What we
keep
This covers the website and the chat bot. It is short because there is not much of it: the Bureau records who you are on Twitch and which channels it has seen you in, plus, if you are ever in a Stoat voice call a streamer shows on stream, your Stoat name. The list below is all of it.
What is on file
Your Twitch ID, login, display name and picture, from Twitch's own API, using a token you granted through Twitch's login screen. Each time you sign in, we also keep when you signed in and when you last used it. A sign-in ends after thirty days, or when you sign out.
The badges you hold in each channel (moderator, VIP, subscriber tier and how long for), read off your own chat messages as they arrive. The badges, not the message.
Which channels those were, and when. That list is what the document is made of; it is also the part worth thinking about before you publish it.
Which broadcasts of those channels you were counted at. That is what a streak and a visit count are made of.
Your miles: one row for every port and visit they were earned at, and one for everything you spend them on. It is worked out from the two lists above and adds nothing to them; it is listed here because it is kept as its own ledger.
Anything you hand in yourself: the reason you give with !visa (sixty characters), the papers you fill in at an Inspection Booth, the link and note you send with a video for a media night, the choices you make on your holder record (title, signature, style), the giveaways you enter and any you win, flowers you are given, what you buy in the Duty Free, and any picture you upload as a streamer, with Google's rating of it.
If a streamer has made you a mod of their channel here, your name on their list, and what you did with it: the control room keeps a short log of who approved and declined what.
If you become a Friend of the Bureau: that you paid, how much and when, and whether you asked to be named on the Patrons page. You pay on Stripe's own page, so your card and billing details go to Stripe and never reach us. We do not tell Stripe your Twitch name or anything else from this list; our own note of which payment was yours is the only link between the two.
If you are in a Stoat voice call that a streamer shows on their stream: your Stoat user ID, your Stoat name, and when the Bureau last saw you in a call. If you choose your own call pictures, those pictures too; you can remove them yourself on that page. If you ask to be kept off every Bureau stream, your Stoat ID stays on that list until you change it. The sign-in code the Bureau's bot sends you lasts ten minutes, and the sign-in it gives you lasts thirty days. The call itself is never recorded, and nothing anybody says is kept.
If you stream: your channel's Twitch ID, name and picture; when each of your broadcasts started and ended; and, while you are live, the category and Twitch's public count of how many people are watching, read once a minute and kept as an average and a peak for each broadcast. Also its settings, its control list, anything uploaded to it, and the commands and timed messages written for it. The name and picture appear on the front page while you are live. If you connect your own bot, its sign-in is stored sealed. If you send a problem report, its text and a snapshot of your desk are kept for the person who fixes it.
All of it is kept until you ask for it to go. Nothing expires on its own. The section at the bottom is how you have it removed.
What it is for
Building the passport that appears on stream when somebody types
!passport: the channels you have been seen in, the badges you
hold there, and how long you have been around. Your Stoat details are used
for one thing: drawing your picture in a call a streamer shows, and sending
you the sign-in code you ask for when you choose your own. That is all any
of it is used for unless you publish a page yourself.
Kept without a passport
Someone can talk all day in a channel the bot is sitting in and we keep nothing about them. Your ordinary messages are read for the badges attached to them and then dropped. A few things are the exception:
If you cheer, subscribe, gift or raid, your name goes on that channel's list of its last 200. The message on a cheer, and the one you add when you subscribe or resubscribe, is kept with it so the streamer can read it and say thank you.
If you type !water, your Twitch ID is kept until that plant finishes growing.
If you are in a Stoat call a Bureau overlay is showing, your Stoat ID and name are kept, so you can later ask for your own call pictures.
Typing !house join in a channel running Houses files your Twitch name and picture with that channel's houses. A message there is also checked for the house words, and only how many times each came up is kept, in memory, until the bot restarts.
If you enter a giveaway by typing its entry phrase, your Twitch ID and name are kept with that giveaway, so it can be drawn and the streamer has a record of who entered and who won. For a followers-only giveaway, the bot asks Twitch whether you follow the channel; only the answer is used, and it is not kept.
Pictures
Pictures uploaded for a passport, a stamp or a Stoat call are sent to Google Cloud Vision, which rates whether they look adult, violent or racy and recognises well-known hate symbols, figures and words. Nothing about who uploaded a picture goes with it, and we keep Google's answer next to it. A picture it flags waits for a person before it is shown anywhere.
Every one of those pictures is also reviewed by a person here, because it is going onto a live broadcast. Until then a channel's artwork appears only on that channel's own stream; a Stoat call picture appears at once unless Google flags it. A person can remove any picture at any time. Pictures and clips a streamer puts on their own stream from the desk are not sent to Google and are not reviewed.
When a picture is uploaded, the Bureau's owner gets an email saying which channel it came from, or that it is a Stoat call picture. The picture is not attached. If you pay to become a Friend of the Bureau, you pay Stripe directly, and we tell Stripe nothing about you.
Who else is involved
We do not sell your record or hand it to anybody to use. The Bureau runs on Google Cloud, behind Cloudflare, which sees every visit. Twitch, Stoat, Stripe, Google Cloud Vision and Klipy (the desk's GIF search) are each sent only what their part needs. The front page plays a live channel in Twitch's own player, which follows Twitch's privacy rules.
Like any website, the server keeps a short technical log: the address each request came from, the page it asked for, and the Twitch names of people who use the bot's commands. It is used to fix problems and nothing else.
The site sets no cookies of its own. Your browser keeps your sign-in and a few preferences (theme, plain mode, text size) in its own storage on your machine. If you connect the desk to OBS, the OBS password stays in that browser and is never sent to us.
Your passport page
You can publish your passport at
bureauofchat.com/p/<your-twitch-name>.
It is off until you switch it on in your holder record, and it goes
off again the moment you say so.
While it is on, anybody with the link sees what the card on stream shows: your name, your picture, how long you have been around, and the channels we have recorded you in. That last one says something about what you watch, so give it a thought first. While it is off, nobody can look you up by name: we answer for a name that has not opted in exactly as we answer for a name we have never seen.
The page asks search engines not to index it. We cannot make them listen.
Getting rid of it
Ask, and it goes. Message diminished_seventh on Twitch, or email [email protected], and say which account. Everything in the list above goes at once (the record, the stamps, the entries, the filings, the booth papers, the miles, the mod listings and our note of any payment) and you get back a count of what went. Stoat details go the same way: say your Stoat name and its tag, and your Stoat record and pictures are removed. You can also remove your own call pictures yourself, at any time, on the page where you set them.
Copies of the database are kept as backups, on the server for a week and on the owner's computer for up to 30 days. A removed record stays in those copies until they age out, and is never restored from them. A payment you made stays in Stripe's records, which is where any refund would come from.