Privacy Policy
Last updated: November 10, 2026
1. Who operates BadgeCatch
BadgeCatch is an independent project operated by Baggins (@Baggns). For privacy questions, contact [email protected].
2. Information we collect
When you browse BadgeCatch, the server may process technical request information such as your IP address, browser, device, and requested URL as part of normal hosting and security operations. BadgeCatch does not use advertising or analytics cookies.
To understand which pages and buttons help viewers find the BadgeCatch Twitch stream, BadgeCatch records first-party usage events such as page views and clicks on “Watch on Twitch”, “Sign in with Twitch”, and Discord links. These events contain the page path, the button placement, the related badge, emote, or game, and whether the stream was live. By default, events are not linked across visits: no cookie or local storage identifier is used. Some deployments may enable optional signed-in viewer tracking, which adds a stable internal viewer ID to events for signed-in visitors and allows those events to be linked to the same BadgeCatch account across visits; this mode is off by default and is not anonymous. Events do not contain your IP address, browser fingerprint, Twitch tokens, chat messages, or Twitch profile details. If your browser sends a Global Privacy Control or Do Not Track signal, no usage events are sent. Usage events are deleted after a limited retention period.
Successful Twitch sign-ins and Discord notification configuration saves also generate first-party usage events under the same privacy opt-outs. Configuration-save events contain no Discord server, channel, account, message, or viewer identifiers; repeated saves are separate operations, not counts of unique installs. Usage reports are available only through authorized internal operator interfaces.
Saved collector profiles store only the selected platform and public username in this browser’s local storage. Displaying saved profiles sends their public usernames to BadgeCatch to load known avatars; it does not start scans. The saved list remains in this browser. You can remove individual entries or clear the list by deleting this site’s browser data. Opening a saved link makes a normal profile request. The comparison selection stores up to two of these profiles in this tab’s session storage. Opening a comparison sends the two public usernames in the comparison page URL.
If you sign in with Twitch, we receive the account information Twitch makes available through the authorization flow, including your Twitch user ID, login, display name, and profile image. We also store the access and refresh tokens needed to provide the features you authorize, such as reading emotes and participating in chat-related integrations.
Optional Kick campaigns and sign-in
The separate Kick section caches public campaign information, reward images and eligible-channel lists. Browsing these campaigns does not require signing in. The public global badge checker and optional chat bot process the badge information described below; personal watch progress is not collected.
If you sign in with Kick, BadgeCatch uses your Kick user ID and display name for a separate encrypted, HTTP-only session cookie lasting up to seven days. A temporary browser cookie and server-side authorization state protect sign-in and expire after ten minutes. Viewer access tokens are used to verify identity and are not retained. Signing out of Kick clears its session without signing you out of Twitch.
The configured BadgeCatch Kick broadcaster can separately authorize category rotation and, when enabled, chat replies and chat-event subscriptions. For that connection, BadgeCatch stores the broadcaster and channel IDs and encrypted access and refresh tokens until the broadcaster disconnects the broadcaster connection. Signing out alone does not remove that authorization; the broadcaster can disconnect it on the Kick account page and revoke the app grant in Kick. Campaign and rotation requests use Kick's services, and reward images are loaded from Kick's image hosts.
Channel owners can separately invite the Kick bot. We retain the channel identity, encrypted access and refresh tokens, and subscription check time until removal on the Kick account page. Signing out does not remove the bot. Invited-channel chat is processed only for badge commands; ordinary chat is not saved or used for background user discovery. Requests can refresh public badge inventory. Message hashes and requester IDs prevent duplicate replies and abuse. Removing the bot stops local processing and deletes its saved authorization; you can also revoke the grant in Kick.
Public Twitch earned-badge inventory
BadgeCatch may retrieve publicly exposed earned-badge collection data when a Twitch account connects to BadgeCatch, participates in BadgeCatch’s Twitch chat and its cached inventory is stale, or someone explicitly searches that Twitch username or requests a refresh on BadgeCatch. This uses Twitch’s undocumented public GraphQL viewer-card data, not an official inventory API. No target user’s OAuth token, browser cookies or captured session headers are required for this lookup.
We may store public Twitch identity metadata (user ID, login, display name and profile image), cached global badge confirmations, historical confirmation times, scan timestamps and sanitized scan status. Public profiles can represent accounts that never signed into BadgeCatch; they do not imply BadgeCatch membership. Failed scans preserve previously confirmed data. This best-effort integration may change, and BadgeCatch does not claim to have scanned all Twitch accounts. Counts of owners found by BadgeCatch describe only our scanned dataset.
Twitch chat badge observations
If you invite BadgeCatchBot to your channel, we store your Twitch user ID, channel login, invitation setting and a recent bot connection timestamp. The bot reads chat to respond to supported commands. A !badges request can refresh public badge inventory for the requester or the named Twitch user using the collection lookup described above. Invited-channel chat text is not stored as badge observations. You can remove the bot from Dashboard → Account.
BadgeCatch reads public chat in its own Twitch channel through Twitch EventSub. When anyone sends a chat message there, including Twitch users who have never visited or signed in to BadgeCatch, Twitch includes the chat badges displayed on that message. BadgeCatch stores only what is needed to record that badge observation: the sender’s Twitch user ID, their Twitch login, the badge identities (badge set, version, and Twitch’s badge metadata such as subscriber months), the channel the message was sent in, the first and last time the badge was observed, and how often it was observed. BadgeCatch does not store chat message text, message fragments, emotes, colors, reply details, or other profile fields from the chat event.
An observation only means that Twitch attached that badge to a chat message from that account. It is not a complete list of the badges an account owns, and a badge that was never observed must not be read as a badge the account does not have. If you later sign in to BadgeCatch, badges previously observed on your messages are shown on your dashboard by matching your Twitch user ID. Observations of Twitch users without a BadgeCatch account are deleted automatically once no new observation has been made for 365 days. Chat observations, separate earned-badge inventory scans, and observations from external sources such as Potat are different datasets and are not silently combined.
3. How we use information
We use this information to authenticate you, maintain your session, display your dashboard, synchronize the Twitch data you request, provide notifications you enable, protect the service, and respond to support requests. We do not sell your personal information or use it for targeted advertising.
4. Cookies and local storage
BadgeCatch uses a necessary, HTTP-only session cookie to keep you signed in and a short-lived cookie to protect the Twitch sign-in flow. These cookies are not used to track you across other websites. You can delete them through your browser, but doing so may sign you out.
Collector tools can store your saved rewards, stream discovery preset and hidden channels in this browser’s local storage. These preferences are not synchronized to your account. Clearing site storage removes them. Optional watchlist notifications work while that page stays open, after you grant notification permission. Badge detective images are compared locally in your browser and are not uploaded to BadgeCatch.
5. Third-party services
BadgeCatch relies on Twitch and Kick for their respective sign-ins and platform data, and may use Discord to deliver notifications or operate community features. Those services process information under their own privacy policies. BadgeCatch also links to third-party websites, whose practices are not controlled by BadgeCatch.
The Kick user checker requests the entered public username from Kick and briefly caches the returned global badges and level. When you open your Kick account page after signing in, BadgeCatch saves your Kick user ID, username, public global badges and last successful scan time to show your latest saved badges if a refresh fails. When the optional Kick chat bot is enabled, verified messages in the configured channel identify first-time chatters for paced background badge scans. Commands can also request a named public user's scan. These scans save the same public inventory fields and contribute to badge rankings and owner counts among users scanned by BadgeCatch. Pending scans store a public user ID, username and retry timing until a successful scan; transient failures are retried. Short-lived command IDs and user cooldowns prevent duplicate replies; complete chat messages are not stored. The bot cannot discover silent viewers through a join event. Badge images load from Kick’s CDN. Kick watch progress is not collected by this checker or bot.
On Twitch pages, the stream and chat connect your browser to Twitch when the panel opens on desktop. It starts open on desktop; player and chat are not displayed or loaded on mobile screens up to 960px wide. BadgeCatch remembers your desktop choice in browser local storage. Collapsing the panel on desktop does not unload existing embeds; resizing to mobile width unloads them. OBS overlay pages do not include this player or chat. The player requests muted autoplay, which your browser may block. Twitch may receive technical information such as your IP address and browser information, and may use cookies or other storage under Twitch’s Privacy Notice. Links to Twitch open Twitch only when you choose them.
First-party events distinguish an embedded player or chat rendered on the page from a placement observed as visible in the browser viewport. These are website placement measurements, not proof of playback, a Twitch viewer count, watch time, or badge eligibility. Visibility events are omitted when the browser cannot measure them, and privacy opt-outs apply to these events too.
6. Retention and security
Twitch chat badge observations of users without a BadgeCatch account are deleted after 365 days without a new observation; observations linked to a BadgeCatch account through the Twitch user ID are kept while the account exists. We keep account and integration information for as long as it is needed to provide the service or meet legal obligations. We use signed sessions and encryption for sensitive integration credentials, but no online service can guarantee absolute security.
7. Your choices
You may stop using BadgeCatch, clear your session cookies, or revoke BadgeCatch’s access in your Twitch account settings. Revoking OAuth does not prevent anonymous public badge lookups. To request access, correction, or deletion of information associated with your BadgeCatch account, public inventory/profile data, or Twitch chat badge observations linked to your Twitch account even if you never created a BadgeCatch account, email [email protected]. We may need to verify your request before acting on it.
8. Children
BadgeCatch is not directed to children under 13, and we do not knowingly collect personal information from children under 13.
9. Changes to this policy
We may update this Privacy Policy when the service or applicable requirements change. The “Last updated” date above indicates when it was most recently revised.