Privacy Policy

1. Controller

The controller responsible for processing personal data on https://moddrop.live is:

E-mail: datenschutz-moddrop@heerlab.com

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Overview

This policy explains which personal data is processed when you use Moddrop, for what purposes, on which legal basis, and for how long. Moddrop is a private, non-commercial project. Moddrop gives streamers and moderators a shared canvas for live overlays in OBS.

Personal data is not sold and not used for advertising. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Embedded platforms may also process data for advertising under their own policies.

3. Hosting and delivery

Moddrop runs on the controller's own server infrastructure in Germany. Requests from the internet reach the application through a reverse proxy on a virtual server operated by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany (data center in Nuremberg). netcup processes the data as a processor under a data processing agreement pursuant to Art. 28 GDPR. The connection is TLS-encrypted up to the reverse proxy and forwarded from there to the controller's infrastructure through an encrypted tunnel.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is the secure and reliable provision of the website.

For data protection, backup copies are regularly created within the controller's own infrastructure; they are overwritten after their retention period has expired.

4. Server log files

For every request, the reverse proxy automatically stores the following data:

• IP address of the requesting device
• date and time of access
• requested address (path including parameters), HTTP method and protocol
• HTTP status code, amount of data transferred, and response time
• browser identifier (user agent)
• TLS version and cipher used
• target service

The Cookie and Authorization headers are redacted. URL paths and query parameters are logged.

This data is used to operate the site, analyse errors, and defend against attacks and abuse. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is the stability and security of the service. Log files are deleted automatically after 14 days.

Pangolin also processes HTTP request logs, deleted after 14 days, and network logs, deleted after 30 days. Moddrop does not use Pangolin/Pocket-ID single sign-on.

The application processes technical event and error data in short-lived container logs for operation, error analysis and abuse protection. There is no central log collection. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is secure and reliable operation.

5. Protection against attacks (CrowdSec)

To protect against attacks, the security software CrowdSec automatically analyses the server log files and blocks IP addresses that are clearly the source of attacks (for example mass login attempts or scanning for vulnerabilities). When CrowdSec detects an attack, the IP address, time and type of attack are sent to CrowdSec SAS, 20 rue Maurice Arnoux, 92120 Montrouge, France. CrowdSec uses these reports for a shared blocklist that protects many servers. No data is sent to CrowdSec during normal browsing.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is protecting the website and its users from attacks.

According to CrowdSec, the controller and CrowdSec are jointly responsible for this processing (Art. 26 GDPR): CrowdSec is responsible for operating its central services and blocklists, the controller for its use on this server. You can exercise your rights against either of them; CrowdSec can be reached at dpo@crowdsec.net. CrowdSec may pass the reported data on to members and partners of its network. According to CrowdSec, transfers to countries outside the EU are based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Full IP addresses are generally retained for no more than three months and then progressively generalised. CrowdSec describes exceptions of up to one year before anonymisation for certain attack analyses and training purposes. Details: crowdsec.net/privacy-policy.

6. User account and content

Moddrop stores account and profile data, rooms and memberships, canvas content, settings, uploaded media and related file information on the controller's own infrastructure in Germany. This enables collaboration, media delivery and access control. Room participants and authorised OBS sources receive the content needed for these purposes. Content placed in the visible stream area may be broadcast publicly.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is providing the requested functions to authorised users. Data is stored for as long as you use the account, up to 10 years.

Account and profile data, rooms, canvas content and uploads are deleted on request. Please send deletion requests to datenschutz-moddrop@heerlab.com. Deleting your Clerk account alone does not remove this data.

7. Sign-in with Clerk

We use Clerk, Inc., 660 King Street, Unit 345, San Francisco, CA 94107, USA, for sign-in. Clerk processes connection data, account data and authentication information, such as user ID, e-mail address, user name and profile picture. The browser also contacts Clerk on public pages for authentication configuration. You can optionally sign in with Discord or Twitch; identity data you authorise is then exchanged with Clerk.

Clerk is technically necessary for sign-in and session management (Section 25(2) no. 2 TDDDG). The legal basis for processing personal data is Art. 6(1)(f) GDPR; the legitimate interest is restricting editing to authorised users. Clerk is certified under the EU-US Data Privacy Framework; its data processing agreement also provides for Standard Contractual Clauses. The providers retain data for as long as necessary for the purposes described in their privacy policies.

Further information: Clerk privacy policy and data processing agreement.

Discord names Discord Netherlands BV, Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands, for people in the EEA, and Discord Inc., 444 De Haro Street #200, San Francisco, CA 94107, USA, for other regions. Discord describes Standard Contractual Clauses and the Data Privacy Framework for international transfers. Details: Discord privacy policy. For Twitch, see the following section.

8. Twitch and YouTube embeds

Twitch and YouTube content loads when a room displays media configured by its owner. The platforms receive, in particular, IP address, browser and connection data, and information about the page and selected channel or video. They may set their own cookies and process data under their own policies.

Loading is necessary to provide this feature (Section 25(2) no. 2 TDDDG). The legal basis for processing personal data is Art. 6(1)(f) GDPR; the legitimate interest is the requested media display and stream output.

Twitch is provided by Twitch Interactive, Inc., 350 Bush Street, 2nd Floor, San Francisco, CA 94104, USA. Data may be transferred to the USA; see the Twitch privacy notice for details.

For users in the EEA, YouTube is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google LLC is certified under the EU-US Data Privacy Framework; Google also describes Standard Contractual Clauses in its transfer frameworks. Further processing and retention follow the Google privacy policy.

9. tldraw editor

The canvas uses tldraw. The editor loads icons, fonts and translations from cdn.tldraw.com and makes a licence-check request. This transmits connection data and, for the licence request, licence and SDK information and the page address. Canvas content is synchronised with the controller's own backend.

These requests are necessary to provide the editor. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is providing the drawing feature. Section 25(2) no. 2 TDDDG applies to technically necessary local editor settings.

The provider is tldraw Inc., contact address Floor 3, The Arts Building, Morris Pl, Finsbury Park, London N4 3JG, United Kingdom. Data may be processed in the USA, among other countries. For details of processing and retention, see the tldraw privacy policy and licence information.

10. Contact by e-mail

If you contact us by e-mail, your e-mail address, the content of your message and the technical details of the e-mail are processed to answer your request. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is being able to answer requests.

The mailboxes are hosted by Fastmail Pty Ltd, PO Box 234, Collins Street West, VIC 8007, Australia, as a processor. Data may be transferred to countries outside the EU, in particular Australia, the USA and India. For these transfers, Fastmail uses the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). Details: Fastmail privacy policy, data processing agreement and Standard Contractual Clauses. You can obtain a copy of the safeguards by writing to datenschutz-moddrop@heerlab.com.

The controller deletes messages after dealing with the request unless retention remains necessary. Fastmail may subsequently retain backup and log data under its published deletion rules.

11. Cookies and local storage

Storage supports sign-in and the functions you use. Technically necessary access is based on Section 25(2) no. 2 TDDDG. Functional settings remain locally until you delete them; session data ends with the relevant session. Embedded platforms' cookies follow their own policies. You can delete local data in browser settings. This does not delete server data.

12. Your rights

You have the following rights regarding your personal data:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdrawal of consent (Art. 7(3) GDPR): you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

Right to object (Art. 21 GDPR): Where processing is based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation.

To exercise your rights, simply send a message to datenschutz-moddrop@heerlab.com.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).

13. Obligation to provide data

You are not obliged to provide personal data. However, the website cannot be delivered without the technically necessary connection data, and the protected areas cannot be used without signing in.

14. Changes

This privacy policy is updated when the website or the legal situation changes. The version published here applies.