Privacy policy
Version of 29 October 2026
This policy explains what Klips does with personal data. That means your data if you visit klips.live or use the Klips app at https://app.klips.live/, and also the data of players and streamers who have never used Klips. For each use it says which data, why, on which legal basis, who else gets it and how long we keep it.
You can object to a large part of this at any time. That right has its own section: Your right to object.
Who is responsible
The controller under the General Data Protection Regulation (GDPR) is:
Felix Holtkamp (whaamkabaam)
Donaustraße 44
12043 Berlin
Germany
Email: hi@whaamkabaam.com
One person runs Klips, as a sole trader. In this policy "we" and "us" mean the controller named above. Our imprint has the same details.
In short
- Clerk runs sign-up and sign-in for us. Our own server keeps your Riot ID, when you accepted our terms and the matches you check. It doesn't keep your email address.
- To find your clips, Klips reads a match's public data on tracker.gg, all ten players included, and looks for the players' saved streams on Twitch.
- We delete match data 60 days after we first stored it. Your account stays until you delete it on your account page.
- Clips play in Twitch's own player. Nothing from Twitch loads before you press play.
- Klips names a streamer and shows their stream only after that stream has ended.
- klips.live sets no cookies. The app stores what keeps you signed in and, after you pay for Plus, a note that your payment is on its way. Twitch's player and FastSpring's checkout store their own data once you open them.
- We use no analytics and no advertising, and we don't sell data.
- Players and streamers can object at any time without giving a reason. See Your right to object.
Visiting klips.live
klips.live runs on our own server. Hetzner Online GmbH hosts that server for us in a data center in Falkenstein, Germany. When you open a page, your browser sends our server its IP address, the page it asks for, and its name and version (user agent). For each request our server writes a line into its log: your IP address, the date and time, the address of the page or file, the status and size of our answer, and your browser's name and version (user agent). Errors go into a second log, which can also hold your IP address.
The same server runs the Klips app at app.klips.live and at its older address api.klips.live. Its logs work the same way, and some of them also hold the address of the page you came from (referrer).
We use these logs to deliver the pages, to find faults and to fend off attacks. We delete them after 15 days at the latest. The legal basis is Art. 6(1)(f) GDPR: our legitimate interest is a website and an app that work and stay safe.
klips.live sets no cookies and stores nothing in your browser. It has no analytics and no ads. It loads nothing from other servers: its fonts, pictures and scripts all come from klips.live itself.
If you have a Klips account
Signing up and signing in
Clerk, Inc. (San Francisco, USA) runs sign-up and sign-in for us as our processor. You sign up through a friend's invite link: Clerk emails a sign-up link to the address you enter (see If a friend invites you). You sign in with your email address, and Clerk sends you a new code by email each time.
Clerk keeps these sign-in details for us: your email address, your name if you gave one, and your sessions with the IP address and browser of each device. You can see and change them under "Manage sign-in" on your account page.
During sign-up Clerk runs checks in your browser that read features of your browser and device, to tell people from bots. If a sign-up looks automated, for example because it comes through a VPN or a proxy, Clerk also shows a check from Cloudflare (Turnstile), which your browser loads from Cloudflare, Inc. (USA). The legal basis for these checks is Art. 6(1)(f) GDPR: our legitimate interest is to keep fake accounts out of Klips.
From Clerk our server gets an ID for your account and, each time you use the app, a short-lived token that shows you are signed in and on which session. Clerk also sends our server a message when an account is made or deleted, or a session ends. We keep only the IDs: your account's ID with your Klips account, and the IDs of ended sessions and of these messages. When you download your data (see below), our server asks Clerk for your sign-in details (your Clerk ID, name, username, email addresses, and when you signed up and last made a change) and puts them into the file without keeping them.
The legal basis is Art. 6(1)(b) GDPR: we need this to give you your account. Without an email address you can't create an account.
Accepting the terms
Before you can use Klips, you confirm that you are 16 or older and that you accept our terms. We store the time and which version of the terms you accepted. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for keeping the record: our legitimate interest is to be able to show what you agreed to.
Your Riot ID
Next you connect one Riot ID (name and tag) to your account and confirm that it is your own. We store it with your account. If you change it, we delete your old Riot ID from your account, with the list of matches found for it. Checks you made with it stay stored until their 60 days are up, but no longer open. Klips doesn't check with Riot Games that the Riot ID is yours. It uses your Riot ID to find your matches. Without a Riot ID, Klips can't find anything for you. The legal basis is Art. 6(1)(b) GDPR.
Finding your matches and checking one
When you use "Find my clips", Klips asks tracker.gg for the newest matches of your Riot ID in each game mode and notes which matches it found. When you pick one of your matches, or paste its tracker.gg link, Klips starts a check of that match. Klips opens only matches that its records show you played with your Riot ID.
For a check, Klips loads the whole match from tracker.gg, with all ten players. It then looks for the other players' saved streams on Twitch and for your kills and deaths in them. How it does that, and what it uses about the other players, is in the sections for players and streamers. With each check we store the match, which player in it you are, how far the check got, what it found and when you started it.
The legal basis is Art. 6(1)(b) GDPR. We delete a check 60 days after you started it, or earlier when the match itself is deleted (see How long we keep data). We delete each entry in the list of matches found for your Riot ID 60 days after we found it.
Your clip library
Your library shows the matches Klips checked for your Riot ID, with the clips it found. For each match it shows the whole match as tracker.gg shows it publicly: every player's Riot ID, team, agent, rank, stats and the group they queued with, and every kill, spike plant and defuse with the players' positions on the map. For a streamer whose saved stream had you on screen, it shows their channel and which player they were in that match, once their stream has ended.
Pictures in your clip library
Your clip library shows pictures of maps, agents and weapons. Your browser loads them from media.valorant-api.com, a free service for Valorant pictures that says it is unofficial and not endorsed by Riot Games. Its website names no operator and no privacy policy, so we can't tell you who runs it or in which country. Cloudflare's network delivers its pictures. When your browser loads one, that service gets your IP address, your browser's name and version, and the address https://app.klips.live/. It sets no cookies. The check page itself, where a check runs, loads all its pictures from our own server.
The legal basis is Art. 6(1)(f) GDPR: our legitimate interest is to show the game's maps, agents and weapons in your library.
Watching a clip
Clips play in Twitch's own player, from the streamer's saved video. Klips loads nothing from Twitch until you press play on a clip. When you press play, your browser connects to Twitch (Twitch Interactive, Inc., USA). Twitch then gets your IP address and browser data, and it can set its own cookies and show its own ads in the player, for its own purposes. Twitch is not certified under the EU-US Data Privacy Framework, so no EU adequacy decision covers it, and your data doesn't have EU-level protection there.
Under EU law, Twitch and we are jointly responsible for loading the player (Art. 26 GDPR). What Twitch does with your data once its player has loaded is up to Twitch, under its privacy notice: https://legal.twitch.com/en/legal/privacy-notice/. You can use your rights against either of us.
By pressing play you agree that Twitch's player loads, that Twitch gets your data and that it can store data on your device (Art. 6(1)(a) GDPR, § 25(1) TDDDG), and that your data goes to Twitch in the USA without EU-level protection (Art. 49(1)(a) GDPR). Each clip asks again, so you can stop at any time: close the player and don't press play again. Data that Twitch already stored in your browser you can delete in your browser's settings. If you don't press play, nothing goes to Twitch. Links to twitch.tv, such as "Watch on Twitch" or a channel link, open Twitch's own website, where Twitch's privacy notice applies.
Limits and abuse protection
Klips limits how many checks one internet connection can start in a day. For that, our database stores, with each check, a code made from your IP address with a secret key (an HMAC), not the address itself. For IPv6 addresses the code covers only the first half of the address. The legal basis is Art. 6(1)(f) GDPR: our legitimate interest is to stop one person from using up Klips for everyone. The code is deleted with the check, 60 days after you started it.
Inviting friends
When you make an invite link, we store when you made it, whether it was used and when your friend joined. We make each link from a random value and a secret key, so our database alone can't rebuild it. You never see your friend's email address. We store which account joined with your link, so that we can stop invite links from being misused. We delete cancelled and expired links 30 days after they end, and everything else about your invites when you delete your account. The legal basis is Art. 6(1)(b) GDPR for the invites you make, and Art. 6(1)(f) GDPR for the record of who joined with your link: our legitimate interest is to stop misuse of invite links.
Downloading your data and deleting your account
On your account page you can download your data as a file. It holds your Klips account (when you created it, which terms you accepted and when, your Riot ID), your checks, your payment records if you have any, and your sign-in details from Clerk.
You can also delete your account there. We then delete your Klips account, your Riot ID, your checks and the matches found for your Riot ID, and we have Clerk delete your sign-in details. If you have Plus, it ends at once and you won't be charged again. A few things stay, each for the time in How long we keep data: your payment records, without the link to your account; a scrambled form (a hash) of your Clerk ID, so that a late message from Clerk can't bring your account back; our backups; and the data of the matches you played, which every player of those matches shares and which we delete 60 days after we first stored each match.
If you buy Plus
Plus is not on sale yet. This section applies from the day it is.
FastSpring sells Plus to you as our reseller (merchant of record). FastSpring is Bright Market, LLC d/b/a FastSpring (Santa Barbara, USA), which does business in the EU through FastSpring B.V. (Amsterdam, Netherlands).
When you press "Get Plus" on your account page, your browser loads FastSpring's checkout script from sbl.onfastspring.com, and FastSpring's checkout opens in a window over the page. Nothing from FastSpring loads before you press the button. In the checkout, FastSpring collects what it needs for the purchase, such as your name, email address, address, country, payment details and IP address. FastSpring's privacy notice applies to that: https://fastspring.com/privacy/.
FastSpring says that it and the seller are jointly responsible for the data of a purchase (Art. 26 GDPR). The essence of this arrangement: each of us decides on its own processing and tells you about it. FastSpring handles the payment, taxes, the invoice, refunds and fraud checks. We handle your Plus. If you ask one of us about your rights, we agree with each other on the answer. You can use your rights against either of us.
We send FastSpring only which product you buy, a one-time code that ties the purchase to your Klips account, and FastSpring's customer number for you if you bought from FastSpring through Klips before. We don't send your name or email address. FastSpring tells our server your FastSpring customer number, your subscription and order numbers, whether your Plus is active and until when, and any cancellation, refund or chargeback. FastSpring's messages to our server also contain your contact details. We don't store those, and we never see your payment details.
The payment link on your account page takes you to FastSpring's own account page for your subscription.
With Plus, Klips also checks the matches of your Riot ID on its own: it regularly asks tracker.gg for your newest matches and looks for the saved streams of the opponents you killed or who killed you.
The legal basis is Art. 6(1)(b) GDPR. After your Plus ends, we keep the payment records on the basis of Art. 6(1)(f) GDPR: our legitimate interest is to answer questions about refunds and chargebacks. How long is in How long we keep data.
If a friend invites you
If you open a friend's invite link and enter your email address, our server passes it to Clerk, which emails you a sign-up link. Clerk is our processor (see Who gets data). While that link works, our database keeps a code made from your address with a secret key (an HMAC), not the address itself, so that one address can't get two sign-up links at once. We delete the code when you sign up, when your link runs out after 7 days, or when it is cancelled, and then we have Clerk delete the invitation with your address.
The friend who invited you sees when you asked for your sign-up email and until when it works, and later that you joined and when. They don't see your email address. If you make an account, we store that you joined with your friend's link. That record goes when either of you deletes their account.
To stop misuse, our server counts the tries from each internet connection during the day in its memory. It doesn't store them. The legal basis for this count is Art. 6(1)(f) GDPR: our legitimate interest is to stop misuse of invite links.
The legal basis is Art. 6(1)(b) GDPR: steps you asked for before a contract. Without an email address we can't send you a sign-up link.
If you played in a match that a Klips user checked
This part is for every player in a match that a Klips user played in and checked, whether or not you use Klips yourself.
What we get, and from where:
- From tracker.gg (Tracker Network LLC, USA), which shows Valorant match data publicly on its website: your Riot ID (name and tag), your team, agent and rank (and your leaderboard place, if you have one), the group you queued with (party), your stats in the match (such as kills, deaths, assists, score, damage, headshots, first kills, multi-kills and clutches), and every kill, spike plant and defuse in the match with its time, its weapon and the players' positions on the map.
- From your profile on tracker.gg: your Riot account ID, whether your profile is public or private, how often it was viewed, and the accounts linked on it (such as Twitch, X, YouTube, Instagram, TikTok or Facebook).
- From a search on Twitch for your in-game name: Twitch channels with a similar name.
- Made by Klips: whether one of those channels is yours (see the section for streamers).
Why: so that the Klips user can see their own plays in the saved streams of the other players in that match. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is the Klips user's and ours: letting players see their own plays from other players' streams. On your side: Klips works only with matches that are over; it shows your data only to Klips users whose connected Riot ID played in that match (Klips doesn't check with Riot Games that a Riot ID belongs to the person who connected it, see below); it shows a stream only once it has ended; it deletes match data after 60 days; and it stops when you object.
What a Klips user sees about you, if their connected Riot ID played in that match: the whole match as tracker.gg shows it publicly. That is the scoreboard with your Riot ID, team, agent, rank, stats and the group you queued with, and every kill, plant and defuse of the match with its time, its weapon and where each player stood on the map. If you streamed that match, see the section for streamers.
Who else gets it: our host and our other processors (see Who gets data). Twitch gets your in-game name as a search text. tracker.gg gets your Riot ID when we ask for your profile.
Why we didn't tell you directly: we only have your Riot ID. We have no email address or other way to reach you, and we can't contact every player of every checked match. So we publish this policy instead and keep the data to a minimum and for a short time (Art. 14(5)(b) GDPR).
Klips doesn't check with Riot Games that a Klips user's Riot ID is really theirs. If someone has connected your Riot ID to their Klips account, tell us.
If you stream on Twitch
What we get, and from where:
- From Twitch's interface for developers: your channel's ID, login name and display name, and whether you are a Partner or an Affiliate. Your saved videos: their IDs, start times and lengths, and whether everyone can watch them.
- Whether you are live right now. Klips asks this only to wait until your stream has ended. Twitch's answer also contains your stream's title and viewer count. Klips doesn't keep them.
- From Twitch's channel search, when Klips looks for a player's name: your channel, if its name is similar, with the public details Twitch shows in its search results.
- From tracker.gg: a link between a Riot ID and your channel, if a player's profile or the match data shows one.
- Made by Klips: that a Riot ID belongs to your channel and how we found that out; where each round of the match is in your saved video; and whether your video shows the team and agent of that player.
- Frames of your saved video. To find a moment, our server opens your saved video in Twitch's own player and reads a few frames for the round clock, the score and the team and agent icons. If you use a camera, your face can be in those frames. Our server reads each frame in memory and drops it right away. It stores no frames, and nothing analyses faces.
What a Klips user sees, if their connected Riot ID played in that match: your channel name, a link to your channel, your saved video in Twitch's player at their play, and in their library which player in that match you were (Riot ID and agent). Klips shows this only after your stream has ended. While your stream is still running, Klips shows nothing about it.
Why: so that a player can see their own plays from your side, in Twitch's player, from your saved video. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is ours and the player's: offering Klips, and seeing their own plays from your side. On your side: your video plays only in Twitch's player, with your name and Twitch's ads, and if you delete a video, it is gone from Klips too. Klips shows nothing while you are live, never downloads or re-uploads your stream, shows your channel only to Klips users whose connected Riot ID played in that match, and removes your channel if you ask, without needing a reason.
Who else gets it: our host and our other processors (see Who gets data). Twitch gets our requests about your channel and videos.
Why we didn't tell you directly: we can't write to every streamer of every checked match before showing a moment. So we publish this policy instead (Art. 14(5)(b) GDPR). If we ever contact you, our first message points you to this policy and to your right to object.
If you write to us
If you email us or use the contact form on klips.live/contact, we use your email address, your message, your name if you gave one, and anything you send with it, to answer you and to handle your request. Our mailbox is hosted by STRATO GmbH in Berlin, Germany, as our processor. Messages from the contact form are stored in our database on our server at Hetzner (see Who gets data), and we answer them from our mailbox.
The legal basis is Art. 6(1)(b) GDPR if your message is about your account or Plus, Art. 6(1)(c) GDPR together with Art. 12 GDPR if you use one of your rights under the GDPR, and otherwise Art. 6(1)(f) GDPR: our legitimate interest is to answer you. We keep your emails until your matter is closed, and after that until the end of the third year, so that we can show how we handled it. We keep them longer only where tax law requires us to keep business letters.
To stop misuse of the contact form, we store with each message a code made from your IP address with a secret key (an HMAC), not the address itself, and delete the code after 30 days. The legal basis for this code is Art. 6(1)(f) GDPR: our legitimate interest is to keep the form free of spam. We delete messages we mark as spam after 30 days. You have to give an email address, or we can't answer you. When a message arrives, our server can send us a short email saying that a new message is waiting. That email doesn't contain your message or your address.
Your right to object
For your own objection, the legal basis of our handling is Art. 6(1)(c) GDPR together with Art. 12 and 21 GDPR. For a request about someone else's channel or Riot ID, it is Art. 6(1)(f) GDPR: our legitimate interest is to stop misuse of objections.
An older opt-out address
Our server still answers an earlier opt-out address at api.klips.live. No page of Klips links to it, and email or our contact form is the way to object. If a request arrives there, we store what to remove, the reason, the contact email address and a code made from the sender's IP address with a secret key. We keep it until we have answered and for 3 years after that, so that we can show how we handled it.
Your other rights
You have the right to:
- get access to the data we hold about you and a copy of it (Art. 15 GDPR);
- have wrong data corrected (Art. 16 GDPR). We remove a wrong link between a Riot ID and a channel as soon as we know about it;
- have your data deleted (Art. 17 GDPR);
- have its use restricted, for example while we check a request (Art. 18 GDPR);
- get the data you gave us in a common, machine-readable format (Art. 20 GDPR). The download on your account page does this for your account;
- object (Art. 21 GDPR, see Your right to object);
- withdraw your consent at any time, for the future; what we did before stays lawful (Art. 7(3) GDPR). The only consent in Klips is pressing play on a clip: close the player and don't press play again (see Watching a clip);
- complain to a data protection authority (Art. 77 GDPR), in particular in the EU country where you live or work or where you think the breach happened. The authority for us is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany, phone +49 30 13889-0, mailbox@datenschutz-berlin.de, https://www.datenschutz-berlin.de.
How: email hi@whaamkabaam.com. It's free. We answer within one month. If a request is complex or we get many, we can take two more months, and we tell you why within the first month (Art. 12(3) GDPR). If we have reasonable doubts that a request comes from you, we ask for what we need to check it and no more (Art. 12(6) GDPR). Data about a Twitch channel goes only to the person who runs the channel.
Who gets data
Processors, who work for us under a contract (Art. 28 GDPR):
| Who | What for | Where |
|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | our server, its database and its backups | Germany (Falkenstein) |
| Clerk, Inc., San Francisco, USA | sign-up, sign-in, invitations, sessions and bot protection. Clerk uses its own processors, such as Google Cloud, Cloudflare and services that send its emails | USA |
| STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany | our email | Germany |
| Anthropic Ireland, Limited, Dublin, Ireland | AI coding tools we use to build and run Klips. They can see data on our server while we work with them | Ireland; Anthropic and its processors also process data in the USA and other countries |
| OpenAI Ireland Ltd, Dublin, Ireland | AI coding tools we use to build and run Klips. They can see data on our server while we work with them | Ireland; OpenAI and its processors also process data in the USA and other countries |
Jointly responsible with us (Art. 26 GDPR):
- FastSpring, for the purchase of Plus (see If you buy Plus).
- Twitch, for loading its player when you press play (see Watching a clip).
Others, each responsible for its own processing:
- tracker.gg (Tracker Network LLC, USA): our server asks it for match data, match lists and profiles. Our requests contain Riot IDs and match IDs.
- Twitch (Twitch Interactive, Inc., USA): our server asks its interface for developers about channels, saved videos and live status, and searches it for players' names. Our server also opens saved videos in Twitch's player to read frames.
- media.valorant-api.com (operator unknown): the pictures in your clip library (see Pictures in your clip library).
- Klips users whose connected Riot ID played in the same match (see the sections for players and streamers).
- Authorities and courts, where the law obliges us.
Data outside the EU
| Recipient | Country | What makes the transfer lawful |
|---|---|---|
| Clerk | USA | EU-US Data Privacy Framework (EU Commission adequacy decision of 10 July 2023). Clerk's data processing agreement adds the EU standard contractual clauses as a fallback. |
| Clerk's processors, Cloudflare included | USA | Clerk's data processing agreement with us. Cloudflare is certified under the EU-US Data Privacy Framework. |
| FastSpring (Bright Market, LLC) | USA | EU-US Data Privacy Framework |
| Anthropic and its processors | USA and other countries | EU standard contractual clauses in Anthropic's data processing agreement (Art. 46(2)(c) GDPR) |
| OpenAI and its processors | USA and other countries | EU standard contractual clauses in OpenAI's data processing agreement (Art. 46(2)(c) GDPR) |
| Twitch, when you press play | USA | No EU adequacy decision covers Twitch. Your data goes there only after you agree by pressing play (Art. 49(1)(a) GDPR). |
| tracker.gg, for your own Riot ID | USA | No EU adequacy decision covers Tracker Network. We send your Riot ID there because you ask us to find your matches (Art. 49(1)(b) GDPR). |
| Twitch and tracker.gg, for other players and streamers | USA | No EU adequacy decision covers Twitch or Tracker Network, and we have no other safeguard agreement with them. We send tracker.gg only Riot IDs and match IDs that it publishes itself. We send Twitch only channel IDs and the in-game names we search for. |
| media.valorant-api.com | unknown | We don't know who runs it or where (see Pictures in your clip library). |
You can ask us for a copy of the standard contractual clauses named above.
How long we keep data
| Data | How long |
|---|---|
| Server logs with IP addresses (klips.live, app.klips.live, api.klips.live) | 15 days at the latest |
| Technical logs of our programs | until they are overwritten: each program keeps at most 30 MB of log |
| Your Klips account: Clerk ID, when you created it, which terms you accepted and when, your Riot ID, your requests to "Find my clips" | until you delete your account |
| Your sign-in details at Clerk | until your account is deleted |
| Your invite links: when you made them, whether they were used, when your friend joined, and which account joined | until you delete your account; cancelled and expired links 30 days after they end |
| An invite a friend sent you: the code made from your email address on our server, and the invitation with your address at Clerk | until you sign up, your sign-up link runs out after 7 days, or it is cancelled |
| Your checks, with the abuse-protection code made from your IP address | 60 days after you started the check; earlier if the match is deleted first or you delete your account |
| The matches found for your Riot ID | 60 days after we found each one |
| Match data: all ten players' Riot IDs, teams, agents, ranks, stats and kills with positions, and the raw match data from tracker.gg | 60 days after we first stored the match |
| Profile details from tracker.gg (Riot account ID, profile status, views, linked accounts) and name searches on Twitch | 60 days after we last read them |
| Links between a Riot ID and a Twitch channel | 60 days after Klips last saw the link |
| Channel details and the list of saved videos | 60 days after we last fetched them |
| Where the rounds of a match are in a saved video, and the team and agent checks | deleted with the match or the video, at the latest after 60 days |
| Records of our requests to tracker.gg and Twitch, and of the video checks our server runs | 60 days |
| Records of background jobs on our server | 24 hours; 7 days for jobs that failed |
| Backups of our database | 30 days. Data you or we delete is gone from all backups 30 days later. |
| Payment records (FastSpring customer, subscription and order numbers, dates, refunds, chargebacks) | while you have Plus, then until the end of the third year after your last payment, so that we can answer questions about refunds and chargebacks |
| Purchase data at FastSpring | as FastSpring's privacy notice says |
| The scrambled form (hash) of a deleted account's Clerk ID, and the IDs of ended sessions and of Clerk's messages | as long as Klips runs, so that a deleted account stays deleted |
| The do-not-look-up list (objections) | as long as the objection stands |
| Requests that reach our older opt-out address | until we have answered, then 3 more years |
| Emails and contact form messages | until your matter is closed, then until the end of the third year after that; longer only where tax law requires |
| The code made from your IP address with a contact form message | 30 days |
| Contact form messages we mark as spam | 30 days |
| Records of our work with AI coding tools, which can contain data the tools read on our server | kept on our own computer and its backup drive; we haven't set a time to delete them yet |
Our server runs its deletions once a day, so data can stay up to one day past the times above. We keep data longer only where the law obliges us to, or for as long as we need it for a specific legal dispute (Art. 17(3)(b) and (e) GDPR).
Cookies and storage in your browser
klips.live stores nothing in your browser. In the app, we store something on your device or read it from there only where it is strictly needed for what you asked for (§ 25(2) no. 2 TDDDG): signing in, keeping fake accounts out of the sign-up you started, and the Plus checkout once you start it. Twitch's player stores and reads data on your device only after you agree by pressing play (§ 25(1) TDDDG). FastSpring's checkout can store its own data once you open it.
| Name | Where | Set by | What for | How long |
|---|---|---|---|---|
| __session | app.klips.live | Clerk | shows our server that you are signed in | 60 seconds; Clerk renews it while you use Klips |
| __client_uat | klips.live addresses | Clerk | tells the app when your sign-in last changed; holds only that time | Clerk doesn't publish a period |
| __client | Clerk's sign-in address under klips.live | Clerk | keeps you signed in on this browser | long-lived, as long as your browser allows |
| other short-lived Clerk cookies, such as __clerk_handshake | app.klips.live | Clerk | Clerk's sign-in steps | until you close the browser |
| __clerk_environment (local storage) | app.klips.live | Clerk | Clerk's settings for sign-in, so that sign-in still works when Clerk's server is slow | 24 hours |
| Clerk's bot checks and Cloudflare Turnstile | during sign-up | Clerk, Cloudflare | read features of your browser and device to tell people from bots, and show Turnstile when a sign-up looks automated (see Signing up and signing in) | only during sign-up |
| fscLatestSession-..., fscSerial-... (local storage) | app.klips.live | FastSpring's checkout script | your checkout session; only after you press "Get Plus" | until you clear your browser's storage |
| klips.billing.pending (session storage) | app.klips.live | Klips | after you pay for Plus, notes that FastSpring hasn't confirmed your payment yet | until FastSpring confirms it or you close the tab |
| FastSpring's own cookies | inside FastSpring's checkout window | FastSpring | FastSpring's checkout | as FastSpring sets them |
| klips_test | api.klips.live | Klips | only if you opened an invitation link we sent before Klips opened to everyone: keeps that link working on this browser | 30 days |
| Twitch's cookies and storage | inside Twitch's player | Twitch | Twitch's own purposes, ads included; only after you press play | as Twitch sets them |
Klips sets no tracking cookies and no advertising cookies, and it uses no analytics.
Age
You must be 16 or older to have a Klips account. You confirm it when you accept our terms. If you are 16 or 17, you also need a parent's or guardian's agreement to use Klips, and only a parent or guardian can buy Plus for you (see our terms). If we learn that someone under 16 has an account, we delete it.
The players and streamers that Klips looks up can be younger. We don't know anyone's age, so we treat everyone's data with the same limits.
No automated decisions
Klips works out on its own which channel belongs to a player, where your moments are in a saved video, and which clips to show you. None of this is a decision about you that has legal effects or affects you in a similarly significant way (Art. 22 GDPR). Clerk's bot protection can stop a sign-up it takes for automated. If that happens to you, write to us and a person will help.
Security
All connections to klips.live and to the app are encrypted (HTTPS). Our server and its database are in Germany. The database can't be reached from the internet. It stores codes made with a secret key instead of IP addresses. Your sign-in codes go to Clerk and never reach our server. Only we and the processors listed in Who gets data can reach our server and database.
Changes to this policy
We change this policy when Klips changes. The date at the top shows the current version. If a change affects what we do with your data in a way that matters to you, we tell account holders by email before it applies.