Extension on Twitch.

1. Information We Collect & Process

The Extension operates within the official Twitch Extension Helper sandbox and securely interacts with our Google Cloud Platform backend. We process the following categories of information:

A. Twitch Authentication & Universal Identity Consent

• Opaque User IDs: When an unlinked viewer views the Extension in an active Twitch Panel (Panel 1, 2, or 3), Twitch provides a privacy-preserving opaque identifier (e.g., U12345678) to maintain initial UI state without exposing your personal account.
• Explicit Twitch Identity Sharing Consent (Zero-Fallback): To participate in interactive gameplay (Free Community matches or Bits Tier challenges), submit moves, and record leaderboard rankings, viewers must explicitly grant identity permissions to the Extension. This transmits your verified numerical Twitch User ID and allows our EBS to resolve your public Twitch Helix display name. Requests without explicit identity consent cannot initiate match transactions.
• Broadcaster Channel ID: The numerical Twitch Channel ID where the Extension is installed, used to associate configuration settings, move queues, free daily quotas, and channel-specific leaderboards.

B. Twitch Helix Display Names & Public Leaderboard Visibility

To celebrate match moments and populate competitive rankings, our EBS calls the official Twitch Extension Helix API using Twitch Extension Helper JWT tokens (Authorization: Extension <token>) to resolve and cache public broadcaster and viewer display names. When you participate in interactive matches within the Extension, your public Twitch Display Name, earned digital Prestige Points, rank, milestone badges, and aggregated match statistics are published on in-extension leaderboards, on-stream OBS overlays, and the official web companion leaderboard at canonevnt.io.

Internal authentication tokens, private session keys, and individual raw transaction records are maintained confidentially and are never published to public web endpoints.

C. Gameplay Telemetry, Free & Bits Tiers

• Match Records: Moves chosen (🪨 Rock, 📄 Paper, or ✂️ Scissors), match outcome (win, loss, or draw), timestamp, and match tier type (free vs bits).
• Free Community Match Telemetry: Records of casual matches played, free wins, free losses, free draws, and daily channel quota counters stored in free_matches/{YYYY-MM-DD} (3 daily free matches per channel, resetting at 00:00 UTC).
• 13 Bits Challenge SKU Increments: Records of Bits-powered challenges initiated across 13 registered Twitch Bits SKUs (Micro Challenges: 1, 2, 5, 10, 25 Bits; Milestone Challenges: 50, 100, 250, 500, 1,000, 2,500, 5,000, and 10,000 Bits).
• 10:1 Digital Prestige Points: Non-monetary digital Prestige Points awarded at a guaranteed 10:1 ratio per Bit played upon challenge completion (win, loss, or draw).
• 7 Cumulative Prestige Milestone Ranks: Cumulative point progression tracked across the 7 account milestone tiers (🥉 Scrapper, 🥈 Contender, 🥇 Challenger, 🏆 Champion, 💎 High Roller, 👑 Whale King, and ⚡ Overlord).
• Platform Reach & Exploration Telemetry: List of distinct broadcaster channels challenged across Twitch (uniqueChannelsChallenged) and the total count (totalChannelsChallenged), used exclusively to calculate your worldwide Platform Reach Rank (🌐 #X Worldwide • Y / Z Channels).
• Dual-Identity Stats: Current active season metrics (seasonStats) and permanent lifetime aggregate totals (lifetimeStats).

D. Public Player Profiles & Battle Galaxy Graph

• Sanitized Public Player Tier (public_players/{viewerId}): A public, sanitized data tier storing high-level career achievements (favorite move distribution, win/loss totals, Prestige tier badge, and total channels challenged) enabling player lookup modals on canonevnt.io with 5-minute CDN edge caching.
• Pre-Aggregated Alliance Graph (leaderboards/network_graph): High-level community graph data mapping creator hubs and gladiator connections for the Battle Galaxy network graph. In strict accordance with creator privacy best practices, broadcaster total financial Bits/prestige revenues are never exposed on public network graph endpoints.

E. Transaction Receipts, Security Logs & Abuse Prevention Telemetry

To preserve transaction validity and protect competitive game integrity, the EBS automatically logs and processes technical security telemetry:

• Cryptographic Bits Transaction Receipts: When a viewer uses Bits to initiate a challenge via window.Twitch.ext.bits.useBits, Twitch transmits a cryptographic transaction receipt to our EBS. We store the transaction ID, channel ID, user ID, Bits SKU amount, and timestamp in an immutable audit ledger (transactions/{docId}) solely to prevent duplicate executions and verify commerce fulfillment.
• Anti-Abuse & Anomaly Telemetry: To detect scripted move scrapers, multi-account Sybil bot networks, or unauthorized overlay token access, the EBS logs request timestamps, challenge frequencies, cryptographic JWT signatures, and overlay token access events. These logs are used exclusively for automated abuse detection and security anomaly investigation.

2. How We Use Your Data

We process your data exclusively for operational functionality:

• To execute atomic Rock, Paper, Scissors matchmaking between viewers and pre-queued broadcaster moves in the cloud.
• To broadcast real-time clash countdowns and result banners to active Viewer Panels and OBS Stream Overlays via Twitch PubSub and Server-Sent Events (SSE).
• To compile and display channel-level, global Season 1, and web companion leaderboards.
• To enforce security rules, prevent anti-self-play, account for daily free match allowances, and verify incoming Twitch EventSub webhooks (HMAC-SHA256).
• To protect competitive platform integrity, investigate automated bot attacks, unauthorized move-scraping, or queue tampering, and enforce fair play sanctions.

3. Third-Party Sharing & Zero Brokerage

We never sell, rent, lease, or monetize user data. We do not share personal identifiers or gameplay stats with data brokers or advertising networks. Data is shared only with:

• Twitch Interactive, Inc.: Data communicated via official Twitch Extension APIs, PubSub, and Helix in accordance with the Twitch Developer Services Agreement.
• Google Cloud Platform (GCP): Our cloud hosting infrastructure provider (Cloud Firestore and Cloud Functions v2) operating under enterprise-grade security controls in secure US regions.

4. Data Storage, Security & Encryption

All data processed by the Extension is secured through modern cryptographic standards:

• HS256 JWT Verification: All incoming requests from client views must present a valid, unexpired Twitch Extension JWT signed with the extension's base64 secret.
• Encryption in Transit & at Rest: All communications between the Extension Helper, EBS, and Firestore are encrypted using TLS 1.3 in transit and AES-256 at rest.
• Write-Gated Security Rules: Cloud Firestore security rules strictly block direct client write or delete permissions, routing all mutations exclusively through authenticated EBS microservices.

5. Data Retention & User Deletion Rights

We retain seasonal gameplay statistics for the duration of the active competitive season. When a season resets, seasonal rankings archive, while permanent lifetime totals remain on your user profile.

Exercising Your Right to Deletion ("Right to Be Forgotten")

Viewers and broadcasters have the absolute right to request the complete deletion of their Twitch ID, display name, match history, and leaderboard records from our Cloud Firestore databases. To request data erasure under GDPR, CCPA, or applicable privacy frameworks, simply send an email with your Twitch username or Channel ID to:

📧 RPSChampionship@canonevnt.io (Subject: Twitch Extension Data Deletion Request)

We will verify the request and permanently delete your user document from all Firestore collections within 30 days. Please note that minimal immutable transaction receipts and security blacklists may be retained where required by law for tax/financial audit compliance or to prevent persistent security abuse and ban evasion.

6. Changes to This Extension Privacy Policy

We may update this Privacy Policy periodically to reflect technological improvements or regulatory updates. Any changes will be posted immediately to this URL with an updated effective date.

7. Contact Information

If you have any questions or data privacy inquiries regarding the Extension, please contact our privacy compliance team:

• Email: RPSChampionship@canonevnt.io
• Entity: Canon Evnt, LLC
• Location: Florida, USA
• Website: https://canonevnt.io