Privacy Policy

Who processes your data

The service operator is Dushat. This policy applies to dushat.com, the account area, constructors, and OBS links issued by the service.

For data access or deletion requests, contact support@dushat.com.

Data we process

• Twitch account: user ID, login, display name, and permissions granted through Twitch.
• Connected services: YouTube and Kick channel identifiers and names, DonationAlerts profile data, OAuth tokens, expiry times, and connection status.
• Content and settings: chat styles, widget configurations, lot names and amounts, bidder aliases, auction events, and results.
• PRO and Boosty: access status, source, and expiry; Boosty subscriber ID and display name; support tier, status, and end date; sync timestamps; and activation audit records.
• Technical data: session and language cookies, one-time OAuth state, security and error logs, and IP address where needed for abuse prevention.

Why we use data

• to authenticate users and maintain a secure session;
• to receive Twitch, YouTube, Kick, and DonationAlerts events and deliver them to the selected OBS widget;
• to save settings, styles, auctions, and result history;
• to verify the Twitch-to-Boosty link, grant or revoke PRO, and prevent duplicate linking;
• to secure the service, diagnose faults, and prevent circumvention or abuse.

Processing is based on performance of the user agreement, steps requested by the user, Dushat's legitimate interest in service security, consent where required, and applicable legal obligations.

Cookies and OBS links

The complete list, purposes, and retention periods are described in the Cookie Policy.

Dushat uses necessary cookies: a session cookie for sign-in, short-lived cookies that secure OAuth, and a language preference cookie. We do not use them for advertising profiles.

Personal OBS links contain a secret access key. Anyone who obtains the link may open the relevant widget. Do not publish it; rotate the link in settings if it leaks.

Boosty and other third-party services

Dushat features rely on Twitch, Google/YouTube, Kick, DonationAlerts, 7TV, and Boosty. When you connect or use a relevant feature, data is sent to that provider and is also governed by its own policies.

For Boosty activation, Dushat checks a one-time code in a comment under the designated subscriber-only post and verifies an eligible support tier. We retain only the data needed to link the subscriber to a Twitch profile, prevent duplicate linking, and calculate the PRO term. We never receive the user's Boosty password or financial details.

Some providers may process data outside the Russian Federation. By using the relevant integration, the user initiates transfer to the selected foreign service.

Retention and security

Account data, settings, and created content are kept while the account exists or while needed for the selected feature. Sessions and temporary OAuth records expire. Activation and security records may be retained longer to prove entitlements, prevent abuse, resolve disputes, and comply with law.

OAuth tokens are encrypted on the server, and OBS keys are stored in a form intended for access verification. No system provides absolute security, so if a leak is suspected, disconnect the integration and rotate the affected link.

Your rights

You may request access, correction, restriction, or deletion of data and withdraw consent where processing relies on consent. YouTube, Kick, and DonationAlerts can be disconnected in the interface; permissions may also be revoked in the provider's settings.

To locate the correct account, a request must come from the account owner and include the Twitch login or Twitch ID. We may verify account ownership before fulfilling the request.

You can delete your profile from the account area after confirming ownership through Twitch again. Deletion permanently removes the profile, OAuth tokens, integrations, saved styles, auctions, sessions, and OBS links, and releases the Boosty link. Active PRO, including lifetime access, is cancelled and cannot be transferred to a new profile.

Limited activation and security records required for abuse prevention, dispute resolution, and legal compliance may be retained in anonymized or pseudonymous form.

After profile deletion, Dushat retains a limited pseudonymous account identifier for up to three years to prevent repeated trial access. It contains no login, name, avatar, or OAuth tokens, is not used for advertising, and is not used to link different accounts.

Local data is deleted immediately after confirmation. Revocation at external platforms depends on provider availability and may complete separately; you can also revoke permissions in the provider's own settings.

Policy changes

This policy may change when features, integrations, or legal requirements change. The new version is published on this page with an updated date. Material changes may also be announced in the Dushat interface.