Privacy notice

What we collect from streamers

• Your account: email address, password (stored only as a secure hash) and language. If you sign up with Google instead, Google gives us your name, email address and profile picture, and you don't set a password with us.
• Your page: display name, link (handle), photo if you add one, bio, social links, colours and tip amounts.
• Your gateway: the ToyyibPay User Secret Key and category code you connect, stored encrypted. Your bank details stay with ToyyibPay; we never see them.
• Your activity: the tips you receive, your alert settings, and the device and IP address you sign in from, to keep your account secure.
• If you pay for Pro: what you bought, when, the amount and ToyyibPay's payment reference, for your receipts and our accounts. Your bank details stay with ToyyibPay.

What we collect from viewers

• The name and message you type (both optional), the amount, and when you tipped.
• The payment's status and the gateway's reference number, so we can confirm it and show it to the streamer.
• ToyyibPay's payment page asks for your name, email and phone number. ToyyibPay collects those under its own privacy policy; we don't store them.
• Your IP address, briefly, to stop abuse such as too many tips in a short time. We don't keep it.

Before a tip's name and message go on stream, an AI service checks them against the streamer's message rules. If the streamer has Pro text-to-speech on, a speech service reads the name and message aloud. Both receive only the name and message, never your payment details.

Why we use it

• To run streamers' pages, show tips and alerts, and let streamers see their tips.
• To create payments with the streamer's gateway and confirm them.
• To send account emails, such as verifying your email or resetting your password.
• To keep Tiplah safe from fraud, abuse and spam, and to meet our legal obligations.

We don't sell personal data, and we don't use it for advertising.

What's public

• A streamer's page is public: their display name, photo, bio, links and recent tip messages.
• A tipper's name (or "Anonymous"), amount and message appear on stream and in the page's recent messages.

Who we share it with

• ToyyibPay, the payment gateway, to create and check payments.
• Companies that run parts of Tiplah for us: Railway (servers and database), Cloudflare (network and file storage), Resend (email), PostHog (website analytics), Anthropic (the AI check on tip names and messages), Microsoft Azure (text-to-speech for alerts) and Google (if you sign in with Google). They may only use the data to provide their service to us.
• The authorities, when the law requires it.

Our servers are in Singapore, and some of these companies process data in other countries. We only use providers that protect personal data to a standard comparable to the PDPA.

How long we keep it

• We keep a streamer's data while their account is open. When an account is closed, we delete or anonymise its data within 30 days, except what the law requires us to keep, such as billing records.
• Tip records stay with the streamer's account so they can see their history.

Your rights

• You can ask to see the personal data we hold about you, correct it, or ask us to delete it. Streamers can change most of their data in the dashboard.
• Email us and we'll reply within 21 days. We may ask you to confirm who you are first.
• You can withdraw your consent at any time, but we may then be unable to run your page.

Security

• Passwords are hashed, gateway keys are encrypted, and every connection uses HTTPS. Overlay URLs are secret, and streamers can replace them at any time.
• If a data breach affects your personal data, we'll tell you and the Personal Data Protection Commissioner as the law requires.

Website analytics

On our home page, setup guide and legal pages, and while you sign up and set up your page, we use PostHog to see where visitors come from and where they get stuck. It records page views and how the page is used, and may replay a visit to help us fix problems; everything you type is hidden.

It isn't used on creator pages, tip pages, the dashboard or OBS overlays. It keeps a random ID in your browser's storage, not a cookie, and doesn't receive your name or email.

Cookies

We use one cookie to keep streamers signed in. We don't use advertising cookies, and website analytics doesn't use cookies.

Children

Streamer accounts are for people aged 18 and over. Viewers under 18 should ask a parent or guardian before they tip.

Changes to this notice

We'll update this notice when how we handle data changes, and tell streamers by email if the change matters. The date at the top shows the current version.