CPWGames Tools CPWGames Tools
FR Langue
English Español Português Français Deutsch
Connecter Twitch
Mentions légales

Politique de confidentialité

En vigueur : 10 novembre 2026 Contact : support@cpwgamestools.com
Ce document juridique n’est disponible qu’en anglais. La version anglaise fait foi.

This policy explains what CPWGames Tools does with your information. The short version: the service stores the minimum needed to show you your own Twitch, Kick or Velora token, or an ANTISLAVE app token, keeps it server-side, uses no advertising or analytics trackers, and deletes it when you revoke or after a period of inactivity.

1. What we collect

When you authorize with Twitch, Kick or Velora, the service receives and stores user profile and token data. ANTISLAVE app tokens are application credentials and do not contain a user profile.

  • Platform identity: your numeric user id, login or display name and avatar URL. For Twitch this can also include the account creation date.
  • Email address: for Twitch, only if you grant the user:read:email scope; Kick may return an email address with user:read.
  • OAuth credentials: the access token and refresh token issued to this application, plus their expiry time. ANTISLAVE app tokens are stored separately and have no refresh token.
  • Scope data: which scopes you requested and which platform actually granted.
  • Timestamps: when the token was first obtained and last updated.
  • Server logs: your IP address, browser user agent and requested URLs may appear in standard web server logs for security and debugging.

The service never receives your Twitch, Kick or Velora password, your stream key, your payment details or your private messages. It does not read your chat or channel data unless you press a button that makes such a request, and it does not run background jobs against the platform APIs.

On Kick, the requested scopes are user:read, channel:rewards:read, channel:rewards:write, chat:write and events:subscribe. Kick access tokens are short-lived; when you open the Kick dashboard near expiry, the service refreshes them automatically and replaces the stored refresh token with the rotated one Kick returns.

Velora OAuth requests user:read, stream:read, chat:read, channel:read, channel:points:read, followers:read, emotes:read and webhooks:manage. ANTISLAVE app tokens request channel:read, chat:read, chatters:read, clips:read and schedule:read. ANTISLAVE app tokens are server credentials, not user sign-ins.

2. Why we use it

  • To complete the OAuth exchange and display the token you asked for.
  • To refresh an expired token when you ask, so you do not have to authorize again.
  • To show which scopes were granted and which the platform skipped.
  • To revoke the token with the platform and delete the record when you request it.
  • To keep the service secure, diagnose errors and prevent abuse.

Your data is not used for advertising, profiling, marketing or sale.

3. Legal bases

Where data protection law requires a legal basis, processing relies on your consent (you choose to authorize and approve scopes), performance of the service you requested, and the operator's legitimate interest in keeping the service secure. You can withdraw consent at any time by revoking the token.

4. Cookies and sessions

The service sets a small number of first-party cookies. The main one is a session cookie. It normally has the name cpwg_session and is used to keep you signed in, carry the OAuth state value between the redirect and the callback, and protect forms against cross-site request forgery.

The session cookie is HttpOnly, SameSite=Lax, and marked Secure when served over HTTPS. It lasts up to 14 days and contains a random session identifier only — never a Twitch or Kick token. There are no advertising, analytics or third-party cookies, and no tracking pixels.

Two preference cookies are also used: cpwg_lang remembers the language you selected, and cpwg_consent records whether you accepted or rejected optional cookies. The consent choice lasts six months and is set only after you use the banner. Your light or dark theme is kept in your browser's local storage, not in a cookie. You can change the cookie choice at any time with Cookie settings in the footer.

Clearing cookies in your browser signs you out and resets your cookie choice.

5. Storage and retention

Token records are kept in protected JSON files (by default storage/tokens.json for Twitch, storage/kick_tokens.json for Kick, storage/velora_tokens.json for Velora and storage/antislave_token.json for an ANTISLAVE app token), readable only by the web server process, with restrictive file permissions where the operating system supports them. Records are keyed by platform user id, so one account's token is never returned to another.

  • Active use: the record is kept while you use the dashboard.
  • Inactivity: records untouched for 30 days are pruned automatically.
  • Revoke: the record is deleted immediately when you revoke from the dashboard.
  • Server logs: retained according to the hosting provider's normal log rotation.

Removing the local record does not itself invalidate the token at the platform. Use the revoke button, or remove the application in the platform's connected-apps settings, to invalidate it.

6. Sharing

Tokens and profile data are not sold, rented or shared with advertisers or data brokers. Data is shared only with:

  • Twitch, Kick or Velora, because every OAuth exchange, refresh and revoke is a request to that platform's API (see its privacy policy). ANTISLAVE processes app-token requests and API calls under its own privacy policy.
  • The hosting provider that runs this server, which necessarily processes the stored file and access logs.
  • Authorities, where disclosure is legally required.

7. Security

Reasonable technical measures protect the data: the client secret stays in server-side configuration, OAuth state and form CSRF tokens are verified, session identifiers are regenerated after login, pages are sent with no-store caching and a restrictive content security policy, and the token file is not web-accessible.

No system is perfectly secure. If you believe a token has leaked, revoke it immediately from the dashboard and from the platform's connected-apps settings, then authorize again.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or port your data, and to object to processing. For this service, in practice:

  • Access: your dashboard shows the profile data and scopes that are stored.
  • Deletion: revoke from the dashboard, which deletes the stored record. You can also email us to request deletion of any data tied to your Twitch, Kick or Velora id, or the ANTISLAVE app-token record.
  • Withdrawal of consent: revoke the token; the service cannot act for you afterwards.

Requests are answered within a reasonable period, normally 30 days.

9. Children

The service is not directed at children under 13 (or the higher minimum age in your country). Twitch, Kick, Velora and ANTISLAVE accounts are themselves subject to their platform's minimum age rules. If you believe a child's data was stored, contact us and it will be removed.

10. International transfers

The server may be located in a different country from you, and Twitch, Kick, Velora and ANTISLAVE process data in the countries where they operate. Where required, transfers rely on appropriate safeguards offered by the hosting provider and the relevant platform.

11. Third-party links

The site links to Twitch, Kick, Velora and ANTISLAVE documentation and developer consoles. Those sites have their own privacy practices, which this policy does not cover.

12. Changes

This policy may be updated; the effective date above will change. Material changes will be reflected on this page, and continued use after an update means you accept the revised policy.

13. Contact

Privacy questions or deletion requests: support@cpwgamestools.com.

CPWGames Tools is an independent tool, not affiliated with Twitch Interactive, Inc., Amazon.com, Inc., Kick, Velora or ANTISLAVE.