1. Controller
The controller for the data processing on badgebase.de under the GDPR is:
Marco Verch
Scanbox #02223
Ehrenbergstr. 16a
10245 Berlin, Germany
Email: badges@badgebase.de
See the imprint for further legal details.
2. Data we collect
a) Server logs
Every page request generates a log entry in our hosting provider's server logs containing:
- IP address
- Date and time
- Requested URL, HTTP status, referrer, user-agent
Purpose: Serving the site, troubleshooting, abuse detection.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
Retention: managed and deleted at short notice by our hosting provider.
We do not store IP addresses in our own database. For rate limiting, abuse detection and counting unique visits we only need to know whether several requests come from the same connection. The IP address is therefore converted into a non-reversible checksum using a secret value known only to us (a “salt”) before anything is stored. The original address cannot be derived from that checksum, and it remains unreadable even if a third party gained access to our database.
Our request_log table therefore stores: this checksum, target URL, status, timestamp, user-agent and traffic source (WEBSITE/EXTENSION).
Legal basis: Art. 6(1)(f) GDPR.
Retention: 30 days, then deleted automatically.
b) Twitch user data
We pull publicly available Twitch data via the official Twitch Helix API and store:
- Twitch ID, login, display name, profile picture
- Broadcaster type (Partner, Affiliate), account creation date
- Cached live-stream status and game category
- Publicly available Twitch badge collections (via GraphQL API)
Purpose: Building collector profiles, leaderboards, comparisons, recaps.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in maintaining a public Twitch fan archive).
Opt-out: Email badges@badgebase.de to have your profile removed and set to noindex.
Email address on sign-in (login): When you sign in with your Twitch account (OAuth), Twitch also shares — with your consent — the email address on file with Twitch (scope user:read:email). We store it against your account to send you a one-time welcome / sign-in confirmation and — only if you enable the Badge Alert in your account settings — new-badge notifications. This is not a marketing newsletter; you can turn the Badge Alert off in your settings anytime.
- Purpose: one-time welcome / confirmation email after sign-in.
- Legal basis: Art. 6(1)(b) GDPR (performing the sign-in you initiated) and Art. 6(1)(f) GDPR (legitimate interest in a one-time welcome message).
- Delivery: via Mandrill (Intuit), see section 3.
- Retention: until your profile is deleted; deletion/withdrawal anytime at badges@badgebase.de.
c) Twitch Extension
If you install our Twitch Extension, it sends your Twitch ID to our server so we can return matching badge stats. We do NOT receive subscriptions or private data.
Legal basis: Art. 6(1)(b) GDPR (contract performance).
d) Donations via PayPal
If you donate via our /donate/ button, PayPal handles the transaction. After a successful payment, PayPal sends us an Instant Payment Notification (IPN) with:
- Donor's first and last name (as provided by PayPal)
- PayPal email address
- Transaction ID, amount, currency, payment date
- Optional memo field the donor filled in
This data is forwarded to Billomat GmbH where a monthly collective invoice is created for accounting.
Legal basis: Art. 6(1)(c) GDPR (legal obligation: tax record-keeping).
Retention: 10 years (German tax retention requirement).
e) Cookies
We set the following cookies:
site_lang(first-party, 90 days) — remembers your language.blog_lang(first-party, 90 days) — remembers your blog language.- Google Analytics:
_ga,_ga_G-3F1ZRM0H5L(third-party).
3. Third-party services
Google Analytics 4
Provided by Google Ireland Ltd., Dublin, Ireland. IP addresses are truncated. EU Standard Contractual Clauses apply for US transfers.
Opt-out: tools.google.com/dlpage/gaoptout.
Fonts
The typeface we use (“Inter”) is served exclusively from our own server. No connection to Google is made and no data is transferred to Google.
Twitch Interactive, Inc.
Badge images, profile pictures and the footer live player are loaded from Twitch's CDN (San Francisco, USA). See Twitch Privacy Notice.
7TV
7TV emotes and profile pictures load from cdn.7tv.app and 7tv.io. Privacy: 7tv.app/legal/privacy.
Cloudinary
Fallback profile pictures are hosted by Cloudinary Ltd. (Israel). Privacy: cloudinary.com/privacy.
Mandrill (email delivery, Intuit)
Transactional emails — the one-time welcome after Twitch sign-in and, only if you enable the Badge Alert, new-badge notifications — are sent via Mandrill (Intuit Inc., Atlanta, USA). Your email address and Twitch display name (for the greeting) are transferred.
Legal basis: Art. 6(1)(b)/(f) GDPR (see section 2b); you can disable Badge Alert anytime in your account settings.
Third-country transfer: Intuit is certified under the EU-U.S. Data Privacy Framework, with EU Standard Contractual Clauses as fallback; a Data Processing Addendum is part of its terms.
Retention: Mandrill send logs per its policy; the underlying email address is stored as described in section 2b.
PayPal
Payment processing by PayPal (Europe) S.à r.l. et Cie, S.C.A. See §2d.
Billomat
Invoicing software by Billomat GmbH & Co. KG, Fürther Straße 244a, 90429 Nürnberg, Germany. Receives donation payment data. Privacy: billomat.com/datenschutz.
All-Inkl (hosting)
Server hosting by ALL-INKL.COM (Germany). Data processing agreement in place. Privacy: all-inkl.com/datenschutz.
Discord Webhooks
Internal operational notifications (e.g. "new badge discovered") are pushed via webhook to Discord Inc. (San Francisco, USA). No personal user data is transferred beyond public Twitch handles in the context of the alert. Privacy: discord.com/privacy.
4. Your rights
Under the GDPR you have the right to:
- Access your stored data (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16)
- Erasure (Art. 17)
- Restriction of processing (Art. 18)
- Data portability (Art. 20)
- Object to processing (Art. 21)
- Withdraw consent at any time (Art. 7(3))
- Lodge a complaint with your national data protection authority (Art. 77) — ours: Landesbeauftragte für Datenschutz und Informationsfreiheit NRW, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.
5. Contact and erasure requests
For anything privacy-related, email badges@badgebase.de with subject line "Privacy".
6. Changes to this policy
We may update this policy when laws or services change. The current version is always at badgebase.de/datenschutz/.
Last updated: 2026-08-25