Privacy Notice

1. Controller

Responsible for data processing on this website:

Lukas Hunger
Gartenstraße 11
09618 Brand-Erbisdorf
Germany
E-mail: contact@kalyix.com

2. What data is processed?

2.1. Server log files / hosting

When you access the site, technically required data is processed automatically, e.g.:

• IP address
• Date and time of access
• Requested page/URL
• Referrer URL (if sent)
• Browser type and version (user agent)
• Possibly operating system and similar technical metadata

Hosting provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Data center: Nuremberg (Germany). Data processing agreement per Art. 28 GDPR in place.

Purpose: secure and stable operation of the site, defense against attacks, error analysis. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, stable, efficient operation).

No evaluation for marketing or tracking. Log files are deleted or anonymized after a purpose-bound retention period unless longer retention is required for security or evidence.

2.2. No tracking tools

No web analytics tools (e.g. Google Analytics, Matomo) are used and no third-party tracking scripts are loaded. No advertising cookies, no cross-site tracking, no marketing profiles.

2.3. Newsletter / early access / project updates

If you sign up with your e-mail for updates, early access info or project news, the following is processed:

• E-mail address
• Time of registration
• Possibly technical log data (e.g. IP and timestamp of registration, depending on the mail/backend service)

Purpose: sending KALYIX information (e.g. alpha/beta availability, important changes, status updates). No selling or renting of your e-mail to third parties.

Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw anytime (e.g. unsubscribe or e-mail us).

2.4. User account and login (database)

When you create a KALYIX account or log in via Twitch, the following may be stored:

• User: internal ID (UUID), e-mail (if provided), handle (optional), displayName, avatar URL (if provided), preferred language/locale (optional), newsletter status, timestamps.
• Account (per provider, currently Twitch): provider, providerAccountId (Twitch ID), username (if provided), access/refresh token (if needed/present), expiresAt (if present), relation to the user, timestamps.
• Session: sessionToken, userId, expiry, timestamps.
• VerificationToken: identifier, token, expiry, timestamps.

Optional fields are only stored if the provider supplies them. Purpose: provide login, link your Twitch account, manage sessions, security (abuse/fraud protection).

Legal basis: Art. 6(1)(b) GDPR (contract/pre-contractual steps) and Art. 6(1)(f) GDPR (legitimate interest in a secure and functional auth/session system).

2.5. Cookies

KALYIX uses cookies for login, settings, and consent:

• kalyix_session (httpOnly): session token; ~30 days, with “stay signed in” up to ~90 days; renewed on login/remember updates.
• kalyix_user (non-httpOnly): basic Twitch profile data (ID, displayName, login, avatar URL, possibly e-mail) to simplify frontend display.
• kalyix_settings (httpOnly): settings (e.g. newsletter/remember status) for non-logged-in users; for logged-in users usually stored in DB.
• kalyix_remember (non-httpOnly): true/false whether “stay signed in” is active; indirectly controls session length (30 vs. 90 days).
• kalyix_consent (non-httpOnly): stores your cookie/consent choice.
• OAuth nonce cookie: temporary for the Twitch login flow; removed afterwards.

No advertising/marketing cookies, no cross-site tracking.

2.6. Local storage (browser)

Stored in local storage, among others:

• kalyix:locale: your chosen language (e.g. “de”, “en”) for the UI.
• kalyix_consent: mirror of the consent/cookie choice for a quick client check.

These entries stay on your device and can be cleared in your browser.

3. Data processing in the later KALYIX client

The KALYIX client is meant to run locally on your machine. Depending on use, more data can be processed there (e.g. Twitch events, overlays/logs, plugin data). This processing is fundamentally local and not automatically part of this website.

Once a public alpha/beta of the client is available, a separate plain-language notice will explain what is processed locally, when a server component might be used, and which privacy options you have there.

4. Retention

• Server log files: kept only as long as needed for operation, troubleshooting, and security; then deleted or anonymized unless longer retention is required.
• User account / database: as long as you use a KALYIX account; removed from production DB when you delete your account, unless legal retention applies.
• E-mails for updates/newsletters: as long as you are subscribed or until the list/project ends; can be deleted on request anytime.
• Cookies / local storage: according to configured durations (e.g. session/remember) or until you clear them in your browser.

5. Your GDPR rights

You have in particular the following rights:

• Access to stored personal data
• Rectification of inaccurate or incomplete data
• Erasure, unless legal duties or legitimate reasons oppose it
• Restriction of processing under certain conditions
• Objection to processing based on Art. 6(1)(e) or (f) GDPR
• Data portability in a common, machine-readable format

You also have the right to lodge a complaint with a competent data protection authority if you believe processing violates data protection law.

6. Account deletion and handling of data

You can delete your KALYIX account anytime via the dashboard: https://kalyix.de/en/dashboard?section=settings#settings

You need to be signed in to delete your account.

When deleted, the linked personal data is removed from the production database unless legal retention duties require otherwise.

Technical log data or backups may persist briefly for security/operations and are regularly deleted or anonymized. Legally required retention is limited to the necessary scope.

7. Version

Last updated: 01 Dec 2025