1. Who we are
XtreamChaos is the service at xtreamchaos.com, the XtreamChaos Windows and Android apps, and the XtreamChaos Discord bot. In this policy “we” means the operator of XtreamChaos. You can reach us any time in the XtreamChaos Discord server.
2. What we collect
Your account
- Email address and a password (stored as a hash by our authentication provider, never readable by us), or a Discord sign-in instead of a password.
- A display name you choose.
- The TikTok username(s) you type into your stream profiles. This is the public handle; we never ask for your TikTok password.
- Your plan, where it comes from (a subscription, a Discord role, or a grant by staff) and when it ends.
Your setup
- Everything you configure in the panel: actions, events, overlays, goals, points rules, song request settings, gift deck cards, game mod settings.
- Files you upload: sounds, images, GIFs, videos, animations. These are stored so your overlays can play them.
- Keys you add for other services (for example an ElevenLabs key for voices, an OBS WebSocket password, a Spotify connection). They are stored on your account and used only from our servers or your own app to do the thing you added them for. They are never shown to other people.
Diagnostics
The Windows app and browser panel send your account ID, app version, event time and a short failure code when they detect an unexpected exit, connector error, stalled stream connection or failed action. A report can include bounded connection timing, frame count, renderer exit code, error fingerprint, platform, trigger, action and game mod identifiers, and up to three recent trigger and action codes. Windows reports retry after you sign in if the service was unavailable. Reports are forwarded to our private staff diagnostics channel and deleted from the database after 14 days. They do not include raw logs, game files, chat messages, URLs or access tokens.
Your LIVE, while you are connected
- When you connect a TikTok LIVE, XtreamChaos reads the public events of that stream: gifts, likes, follows, shares, comments and the public usernames of the viewers sending them. That is how your actions fire.
- Some of this is kept: viewer usernames and points balances (for your points system and leaderboards), session statistics for your overlays, and the events that fired. Comments are processed for text-to-speech and chat commands and are not kept beyond what your overlays and points need.
Payments
- New payments are handled by Stripe. We receive the subscription or checkout id, the plan or add-on bought, the amount, and the payment status. We keep historical PayPal billing records. We never see or store card numbers or bank details.
Discord
- If you link Discord, we store your Discord user id, username and avatar, and read which roles you hold in the XtreamChaos Discord server, because some roles grant a plan. The XtreamChaos bot also gives paid plans a role in that server.
- In the XtreamChaos Discord server the bot reads messages in the support channel to answer common questions, and stores nothing from them.
TikTok account connection (Login Kit)
- If you sign in with TikTok or connect your TikTok account, TikTok sends us your open id, display name and avatar (user.info.basic), and - only if you grant them - your profile links and bio (user.info.profile), your follower, following, likes and video counts (user.info.stats) and the list of your public videos (video.list). We use these to show your account and its statistics inside your panel and to match your LIVE connection to the right account.
- If you grant video.upload or video.publish, XtreamChaos can send a clip to your TikTok as a draft, or post it, only when you press the button to do so. Nothing is ever posted to your account automatically.
- The access token TikTok gives us is stored on your account, encrypted at rest, used only for the calls above, and deleted when you disconnect TikTok in the panel or revoke XtreamChaos in your TikTok settings.
The apps on your devices
- The Windows app keeps game folders, mod files and its local event API on your PC. It sends us your app version (for updates), the games you install mods for, and the events from your LIVE. It does not read files outside the game folders you point it at.
- The Android app keeps your sign-in on the phone and uses the phone's own voices for text-to-speech.
Technical
- Like any website, our hosting keeps short-lived request logs (IP address, browser, pages requested) to keep the service running and to find faults. These are not used to build profiles of you.
- We do not run advertising. The Google Analytics tag loads on website and app panel pages, but analytics storage starts disabled. Loading the tag sends your IP address and browser request details to Google and may send limited consent-state signals. We send page views and allow measurement cookies only after you choose Allow analytics.
3. Why we use it
- To run the service you signed up for: your actions, overlays, points, games and billing.
- To know which plan you have and what it opens.
- To answer support questions and fix bugs.
- To understand which website and app panel pages people use, if they allow analytics.
- To tell you about changes to the service (through the panel, Discord, or email for something important such as billing).
We do not sell your data and we do not use it to advertise to you.
6. How long we keep it
- Account and setup data: for as long as your account exists.
- LIVE event data used by overlays and points: for as long as your profile keeps it; you can reset points and session stats yourself.
- Billing records: as long as tax and accounting law requires, even after the account is deleted.
- Request logs: a short rolling window at the hosting provider.
- Desktop diagnostic reports: 14 days, then automatically deleted.
7. Your rights and choices
- See and change your data on your profile page and throughout the panel.
- Export your whole setup as a file from Setup → Transfer.
- Disconnect TikTok, Discord, Spotify or any key you added, at any time, from the panel.
- Delete your account: ask in the XtreamChaos Discord from the account's linked Discord, or from the email address on the account. The account, its setup and its files are removed within 30 days; billing records are kept as described above.
- If you are in the EU/EEA or UK you also have the rights to access, rectify, erase, restrict, port and object under the GDPR, and to complain to your data protection authority.
8. Age
XtreamChaos is for people who can go LIVE on TikTok, which TikTok limits to adults. You must be at least 18 to use XtreamChaos. We do not knowingly collect data from children; if you believe a child has an account, tell us and it will be removed.
9. Security
Data travels over HTTPS. Passwords are hashed. Keys and tokens you give us are encrypted at rest and never displayed back. Access to production data is limited to the people who run XtreamChaos. No system is perfect; if a breach ever affects your data we will tell you.
10. Changes to this policy
When this policy changes, the date at the top changes, and for anything material we say so in the panel and in the Discord server before it applies.
11. Contact
Questions, requests, deletions: the XtreamChaos Discord server. A person answers.