Last updated: September 21, 2026
The data controller is DrAGoS, individual developer, Romania.
Contact: jumpscareapp@gmail.com
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email address and password (password stored only as a secure hash by our backend provider) or your Google account email, if you use "Continue with Google" | Creating and securing your account, login, password reset, contacting you about your account | Contract performance (art. 6(1)(b)) |
| Hardware fingerprint — a SHA-256 hash of your motherboard identifiers (manufacturer, model, serial). The raw identifiers are never stored, only the hash. | Binding your license to one computer, preventing account sharing and license abuse | Contract performance; legitimate interest (fraud/abuse prevention, art. 6(1)(f)) |
| Device token — a random identifier stored on your computer | Enforcing one active session per account | Contract performance; legitimate interest |
| Subscription status (Standard/Premium, expiry date) | Providing the features you paid for | Contract performance |
| Error reports — date, app version, Windows version, error message and technical stack trace, linked to your account | Fixing bugs and improving the App | Legitimate interest (art. 6(1)(f)) |
| Support and device-reset requests — the message you send us and your email | Answering your request | Contract performance / legitimate interest |
The App stores locally (in %AppData%\JumpScareApp): your settings, your login session (encrypted with Windows DPAPI, tied to your Windows user), the device token, a local error log and any pending error reports. Uninstalling the App and deleting this folder removes them.
Data produced by the chat-based features also stays local: coins balances (coins.json), leaderboards (leaderboard.json), the song request history, and the most recent chat messages held in memory for the overlay. All of them contain your viewers' public names, and all of them live on your computer, not with us.
Account data, subscription status and error reports are stored in our backend hosted by Supabase. If you sign in with Google, Google processes your login according to its own privacy policy.
Your viewers' data. If you use the hosted overlays (needed when you stream from a different computer than the one running the App), chat messages, display names and leaderboards pass through Supabase Realtime in order to reach the page in OBS. They are delivered in real time to pages opened with your account code; they are not written to the database, not logged, and do not remain anywhere after delivery. If you only use the local overlays (localhost), they never leave your computer at all.
For this data you are the controller in relation to your viewers, and we act as the processor that carries it. It is data your viewers made public themselves, by writing in your chat.
Services contacted directly by your computer, not through our servers: YouTube (searching for and playing songs requested from chat) and 7TV, BetterTTV, FrankerFaceZ (emote images). As with any internet request, they see your IP address and their own policies apply.
Only the developer/administrator of the App has access to the backend data, through a restricted admin panel. Data may be disclosed to authorities where the law requires it. We use the following processors: Supabase (hosting/backend) and Google (optional sign-in).
You have the right to access, rectify, delete and receive (portability) your data, to restrict or object to processing based on legitimate interest, and to withdraw consent where processing is based on it. To exercise these rights — including deleting your account and all associated data — email us at jumpscareapp@gmail.com. We reply within one month.
You can also lodge a complaint with your supervisory authority. In Romania this is ANSPDCP (www.dataprotection.ro); in other EU countries, your national data protection authority.
Passwords are handled by our authentication provider and never stored in plain text; hardware identifiers are stored only as irreversible hashes; the local session file is encrypted with Windows DPAPI; server access is restricted by role-based rules. No system is 100% secure, but we take reasonable measures to protect your data.
The App is not intended for children under 16. We do not knowingly collect data from them.
We may update this policy. Material changes will be announced in the App or by email. The current version is always available in the App.
Privacy questions and requests: jumpscareapp@gmail.com