Privacy

Effective September 11, 2026

The one cookie

Logging in with Twitch or YouTube writes one signed cookie to your browser: your public id, name, and avatar. That cookie is the entire login. Nothing is kept on the server. Log out and it is gone.

Login tokens

At login, Twitch or Google hands the site a token. It is used once, to ask who you are, then discarded. It is never saved.

The Twitch login asks for no permissions on your account. The YouTube login asks for read-only access and reads only your own channel's id, name, and picture.

Hatmaster.tv's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Linking accounts

Linking your YouTube channel to your Twitch account stores one record: this channel belongs to that username. Your YouTube shares move into your Twitch portfolio.

The market

The Hatmas Market saves your shares, trades, dividends, and god nominations under your Twitch username or YouTube channel id. Leaderboards are public. The visibility toggle on your portfolio page hides you from them. Hat balances live in the streaming tooling under your Twitch name.

Money

The $5 priority god request is paid on Stripe's checkout page. Your card number goes to Stripe and stays there. Hatmaster.tv keeps only what a refund needs: the god, the name you entered, your message, the amount, and Stripe's receipt id.

Every cookie, listed

• hatmas_session: your login. Lasts 30 days. Logging out deletes it.
• hatmas_oauth_state and hatmas_oauth_link: security cookies for the login round trip. They expire after ten minutes.

Deleting your data

Whisper Hatmaster on Twitch and everything is deleted: portfolio, transactions, account link, payment records. YouTube access can be revoked any time at myaccount.google.com/permissions.

Changes

Updates are posted here with a new date at the top.