Vox

Privacy Policy

Last updated: July 11, 2026

1. Who we are

Voxq ("we", "us") operates a viewer decision engine for live streamers. This policy explains what personal data we process, why, and what rights you have.

2. Data we collect

If you create an account

  • Account data — you sign in with a social account (Google, X, Discord, Twitch, or Kick); we never see or store a password. We store the identifier of the linked social account, your email address, display name, username, and profile details (bio, avatar, social links) you choose to add.
  • Activity data — queues you create, suggestions and votes you make, follows, team memberships, and moderation actions you take. Moderation and admin actions are kept in append-only audit logs.

If you participate without an account

  • Anonymous fingerprint — to prevent duplicate votes and enforce suggestion limits, we compute a SHA-256 hash of your IP address and browser user-agent. The raw IP address is never stored; only the irreversible hash is kept.
  • Guest name — a randomly generated display name (e.g. "Guest_7X4K") stored only in your browser's session storage. It disappears when you close the tab.

3. Cookies and local storage

  • Strictly necessary — our own authentication/session cookie so you stay signed in. This does not require consent.
  • Functional local storage — your cookie-consent choice and interface preferences, stored in your browser only.
  • Analytics (consent-based) — we use Google Analytics (via Google Tag Manager) to understand how visitors use the site — pages visited, session duration, browser type, and country-level location. Google Analytics assigns a randomly generated ID to distinguish visitors; it does not identify you personally. For visitors in the EU/EEA/UK, analytics cookies are only set after you opt in via the cookie banner. For other regions, analytics are active by default and you can opt out at any time via the "Cookie preferences" link in the footer. The cookies set are _ga and _ga_* (up to 2 years).
  • Advertising (consent-based, not currently active) — we do not currently show any advertising. If ads are introduced in the future, ad code would only load if you opt in to the advertising category in the cookie preferences, and you can change that choice at any time via the "Cookie preferences" link in the footer.

4. Third-party processors

  • Social sign-in providers — Google, Discord, Twitch, and Kick act as identity providers when you sign in. Each shares your basic profile (name, email, avatar) with us per its own privacy policy; we do not receive your password.
  • Resend — transactional email delivery.
  • DiceBear — profile avatars are generated by the DiceBear HTTP API. The image URL contains only your chosen art style and a random seed — no personal data is transmitted.
  • Google — Google Analytics (via Google Tag Manager) collects anonymised usage data (pages visited, session duration, browser/device type, country-level location). Data is processed by Google LLC under its privacy policy. For EU/EEA/UK visitors, analytics cookies require your consent; for other regions, analytics are active by default and you can opt out via "Cookie preferences" in the footer.
  • Advertising networks — none currently; would only apply if advertising is introduced, and only after consent.
  • Media platforms — if you submit a YouTube or Spotify link, we fetch its public title and thumbnail from that platform's oEmbed service. No personal data is sent beyond the URL you submitted.

5. Legal bases (GDPR)

  • Contract — operating your account and the queues you participate in.
  • Legitimate interest — abuse prevention (hashed fingerprints, rate limiting, sanctions), service security, and audit logging.
  • Consent — analytics cookies (Google Analytics, for EU/EEA/UK visitors); advertising cookies, if advertising is ever introduced.

6. Retention

Account data is kept while your account exists. Deleting your account removes your public presence; some records (moderation audit logs, sanction records) are retained where we have a legitimate interest in keeping them for abuse prevention. Anonymous fingerprints are irreversible hashes and are not linked back to you.

7. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict processing, and to lodge a complaint with your supervisory authority. Contact us at [email protected] to exercise these rights.

8. Children

The Service is not directed at children under 16, and we do not knowingly process their data. If you believe a child is using the Service, contact us and we will remove the data.

9. International transfers

Our processors may store data outside your country. Where GDPR applies, transfers rely on adequacy decisions or standard contractual clauses maintained by the processor.

10. Changes to this policy

We may update this policy from time to time. Material changes will be announced on the Service, and the "Last updated" date above always reflects the current version.

11. Contact

Privacy questions and data requests: [email protected].