Privacy policy

Last updated 10 October 2026

This policy explains what personal data Alphabibi collects, why, and what you can do about it. The controller is Travis Worthing, British Columbia, Canada. Contact: hello@alphabibi.com.

What we collect and why

• Orders. When you buy, Paddle (our Merchant of Record) collects your payment details, email address and country. We never see your card details. Paddle shares with us your email address, country, what you bought and the order number, so we can deliver your downloads, answer support requests and keep tax and accounting records. Legal basis: performing our contract with you, and legal obligations.
• Downloads. When you download a pack, we record the time, which file you downloaded, your approximate country and internet provider (from Cloudflare), how much of the file was transferred, a shortened browser identifier and a one-way keyed hash of your IP address (never the address itself), and we keep these records for 18 months after your order to prevent fraud and resolve refund and chargeback disputes. Legal basis: legitimate interest in preventing fraud and handling disputes.
• Waitlist. If you ask to be told when a letter goes on sale, we store your email address, the letters you chose, the page you signed up on, and when and to what wording you agreed. We first send one email asking you to confirm; nothing else is sent until you do. After that we email you only when your letters go on sale. Every email has an unsubscribe link. Legal basis: your consent, which you can withdraw at any time.
• Resending links. If you ask us to resend your download links, we use the email address you enter only to look up your orders and send the links, and we log the request to limit abuse.
• Twitch sign-in. If you open your order's "Use it on Twitch" link and sign in with Twitch, we store only your Twitch user id and login, linked to that order, so the Alphabibi Pet extension can unlock your letters on that account, and so that signing in with Twitch on alphabibi.com later shows your download links. We never keep a Twitch access token: the sign-in is used once to read your account id, then revoked. If the order is refunded or charged back, its letters are no longer unlocked on Twitch and its downloads are no longer listed. Legal basis: performing our contract with you.
• Emails to us. If you email us, we keep the conversation to answer you.
• Site analytics. We use Cloudflare Web Analytics to count page views in aggregate: which pages are visited, the referring site, and the browser and country. It sets no cookies and doesn't track you across sites. We use it only to see how the site is used. Legal basis: legitimate interest in understanding and improving the site.
• Server logs. Our host (Cloudflare) processes IP addresses and request data to serve the site, rate-limit abuse and keep it secure.

What stays in your browser

The shop remembers the name you typed and your Talk settings in your browser's local storage, so they are still there next time. That data never leaves your device. A Twitch channel name you type to preview a pack is kept only in your browser and never sent to us. We do not use advertising or tracking cookies.

Microphone (optional). On a character's page, the microphone is used only if you turn on "Mouth follows my voice" and then press Talk, and only with your browser's permission. Only how loud you are is measured, inside your browser, to move the character's mouth. Nothing is recorded, stored or sent to us or anyone else. The microphone is released 20 seconds after you last let go of Talk (so you aren't asked again between presses), straight away when you switch the option off, and when you leave the tab.

The Alphabibi Pet extension on Twitch

The extension stores the channel id and the pet's level, experience and counters. When a viewer uses Bits on it, we store the transaction id, the item and the viewer's Twitch user id, and erase the user id after 90 days. The extension sets no cookies and uses no trackers. Twitch's own privacy notice covers what Twitch collects.

Alphabibi Cards

Alphabibi Cards turns a Twitch channel's emotes into a deck of collector cards that viewers pull with channel points.

• Trying it. When you type a channel name on the try page, we ask Twitch for that channel's public profile and emotes and send them to your browser. We don't store them; Cloudflare may cache the answer for up to 10 minutes. A deck you edit before buying stays in your browser's local storage.
• Streamers who own a deck. We store your Twitch user id, login, display name and broadcaster type, your deck and its settings, and the order it came from. If you connect channel points, Twitch gives us a token for one permission (channel:manage:redemptions), which we keep encrypted to create your "Cast a line" reward and mark redemptions done or refund them. We delete it when you disconnect in the studio, when you remove Alphabibi from your Twitch connections, or when you ask us. Legal basis: performing our contract with you.
• Viewers who redeem. When a viewer redeems the reward, Twitch sends us their Twitch user id, login and display name. We store them with the cards they pulled, to show the pull on stream and keep their collection page. Collection pages are public unless the streamer makes them private. A viewer can ask us to delete their collection at hello@alphabibi.com. Legal basis: legitimate interest in running the game the viewer chose to play.
• Cookies. Signing in sets two strictly necessary cookies: abb_tc, for 10 minutes while Twitch sign-in is in progress, and abb_cs, which keeps you signed in to the studio for up to 30 days. Neither is used for tracking.
• How long. A deck, its pulls and its collections stay while the deck exists. If you ask us to delete your deck, we delete it and its viewers' collections.

Feetbibi

• Building. The characters you build stay in your browser: in its local storage, and in the link if you share one. We don't receive them unless you open a shared link, which loads the character from the link itself.
• Creator access. When you buy, we store the order number, your email, the price paid and a one-way hash of your code (not the code itself), to email your code, unlock VRM downloads when you enter it, and handle refunds. Legal basis: performing our contract with you.
• Gifts. For a gift we also store the Twitch name the buyer typed (if any, to address the email). When the gift is claimed we store when, and either the claimer's email (to send them the code) or their Twitch account ID and name (so signing in with Twitch unlocks it on any device). Signing in with Twitch keeps a session cookie, as for Alphabibi Cards.
• VRM files are made in your browser. We don't receive or keep them. Once you enter your code, the builder keeps it in your browser's local storage so you stay unlocked.

Who else processes data

• Paddle (payments, tax, invoices, refunds): see Paddle's privacy policy. Paddle's checkout script loads from cdn.paddle.com only when checkout is open for sale.
• Cloudflare (hosting, order database, file storage, sending order emails, and cookie-free page-view analytics).
• Twitch (sign-in for claiming an order, the extension and its Bits, and Alphabibi Cards' channel-points reward).
• Google Fonts: your browser loads the Fredoka font from Google, which sees your IP address.

We do not sell or rent your personal data.

How long we keep it

• Order records: as long as tax and accounting law requires (often 6 to 10 years), then deleted.
• Download records: 18 months after your order.
• Waitlist: until you unsubscribe or ask us to delete it. If you never confirm, the confirmation link expires after 7 days and we send nothing more. Sign-ups never confirmed, and addresses that unsubscribed, are deleted 30 days later.

Your rights

You can ask to see, correct, export or delete your personal data, object to its use, or withdraw consent, by emailing hello@alphabibi.com. We answer within 30 days. You can also complain to your local data protection authority.

International transfers

Paddle and Cloudflare may process data outside your country. They use safeguards such as standard contractual clauses.

Children

Alphabibi is meant for streamers aged 13 and over, as on Twitch. We do not knowingly collect data from children under 13.

Changes

If this policy changes, we will update this page and its date.