Privacy policy

Version 1.0 of 2026-10-24.

This policy explains what personal data the overlay.uz service processes, why and how, how long it keeps the data and to whom it passes it. It follows the Law of the Republic of Uzbekistan “On Personal Data” of 2 July 2019 No. ZRU-547 as amended (the Law), above all its Articles 22 and 23.

The operator

The operator and owner of the personal data database is Karshiyev Suxrob Suxvat oʻgʻli, a private individual, Republic of Uzbekistan. The service belongs to the operator.

For any question about your data, write to support@overlay.uz.

What applies now

The service is in development, and there is no sign-in on the site yet. The site itself collects nothing about you: it has no forms, cookies, counters, ads or third-party scripts. The web server keeps only a technical log of requests (see “The server log”).

Everything below about the account, the platforms, chat and donations starts to apply when sign-in opens (the beta). The policy describes that processing in advance so you can read it before you register.

What data we process

The service processes the data of streamers who have an account, and the data of their stream viewers to the extent the platforms pass the viewers' messages and donations to the streamer's overlay.

The account

When you sign in with Twitch or Google, the platform gives us your id on it, your name (login and display name) and your email address, if the platform provides it. For YouTube, also the id and title of your channel.

The platforms' access keys

When you connect Twitch, YouTube or Taps, the platform issues an access key: an OAuth token, or a widget token for Taps. With it the server receives your channel's events and performs the actions you enabled, such as Twitch polls and predictions.

The keys are stored in the database encrypted. The encryption key is kept outside the database, so a copy of the database alone does not reveal any access key.

Chat messages

Messages from your stream's chat: the author's nickname and platform id, the text, the time and the platform's badges (for example, moderator or subscriber). They are needed to show the chat on the overlay, apply your word filter and count the stream's results.

Donations and paid events

Donations from Taps and other donation services you connect, and the platforms' paid events (Twitch bits, YouTube Super Chat and Super Stickers, subscriptions and memberships): the donor's name, the amount and currency, the message, the time and the source. They are needed for alerts, reviewing donations before they are shown, goals and reports.

Settings and summaries

Your overlay settings (scene layouts, widgets, the word filter, alert rules) and stream summaries: donation totals, viewer and subscription counts and other results, without message texts.

The server log

The web server and the application server keep a technical log: the time, the requested address, the IP address, the browser (User-Agent), the response code and errors. Access keys, passwords and chat texts never go into the log.

Purposes and methods

We process data only to:

let you sign in and keep your account;
show on your overlay what you set up: alerts, chat, goals, donations, CS2 and FaceIt data;
perform actions on the platforms and in OBS at your command: polls, predictions, switching scenes through the plugin;
build your stream reports;
keep the service working and secure: find errors, fend off attacks, restore data after a failure.

The processing is automated: receiving data from the platforms, writing it to the database, storing it, showing it on your pages and deleting it on schedule. We do not sell data, show ads, build advertising profiles or make automated decisions that have legal effects for you.

Sources of data

you — when you sign in and in the dashboard;
Twitch (Twitch Interactive, Inc.) — the account, channel events, chat;
Google and YouTube (Google LLC) — the account, the stream's chat and events;
Taps and other donation services you connect — donations;
the CS2 game on your computer — the match state it sends to the address with your key;
FaceIt — the public statistics of the player whose nickname you enter;
the OBS plugin on your computer — the state of OBS scenes and sources.

Retention

Chat message texts and viewers' nicknames — 30 days, then deleted.
Donation messages — 30 days. The donor's name — 12 months. The amount, currency, time and source of a donation stay in reports without the name while the account exists.
Data received from YouTube — no longer than 30 days without a refresh (see “Google and YouTube”).
The account, settings, summaries and the consent record — while the account exists.
A platform's access key — while the platform is connected. On disconnect the key is deleted at once; Twitch and Google keys are also revoked at the platform. We cannot revoke a Taps widget token on our side: you can reissue it in Taps.
The server log — 14 days.
Backups — see “Backups”.

Who receives data

We pass data only in the cases below and only as far as the feature you enabled needs:

Twitch — requests on your behalf with your access key: subscribing to channel events, chat, polls, predictions;
Google and YouTube — requests to the YouTube Data API and the stream's chat with your access key;
Taps — the connection to your donation widget by its token;
FaceIt — the nickname of the player whose statistics you show;
the emote services 7TV, BetterTTV and FrankerFaceZ — the public id of your Twitch channel, to get the channel's emotes;
the hosting provider in Uzbekistan whose server runs the service — stores the data and its backups as a contractor, with no right to use them;
public authorities — only in the cases the law expressly provides.

Failure alerts that the operator receives name an account only by its internal number.

The overlay pages in OBS and the dashboard load images — emotes, chat badges and avatars — straight from the servers of Twitch, YouTube and Google, 7TV, BetterTTV and FrankerFaceZ. Those servers see the IP address and the browser of the computer where the page is open.

Backups

Every night the backup service of the hosting provider in Uzbekistan makes a copy of the database. The copies are kept for 7 days, so data deleted from the database leaves the copies within 7 days. If the database has to be restored from a copy, we delete again everything that was deleted after the copy was made.

Transfer abroad

The server and the database are in Uzbekistan. When you use the platforms' features, the service sends data to their operators abroad:

Twitch Interactive, Inc., USA;
Google LLC (including YouTube), USA.

The FaceIt, 7TV, BetterTTV and FrankerFaceZ services receive only a public player nickname or channel id. These platforms' image servers see the IP address and the browser of the computer where your pages are open (see “Who receives data”).

The basis for the transfer is your consent (Article 15 of the Law), which you give when you register and when you connect a platform. The USA is on the list of countries with adequate protection of data subjects' rights only for companies taking part in the EU-U.S. Data Privacy Framework. Google LLC states that it is certified under this framework. Without your consent, these platforms' features are not turned on.

Google and YouTube

The service uses YouTube API Services. The use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we receive. With Google sign-in — your id, name and email address. When you connect YouTube (read-only access, youtube.readonly) — your channel's id and title, details of your streams (whether you are live, the viewer count), your stream's chat messages, Super Chat, Super Stickers and new members.
Why. Only for the features you see in the service: the overlay, chat, alerts, goals and reports.
What we do not do. We do not sell this data, use it for ads or to train artificial intelligence models, or pass it to anyone except in the cases of “Who receives data”. People read it only with your consent, for security, or when the law requires it.
How long. Data received from YouTube is kept for no longer than 30 days. Summaries kept longer are checked against YouTube every 30 days: if access has been revoked, we delete everything received from YouTube within 7 days.
Disconnecting. You can disconnect YouTube in the dashboard: the access key is revoked at once, and the data received from YouTube is deleted within 7 days. The same applies at your request by email.
Revoking access at Google. You can also revoke the service's access on the third-party access page of your Google Account.

How Google processes your data is described in the Google Privacy Policy.

Twitch

When you connect Twitch, the service asks for permission to read bits, subscriptions, channel points rewards, Hype Trains, new followers and chat, to run polls and predictions, and for chat bot rights on your channel. They are needed for alerts, chat and the actions you start from the dock.

You can disconnect Twitch in the dashboard or in Twitch's connection settings. How Twitch processes your data is described in the Twitch Privacy Notice.

How we protect data

Each streamer sees only their own data: the database itself enforces this (row-level security), not only the service's code.
Access keys are encrypted, and the encryption key is kept apart from the database.
The site works only over HTTPS, and the database is reachable only from inside the server.
Access keys, passwords and chat texts never go into the logs.
The sign-in session is kept in a cookie that the page's scripts cannot read.

Cookies

The site sets no cookies now. Once sign-in opens, the service sets one session cookie, only to keep you signed in. Scripts cannot read it, and it is not used for ads or analytics. There are no third-party cookies or counters.

Breaches

If a personal data breach is discovered, we notify the authorized public body within 24 hours of the discovery and report to it the causes and the measures taken within 72 hours. We inform the affected users without delay, by email or in the dashboard.

Clause 4 of Cabinet of Ministers Resolution No. 415 requires such a notice for breaches during a cross-border transfer; we apply this rule to every breach.

Your rights

Under Article 30 of the Law you have the right to:

know whether your data is processed and receive information on the purposes and methods of processing, the recipients, the sources, the retention periods and transfer abroad;
have inaccurate data corrected;
have the processing suspended or your data deleted;
withdraw your consent to the processing;
appeal against our actions to the authorized public body or a court.

To exercise a right, write to support@overlay.uz from the address linked to your account, or name the platform and your nickname. We may ask you to confirm that the account is yours. Viewers whose messages or donations passed through the service write in the same way.

Response times:

information about the processing — within 10 days;
correction of data — within 3 days;
deletion of data — within 7 days;
a refusal, where there is a lawful ground for it — in writing, with the reason, within 10 days.

Deleting the account

You can delete your account by writing to us at support@overlay.uz. Within 7 days we delete the account, the settings, the summaries, the access keys (Twitch and Google keys are revoked at the platforms at once; a Taps widget token can be reissued in Taps) and everything received from the platforms. Data leaves the backups within the following 7 days (see “Backups”).

Age

The service may be used by persons aged 18 and over. Persons under 18 may use it only with the consent of a parent or guardian (Article 21 of the Law), confirmed by a separate checkbox at registration. If we learn that an account was opened by a person under 18 without such consent, we delete the account and its data. A parent or guardian may write to us and ask for deletion.

You give consent to the processing under this policy at registration, with a separate checkbox. We record the time of the checkbox and the version of the policy you agreed to. When you connect a platform, you also consent to the transfer of data to its operator (see “Transfer abroad”).

You can withdraw your consent by email. The service cannot work without it, so withdrawal leads to the deletion of the account (see “Deleting the account”).

Languages

The policy is published in Russian, Uzbek and English. If the texts differ, the Russian text prevails.

Changes to the policy

We change the policy when the processing changes. Each version has a number and a date, shown at the top of the page. We announce significant changes in advance in the dashboard or by email, and if a change needs new consent, we ask for it at your next sign-in.