Privacy Policy

PXON is the data controller. For anything in this policy, email privacy@zomogames.com. We are not required to have a Data Protection Officer and do not have one; that address reaches the people who can actually act.

You do not need an account to watch and to use free items. When you join with a code we create a viewer session holding:

• the display name you typed, which everyone in the match sees
• your language, and a country derived from your connection
• a hashed IP address — the address itself is never written down; it is combined with a secret and hashed, so we can tell two sessions apart and stop flooding without holding the address
• counters for how many free actions you have used
• a random token in your browser identifying the session

Legal basis: legitimate interest in running a working, non-abusable service. There is no profile behind this and it is not linked to you as a person unless you later sign in and claim the session.

You sign in with Twitch, Google/YouTube, Kick or TikTok. We never receive your password. From the provider we store your account id there, your username, display name, avatar URL, channel URL and — for Google — your email address.

We also store the access and refresh tokens that provider gives us. Those are encrypted at rest with AES-256-GCM under a key held only on our server. They are used to read your public channel information and whether you are live, and for nothing else.

Alongside that, your account holds:

• display name, handle, bio, avatar, language
• your diamond balance and every entry in your diamond history
• matches you played, scores and leaderboard positions
• rooms you created or joined, and chat messages you sent
• items you used as a viewer, and which player you aimed them at
• one row per sign-in session: a hashed session token, your browser user-agent string, a hashed IP, and when it was last used — this is what the “where you are signed in” list in Settings is built from

Legal basis: performance of the contract between us. You asked for an account that remembers your scores and your balance; this is that.

We never see your card. The payment happens on Stripe’s own pages and no card number, expiry or security code ever reaches our servers.

What we keep is the record of the purchase: the amount, currency, which pack, Stripe’s identifiers for the session and the charge, the country Stripe reported for the payer, and whether it succeeded, was refunded or was disputed.

Legal basis: performance of the contract, and legal obligation — Dutch tax law requires us to keep the transaction record for 7 years. That means a payment record survives you deleting your account. It is kept detached from your profile, and no longer identifies you by name.

Stripe is a processor for us and a controller in its own right for fraud prevention. Their privacy policy is at stripe.com/privacy.

If you are a streamer, we poll the public APIs of Twitch, Kick and YouTube to know whether you are broadcasting, and store the answer with the time we checked. That is what the LIVE badge is. Only public information is read, and only for channels you have connected yourself.

Zomo sets a session cookie once you sign in, a viewer-session cookie if you join a match, and a cookie remembering your language. All three are strictly necessary for the thing you asked for, which is why there is no cookie banner — there is nothing to consent to, because there is nothing optional.

We run no analytics, no advertising pixels and no third-party trackers.

A streamer’s page can embed their Twitch, YouTube or Kick player. That embed is loaded from the platform in question, and it can see your IP address and set its own cookies under their policy, not ours. The embed only loads on a page where a stream is actually shown.

We do not sell data and we do not share it for advertising. It reaches:

• Stripe (Ireland/US) — payments
• DigitalOcean (Netherlands, Amsterdam) — the servers everything runs on. All data lives in the EU.
• Game servers — when you start a match we hand the game a short-lived ticket containing a per-game pseudonymous player id and your display name. It deliberately contains no email, no account id and no token, and it expires in 90 seconds.
• the streaming platforms you connected, when we ask them whether you are live
• authorities, where we are legally required to

Under the GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to how we use it, and take it elsewhere in a portable form. Email privacy@zomogames.com and we will answer within 30 days.

Deleting your account from Settings removes your profile, handle, chat, scores and connected accounts. Two things survive: payment records, for the 7 years above, and messages other people quoted or replied to, which are no longer attributed to you.

If you think we have handled your data badly, tell us first — and if that does not resolve it you can complain to the Dutch DPA, the Autoriteit Persoonsgegevens, or to the authority where you live.

Zomo is not for under-16s and we do not knowingly hold their data. If you believe a child has an account here, email privacy@zomogames.com and we will delete it.

If we change this materially we will say so in the product before it takes effect, not quietly edit the date at the top.