Privacy

Privacy

What we collect, why, how long we keep it, and what you can ask us to do. "We" is Streema. This page covers the main site at streema.gg and the race pages we host for customers.

Who is responsible

The controller is Streema. Contact: cryptomikko@outlook.com.

Account and sign-in

You can sign in with a wallet, with an email, or with both linked together.

• A wallet address, when you sign in with a wallet (a Base/EVM wallet, a Solana wallet, or one of each linked to the same account). We use it to know which page you own, to take or refund a payment, and, if you turn tips on, to receive tips.
• An email address, when you sign in with email or link one to a wallet. We use it to send the sign-in message and to keep your referral code, invites and quests on one account.
• A contact you type on the page, so we can reach the person who runs that race.
• A session cookie. Wallet sessions (rf_session) last 30 days. Email sessions (rf_user) last 90 days. Signing out deletes that session.
• A short-lived cookie (rf_signin, 15 minutes) that ties a sign-in email to the browser that asked for it, so a forwarded link cannot silently sign someone else in.

Wallet sign-in challenges expire after 10 minutes. Email codes and links expire after 15 minutes and are kept only in memory until they are used or they expire. We do not keep a copy of the message after it is sent.

Affiliate keys

If you create a race page you give us an affiliate API key for Stake, BetBolt, Roobet, Shuffle or Rainbet. Roobet, Shuffle and Rainbet are in beta. The key is stored encrypted (AES-256-GCM) and is used only to read leaderboard data from that platform. We do not use it to send tips, gifts or anything else. Shuffle's secret is the id in the read URL, and Rainbet's key is a query parameter. Both are redacted from logs and error messages. For Roobet we also store the Roobet user ID you enter, because Roobet's API needs it to find your affiliate stats.

Stake affiliate tokens of approved affiliates can also send tips and gifts. Streema never calls those endpoints. If the platform offers a read-only key or scope, use that one. The key stays while the page exists and is deleted with the page.

Race data

• Usernames and amounts returned by the platform, so the leaderboard can be drawn. The public page shows masked usernames. The page owner sees full usernames in the dashboard, because that is who pays the prizes.
• A short-lived copy of the latest board in memory, so every visitor does not trigger a new call to the platform.
• A snapshot of a finished race, with full usernames, kept for the page owner. We keep the last 24 races per page.
• Referral codes, invite counts and quest points for accounts that use those features. A monthly snapshot of those boards is kept for the operator.

Chat bot, milestones and bonus hunts

These features are optional. We only keep data for them if you turn them on in the dashboard.

• Twitch: when you connect, we store your Twitch user id and login, and the id of the account that posts the replies. We do not store a Twitch token. Twitch keeps the permissions you granted, and you can remove them in your Twitch settings.
• Kick: when you connect, we store your Kick user id and channel name, plus the access and refresh tokens Kick gives us. Both tokens are encrypted (AES-256-GCM). Disconnecting deletes them and asks Kick to revoke them.
• Twitch and Kick send chat messages from your channel to us so the bot can answer commands such as !race. We read each message once to find a command and do not store chat messages or the names of the people who wrote them. Our logs only note the command, ids and the page.
• Wager milestones: the tiers you set, and which players you marked as paid in each race (their username and the time).
• Bonus hunts: the hunt name, start balance, and each slot, bet and win you enter. A hunt you mark public is shown on your page. The overlay link contains a secret token so it can be used on stream without making the hunt public.

Live pages directory

streema.gg/live lists race pages that are paid, approved and running. It shows the page's name, logo, colour, platform, prize pool, race dates, player count and the current leader's masked username and amount. Search engines can index it. To keep your page off the list, contact us.

Visitors of a race page

On a customer's subdomain or custom domain we count page views, Join clicks and widget loads per day. Those counts are kept for 90 days and then deleted. We do not store those visitors' IP addresses in that record, and we do not set cookies on race pages.

The server sees an IP address in order to answer the request. We use it in memory to slow down abusive sign-in and API calls. Those rate-limit records are not written to the visitor stats. Google Analytics is not loaded on race pages.

Analytics on the main site

streema.gg (and www) can load Google Analytics 4, measurement ID G-L1W3NSNHJ2, and only after you click Accept. Until then it is off. Reject stores that choice and does not load Google. The choice is a first-party cookie, rf_analytics, kept for 180 days. Use Cookies in the footer to change it. Accepting or rejecting reloads the page so the tag and the page's security policy turn on or off together.

If you accept, Google receives usage data about the main site (pages, a client id, and technical data such as the IP address, which Google may truncate) under its own terms. We use it to see which pages of the main site are used. We do not send race-page visitors to Google Analytics.

Payments

Page fees can be paid in USDC or ETH on Base, or in USDC or SOL on Solana, from a wallet linked to your account. The transaction is public on that chain. We keep the paying wallet, the transaction id, the amount, the asset and network, the time and, for ETH and SOL, the price quote we used, so we can show what was paid and process a refund. Payment records stay for accounting after a page is deleted.

For ETH and SOL we look up a USD price from Alchemy, and check ETH against Chainlink on Base. Those lookups contain only the asset name, never your wallet or any other personal data.

Tips

Tipping is off until the page owner turns it on. If you send a tip:

• We keep the amount, network and asset, the wallet you sent from, the transaction id, and the optional display name and message you typed, so the tip can be checked on chain and shown to the creator.
• Your display name, message and the amount appear on the creator's stream (alerts and recent tips), on their dashboard, and, if the creator set it up, in their Discord. Your wallet address is not shown on stream or in Discord.
• To send a tip, your wallet is told the creator's receiving wallet. The transaction itself is public on Base or Solana.
• A tip that was started but never sent is deleted once it expires. Stream alert events are deleted after 24 hours. Confirmed tips are kept for the creator's tip history and for accounting.

Discord and reminder emails

• Discord (optional, page owners): if you add a Discord webhook URL, we store it encrypted (AES-256-GCM) and post race updates to it: race start and end, the top 3 and milestones with masked usernames, and tips above the threshold you choose, with the tipper's display name and message. Discord receives that content under its own terms. Removing the webhook stops the posts.
• Renewal reminders (page owners): if an email is linked to your account, we email you 3 days and 1 day before a paid period ends, and on the day it ends, through Resend. We keep a record of which reminders were sent so none is sent twice. Every reminder has a link to turn them off.

How long we keep it

• Account, page settings and the encrypted key: while the account or page exists, then until you ask us to delete them.
• Payment records: kept for accounting.
• Confirmed tips: kept for the creator's tip history and for accounting. Unsent tips: until they expire. Stream alert events: 24 hours.
• Discord webhook: until the page owner removes it, or asks us to delete their data.
• Daily view and click counts: 90 days.
• Finished-race snapshots: the last 24 per page.
• Sessions: until they expire or you sign out. Sign-in challenges: minutes, in memory only.
• Analytics choice: 180 days, or until you change it.

Who else receives data

• Google Analytics, only on the main site and only if you accept. Race pages do not use it.
• Hosting. The site is served from a server we operate. Delivering a page means the host handles the connection, including the IP address.
• Stake, BetBolt, Roobet, Shuffle or Rainbet, when we read a leaderboard. We send them the API key and the race dates, to that platform's read endpoint only.
• Resend, when email sign-in is turned on. Your email address and the sign-in message go through Resend so the message can be delivered.
• Fonts are served from our own server. Pages do not load typefaces from Google or any other font service.
• Base and Solana. Wallet payments and tips are public on those blockchains. We do not control that record.
• Blockchain RPC providers (such as Alchemy, or the networks' public endpoints). To check a payment or tip we send them the transaction id and the wallet addresses involved.
• Alchemy and Chainlink, for ETH and SOL prices. Only the asset name is sent.
• Discord, only if a page owner adds a webhook: the race updates and tip notices described above.
• Resend also delivers renewal reminders to page owners who linked an email.

Why we are allowed to

• Contract: the account, the page, the key and the race data, because that is the service you asked for.
• Legitimate interest: keeping the service online, rate limits, and the daily counts on a race page.
• Consent: Google Analytics on the main site. You can refuse it, and you can withdraw it later, as easily as you gave it.
• Legal obligation: payment records we have to keep.

Your rights

If the GDPR applies to you, you can ask us to:

• access the personal data we hold about you, and receive a copy;
• correct it;
• delete it, including the page and the encrypted key;
• restrict or object to processing that is based on legitimate interest;
• receive data you provided, in a portable form, where the processing is based on contract or consent;
• withdraw analytics consent. Withdrawal does not affect processing that happened before you withdrew it.

Write to cryptomikko@outlook.com. We may need to confirm it is you. You can also complain to a data protection authority, for example the one where you live.

The service is for people who are 18 or older. We do not intend to collect data about anyone younger.

Changes

If this page changes in a way that matters, the date below changes with it. The terms of service are a separate document. Questions: cryptomikko@outlook.com. For help with your page, open a support ticket on our Discord (please do not post private keys, API keys or personal data there).

Version 2026-10-25.