Privacy & Data Policy
Last updated: 21 August 2026
This policy explains what Milked Live ("we", "us", "our"), operated by [PLACEHOLDER: legal entity name], [PLACEHOLDER: registered address], collects, why, and how long it is kept. This is a deliberately short policy because the Service is deliberately minimal.
The short version: we collect only a username and a hashed password. No email, no real name, no address, no phone. Chat is live only and is never saved. There is no analytics, no tracking, and no advertising.
1. What we collect
| Data | Purpose | Lawful basis |
|---|---|---|
| Username | Identifying you on the Service and in live chat | Contract (performance of the account you agreed to) / your consent at signup |
| Password (scrypt hash + salt only) | Verifying your login; the plaintext password is never stored | Contract / your consent at signup |
We do not collect an email address or any other contact or identifying data.
Moderation. If a moderator or the streamer bans an account, we store the banned username, the reason given, and who issued the ban. Moderator status (if you are made a moderator) is attached to your account record.
2. Session cookie (strictly necessary)
When you sign in we set a single session cookie (milked_session) that keeps you signed in. It is:
- HttpOnly (not readable by scripts), SameSite=Lax, and transmitted over HTTPS on the deployed Service;
- strictly necessary for the accounts feature to work, so under the GDPR and ePrivacy rules it does not require separate consent — but we disclose it here as required;
- held for up to 30 days and cleared when you sign out or delete your account.
No other cookies are set. We do not use advertising, analytics, or tracking cookies.
3. Chat messages (live only, never saved)
- Chat messages exist only in server memory and only for the current running session.
- They are never written to disk and never retained: the moment the server restarts, all messages are gone.
- There is no message archive, no log of chat content, and no replay.
- Because messages are ephemeral and never stored, there is nothing we can retain, disclose, or hand over later.
This is the strongest GDPR posture a live-chat service can take: user-generated content is transmitted in real time and disappears immediately.
4. No third parties, no tracking
- The Service sets no tracking pixels, runs no analytics, and no advertising.
- We do not sell, rent, or share personal data with anyone.
- Google Fonts is loaded from Google's CDN to display the site's typography. Loading the font stylesheet sends your IP address to Google in the ordinary course of a web request. No other third-party requests are made by the Service. We may self-host the fonts in future to eliminate even that request.
5. How long we keep data
- Account data (username + password hash): kept for as long as the account exists, and deleted when you delete the account or we close it.
- Moderation data (ban records): kept until the ban is lifted or the account is deleted. Deleting an account also removes any ban record for that username.
- Chat messages: not kept at all (Section 3).
- Session cookie: up to 30 days, or until sign-out/deletion.
6. Your rights
You can, at any time:
- Access the account data we hold — it is limited to your username (and the presence of your account);
- Correct it — update your username/password via your account;
- Erase it — delete your account, which permanently removes your username and password hash. (Chat is already ephemeral, so there is no other content to erase.)
- Withdraw consent — stop using the Service and delete your account.
To exercise any right, use the in-app Delete account control or contact us at [PLACEHOLDER: contact email].
7. International transfer
The Service is hosted by Railway (a cloud provider) on servers whose location may be outside your country. Because the only personal data we process is your username and password hash, and that data is transferred only for the purpose of providing the account service you requested, we rely on standard contractual safeguards and the limited nature of the data. If you are in the EU/EEA and have concerns, contact us at [PLACEHOLDER: contact email].
8. Contact
Data controller: [PLACEHOLDER: legal entity name], [PLACEHOLDER: registered address], [PLACEHOLDER: contact email].
For EU Digital Services Act notices about illegal content, see Terms of Service, Section 4.
This policy is not legal advice. If you need certainty about your obligations, consult a qualified professional. Review the policy periodically — it may be updated as the Service changes.