Privacy Policy – riffbox

Last updated: 14 November 2026 · Version: 1.1 Deutsche Fassung: https://riffbox.effigies.tech/datenschutz

This Privacy Policy covers the website https://riffbox.effigies.tech and the software "riffbox". riffbox is not a public service. The software is used only by its operator for the operator's own accounts on social media platforms. It also processes personal data of other people, for example content creators whose clips are commented on with their permission, or people who comment under the operator's videos. This policy informs everyone concerned under Art. 13 and Art. 14 of the EU General Data Protection Regulation (GDPR) and meets the disclosure requirements of the platforms used. In case of discrepancies between language versions, the German version prevails.

Contents

1. Controller
2. What riffbox is
3. Website
4. riffbox software – general processing
5. Platforms
6. YouTube
7. TikTok
8. Instagram / Meta
9. X
10. Twitch
11. Reddit
12. Third-party data
13. Use of AI
14. Recipients and processors
15. Transfers to third countries
16. Retention periods
17. Security
18. Your rights
19. Data Deletion Instructions
20. Other mandatory information
21. Planned features and changes to this policy

1. Controller

The controller within the meaning of Art. 4(7) GDPR for the website and the riffbox software is:

the operator of this website, a sole proprietor (Einzelunternehmer) in Germany. Name and address are given in the Imprint.

Email: unbecand@gmail.com

For any privacy questions or complaints, access and deletion requests, and opt-out, permission or takedown requests, contact the operator at unbecand@gmail.com.

No data protection officer has been appointed, as there is no legal obligation to do so (Art. 37 GDPR, Sec. 38 German Federal Data Protection Act, BDSG).

2. What riffbox is

riffbox is a locally operated software pipeline. It

• finds popular gaming clips and trends via the platforms' official APIs,
• processes only video material for which the rights holder has given permission or that originates from the operator,
• turns this material into short reaction videos and longer compilations in which a fictional, AI-generated 2D avatar comments on it with a synthetic voice,
• publishes the finished videos to the operator's own accounts on YouTube, TikTok, Instagram and X via the platforms' official APIs, only after the operator has manually approved each video,
• retrieves performance metrics of the operator's own videos and can read comments under those videos.

Who uses riffbox: only the operator, with the operator's own accounts (possibly several per platform). There is no sign-up, no user accounts for third parties, and the software is not provided to anyone else.

Where riffbox runs: on the operator's own server in Germany, optionally on the operator's own laptop. The only externally reachable component is short-lived signed links for finished videos (see Processors).

3. Website

3.1 Hosting and server logs

The website is a static site hosted by: GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA (GitHub Pages).

On each request the host processes technically necessary data:

• IP address of the requesting device
• date and time of access
• requested page or file, amount of data transferred, HTTP status code
• browser type and version, operating system, referrer URL (if sent by the browser)

Purpose: delivering the website, stability and security (e.g. defending against attacks). Legal basis: Art. 6(1)(f) GDPR. The legitimate interest is the secure and error-free operation of the website. Retention: as determined by GitHub, see the GitHub Privacy Statement. The operator does not analyse these logs.

A data processing agreement under Art. 28 GDPR is in place with the host.

3.2 No cookies, no tracking

The website sets no cookies and does not store or read any information on your device (Sec. 25 German TDDDG). There are no analytics, tracking or advertising services, no social media plug-ins, no embedded videos and no forms. Fonts and other resources are hosted locally, so no data is sent to third parties such as Google Fonts or external CDNs when you visit.

3.3 Contact by email

If you email the operator, your email address, your name (if given), the content of your message and the email metadata are processed.

Purpose: handling your request, e.g. privacy requests, opt-out, takedown or permission requests. Legal basis: Art. 6(1)(f) GDPR (responding to enquiries); for permission and usage agreements Art. 6(1)(b) GDPR; for requests to exercise data subject rights Art. 6(1)(c) GDPR in conjunction with Art. 12 et seq. GDPR. Email provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A data processing agreement is in place with the provider. Retention: see Retention periods.

3.4 OAuth redirect page

The riffbox platform apps have redirect URIs for signing in. They point to the operator's local addresses or to a plain redirect page on this website that stores no data. Only the operator signs in there, with the operator's own accounts.

4. riffbox software – general processing

4.1 Origin of video material

riffbox does not download video files from YouTube, Twitch or any other platform. These platforms' APIs are used only to discover clips and trends, retrieve metadata and publish the operator's own videos.

Video material of other people is used only if

• the rights holder (e.g. the streamer) has expressly permitted the use and provides the file themselves, for example via a link they share, or
• the material is under a licence that expressly permits this use.

riffbox also uses the operator's own material, such as the operator's own gameplay recordings.

4.2 Workflow

1. Discovery: public clips, videos and posts on a topic are found as trend and source signals via the official APIs of Twitch, YouTube and, where applicable, Reddit. Only metadata is retrieved.
2. Permission: for a desired clip, the operator requests permission from the rights holder. Permissions granted are documented in the creator register.
3. Intake: the rights holder provides the file. It is stored in a local data folder outside the code repository.
4. Analysis: the software creates a transcript, still frames (keyframes) and highlight markers locally. It automatically checks the material for exclusion criteria, such as slurs, hate speech, sexual content, gambling, real-world violence, drugs, visible personal data, minors and protected music.
5. Creator register: check against an internal list (allowed / blocked / neutral). Material from blocked creators is not used; material without documented permission is not processed.
6. Production: script, review of the generated text, speech synthesis, avatar animation and editing.
7. Review queue: the operator manually reviews every video and approves it per platform.
8. Publishing: upload via each platform's official API to one of the operator's own accounts.

4.3 Data categories at a glance

4.4 No profiling, no selling, no advertising

riffbox does not build profiles of individuals, does not sell data and does not use data for advertising. Metrics are retrieved only in aggregated form, without viewer identities. Platform data is not used to train AI models (see Use of AI).

5. Platforms

The following sections meet the disclosure requirements of each platform's developer terms. Where the operator connects riffbox to the operator's own accounts, the operator is also the app's user. Where data of other people is processed, this is stated explicitly.

5.1 YouTube

riffbox uses YouTube API Services. By using riffbox's YouTube features, you agree to be bound by the YouTube Terms of Service. Google's processing is governed by the Google Privacy Policy (http://www.google.com/policies/privacy).

APIs used: YouTube Data API v3, YouTube Analytics API. Authentication: OAuth 2.0 for the operator's own channels; API key for public search. Scopes: - youtube.upload – uploading own videos - youtube.readonly – reading own channel and video data - yt-analytics.readonly – metrics of own videos - youtube.force-ssl – reading comments under own videos

riffbox does not download videos from YouTube. YouTube search results are used only as a trend signal.

Data accessed and stored:

All data is stored locally on the operator's server.

Use and sharing: the data is used only for the purposes listed. Selected comment texts with display names, and metrics of own videos, may be sent to the AI service Anthropic for analysis and scriptwriting (see Use of AI and Processors). A comment that is used is shown as an on-screen overlay in the video; the display name is hidden or shown only with the person's consent. No other sharing with third parties takes place.

Cookies and storage on devices: riffbox does not store or read any information on the devices of viewers or commenters. riffbox does not display third-party content or ads.

Revoking access: you can revoke riffbox's access to a Google account at any time via Google's security settings page: https://security.google.com/settings/security/permissions. After revocation, all data obtained through the account that does not have to be retained by law is deleted within 7 days. Requests to delete stored data are completed within 7 days. See also Data Deletion Instructions.

Contact for privacy questions or complaints: unbecand@gmail.com

5.2 TikTok

Products used: TikTok Login Kit and Content Posting API (Direct Post). Purpose: publishing own videos to the operator's own TikTok accounts and retrieving metrics of those videos. riffbox does not search TikTok, does not download content from TikTok and does not read data of other TikTok users. Scopes: user.info.basic, video.publish, video.list.

Data accessed and stored:

Publishing: every post requires the operator's explicit confirmation, following TikTok's Content Sharing Guidelines: preview, display of the account nickname, editable title, privacy setting with no pre-selection, comment/Duet/Stitch settings, commercial content disclosure and reference to the Music Usage Confirmation.

Sharing: metrics of own videos may be sent to Anthropic for content planning (see Use of AI). TikTok data is not shared otherwise. No profiles of TikTok users are created.

TikTok's processing is governed by: the TikTok Privacy Policy (EEA) and the TikTok Terms of Service.

Revoking access: the connection can be removed at any time in the TikTok app settings under the permissions for connected apps. Tokens are then deleted and the remaining TikTok data is handled as described in the Data Deletion Instructions.

5.3 Instagram / Meta

Product used: Instagram API with Instagram Login, for the operator's Instagram professional accounts (creator/business). No Facebook Page is required or used. Purpose: publishing own Reels, retrieving metrics of own posts, reading comments under own posts (moderation, "Comment Reply" format). Permissions: instagram_business_basic, instagram_business_content_publish, instagram_business_manage_insights, instagram_business_manage_comments.

Platform data processed:

Providing the video: Instagram fetches videos from a publicly reachable URL. For this, riffbox briefly stores the finished video in a private object storage bucket (Cloudflare R2, EU location) and creates a signed link valid for no more than 1 hour. The file is deleted after successful publishing, and after 24 hours at the latest.

Sharing and service providers: selected comments (text, username) and metrics may be sent to Anthropic for analysis. Service providers that process Meta Platform Data are bound in writing to process it only on the operator's behalf and instructions and not for their own purposes (see Processors). Platform Data is not sold, not used for advertising and not used to train AI models.

Meta's processing is governed by: the Meta Privacy Policy and the Instagram Terms of Use.

Deletion: anyone whose data riffbox has received through Meta can request deletion. See the Data Deletion Instructions.

5.4 X

API used: X API v2. Authentication: OAuth 2.0 user context with PKCE for the operator's own X accounts. Purpose: publishing selected videos to the operator's own X accounts and retrieving metrics of own posts. Scopes: tweet.read, tweet.write, users.read, media.write, offline.access.

Data accessed and stored:

riffbox does not read content or profiles of other X users, does not analyse or monitor X users, and does not use X content to train or fine-tune AI models. If a post is deleted, or if X or an X user requests the deletion of X content, riffbox deletes the affected data within 24 hours of the request.

X's processing is governed by: the X Privacy Policy and the X Terms of Service.

Revoking access: the connection can be removed at any time in the X settings under connected apps.

5.5 Twitch

API used: Twitch Helix API. Authentication: app access token (client credentials). No Twitch user signs in to riffbox and no user scopes are requested. Endpoints: Get Clips, Get Games, Get Users. Purpose: finding popular public clips on a topic in order to request permission from the rights holders; source attribution and credits.

riffbox does not download video files from Twitch. Clips are used only if the streamer has permitted the use and has provided the file themselves (see Origin of video material).

Data accessed and stored:

Sharing: clip metadata (including channel and display names) may be sent to Anthropic for selection and planning (see Use of AI). Twitch data is not shared otherwise.

Twitch's processing is governed by: the Twitch Privacy Notice and the Twitch Terms of Service.

Deletion: Twitch data is deleted at the request of Twitch or the person concerned (see Data Deletion Instructions).

5.6 Reddit

API used: Reddit Data API, read-only. This feature is optional and enabled only when needed. Purpose: trend signal from titles and upvotes of public posts in topic-related subreddits. Data processed: title, score, timestamp, subreddit. No videos, usernames or user profiles are stored. Retention: no more than 30 days. If a post is deleted on Reddit, it is also deleted from riffbox without undue delay. Reddit's processing is governed by: the Reddit Privacy Policy.

6. Third-party data

This section informs people whose data riffbox does not collect, or does not only collect, from them directly (Art. 14 GDPR).

6.1 Streamers and content creators without permission (metadata only)

Data: channel ID, login and display name, metadata of public clips. Source: Twitch API and YouTube API. Purposes: discovering trends and potential partners, requesting permission, duplicate detection. Legal basis: Art. 6(1)(f) GDPR. The legitimate interest is finding suitable material and asking its rights holders for permission. Publication: none. No material of these persons is used without permission.

6.2 Streamers and content creators with permission

Data: channel ID, login and display name, contact details (e.g. email address), content, scope and date of the permission; image and voice in the material provided (e.g. facecam, gameplay commentary); statements in the transcript. Source: the creator and the material they provide. Purposes: producing and publishing commentary videos within the scope of the permission, credits, proof of permission. Legal basis: Art. 6(1)(b) GDPR (usage agreement with the creator) and, where required, Art. 6(1)(a) GDPR (consent to publication of one's likeness, Sec. 22 German Art Copyright Act, KUG). Consent can be withdrawn at any time with effect for the future; the consequences are described under Opt-out and takedown. Publication: excerpts with credit in the operator's own videos on YouTube, TikTok, Instagram and X.

6.3 Twitch clip creators

Data: display name of the person who created a clip on Twitch. Purpose: complete source attribution. The name is not published. Legal basis: Art. 6(1)(f) GDPR.

6.4 Other people in the material

Data: image and voice of teammates, guests and others audible or visible in the material; names where they appear in the transcript or on-screen text. Safeguards: visible personal data in the image, such as addresses or phone numbers, is detected automatically; the material is discarded or blurred. Material showing recognisable minors is not used. No facial recognition or biometric identification takes place. When granting permission, the creator confirms they are entitled to provide the material. Legal basis: Art. 6(1)(f) GDPR. The legitimate interest is commentary on material whose use the rights holder has permitted.

6.5 Commenters on the operator's channels

Data: display name or username, comment text, timestamp, comment ID. Source: YouTube Data API and Instagram API, only comments under the operator's own videos and posts. Purposes: moderation and the "Comment Reply" video format, in which the avatar responds to a comment. Publication: a selected comment is shown as an on-screen overlay. The display name is hidden or shown only with the person's express consent. Legal basis: Art. 6(1)(f) GDPR (moderation and interaction with the community); where the name is shown, Art. 6(1)(a) GDPR (consent).

6.6 Information through this policy

Data under 6.1, 6.3 and 6.4 comes from publicly available sources or from material provided by the rights holder. Notifying each person individually would be impossible or involve disproportionate effort (Art. 14(5)(b) GDPR). The operator therefore provides this information through this publicly available policy. Creators who grant permission receive the link to this policy with the permission request.

6.7 Opt-out and takedown

If you are a creator or a person shown in material and do not want to appear in riffbox videos, or you withdraw a permission, email unbecand@gmail.com. The process:

1. Your channel or person is marked as "blocked" in the creator register.
2. All published videos containing the affected material are taken down on all platforms.
3. All related data (material, transcripts, still frames, metadata) is deleted.
4. A minimal block entry (e.g. channel ID) is kept so that your material is not used again.

7. Use of AI

7.1 What AI does in riffbox

• Avatar: the commentator is a fictional, AI-generated 2D avatar. It does not depict or imitate any real person.
• Voice: the voice is synthetic. It is an own, licensed or base voice of the model used, not a clone of a real person.
• Locally run models (on the operator's server, no data sent to third parties): speech recognition, speech synthesis, optional image description, avatar creation with a custom character model trained only on images of the fictional character, lip sync, scene and highlight detection, and optionally a local language model.
• External AI service: Anthropic (Claude), used for planning, scriptwriting and analysis.

7.2 Data sent to Anthropic

• transcripts of the material used (containing statements by streamers and teammates)
• still frames from the material (may show faces)
• clip metadata including channel and display names
• selected comments under the operator's videos, including display name
• avatar persona description, format guidelines, metrics of own videos

No credentials, tokens or passwords are sent.

Role and terms: riffbox uses Anthropic only through a commercial API account. Anthropic processes the data as a processor under Anthropic's commercial terms of service and Data Processing Addendum. Under these terms, Anthropic does not use the content to train its models and by default deletes inputs and outputs within 30 days. Exceptions apply where content is reviewed on suspicion of usage-policy violations or where longer retention is legally required.

Legal basis: Art. 6(1)(f) GDPR; processing on behalf under Art. 28 GDPR.

7.3 No automated decisions about individuals

AI models automatically check content against exclusion criteria and suggest clips and texts. Every video is manually reviewed and approved by the operator before publishing. There is no automated decision producing legal effects or similarly significant effects on individuals within the meaning of Art. 22 GDPR.

7.4 Protection against manipulated input

Incoming texts (transcripts, comments) are checked for manipulation attempts (prompt injection) before AI processing.

8. Recipients and processors

8.1 Processors (Art. 28 GDPR)

Data processing agreements under Art. 28 GDPR are in place with all processors. They oblige the provider to process data only on the operator's behalf and instructions, not for their own purposes, and to delete it when the service ends. This obligation also covers platform data within the meaning of the developer terms of Meta and other platforms.

8.2 Platforms as independent controllers

Published videos and descriptions are sent to YouTube, TikTok, Instagram and X. These platforms process the data as independent controllers under their own privacy policies (links in the Platforms section).

8.3 Services that receive no personal data of third parties

• GitHub (private code repository): contains only code, concept and configuration, no platform data and no personal data.
• Software and model registries (e.g. Docker registries, Hugging Face, npm, PyPI): used only to download software and models; no project data is sent there.
• The operator's password manager: contains only the operator's own credentials, end-to-end encrypted.

8.4 Authorities and legal advisers

Data is disclosed to authorities, courts or legal advisers only where there is a legal obligation or where it is necessary to establish, exercise or defend legal claims (Art. 6(1)(c) or (f) GDPR).

9. Transfers to third countries

• Anthropic (USA): transfers are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which form part of Anthropic's Data Processing Addendum.
• Cloudflare: video files are stored and processed in the EU. As Cloudflare, Inc. is based in the USA, access from the USA cannot be completely ruled out. The basis is the EU Standard Contractual Clauses in Cloudflare's Data Processing Addendum (Art. 46(2)(c) GDPR) and, to the extent Cloudflare is certified under the EU-U.S. Data Privacy Framework, the European Commission's adequacy decision (Art. 45 GDPR).
• Platforms: the platforms may transfer data to third countries under their own responsibility; see their privacy policies.

A copy of the safeguards is available on request at unbecand@gmail.com.

10. Retention periods

In the event of an opt-out, withdrawal or takedown, all files of the affected creator or person are deleted immediately, regardless of the periods above.

11. Security

• API keys, client secrets and tokens are stored only on the operator's server, never in the code repository; file permissions allow access only by the operator; refresh tokens are encrypted.
• Credentials are never entered into AI services.
• Only the minimum necessary permissions are requested per platform.
• Two-factor authentication on all platform and developer accounts.
• No ports are reachable from the internet; the review interface is only reachable locally.
• Third-party material is processed only in isolated containers.
• Object storage is private, with no public listing; links are signed and valid for no more than 1 hour.
• Logs contain no tokens or secrets.

12. Your rights

Under the GDPR you have the right to:

• access your stored data (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20), where processing is based on consent or contract
• withdraw consent with effect for the future (Art. 7(3))
• lodge a complaint with a data protection supervisory authority (Art. 77). The authority responsible for the operator is: Independent Centre for Privacy Protection Schleswig-Holstein (Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, ULD), Holstenstraße 98, 24103 Kiel, Germany

Right to object (Art. 21 GDPR)

Where riffbox processes your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. The operator will then no longer process your data unless it can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, email unbecand@gmail.com. The operator responds within one month (Art. 12(3) GDPR), and within 7 days for deletion requests concerning YouTube data. To verify your identity, the operator may ask for proof, for example a message from the affected platform channel.

13. Data Deletion Instructions

These instructions apply to everyone whose data riffbox has received through YouTube, TikTok, Instagram/Meta, X, Twitch or Reddit or directly, and to the operator as holder of the connected accounts.

Option A – Deletion by email (for everyone)

1. Send an email to unbecand@gmail.com with the subject "Data Deletion Request".
2. State the platform and your username or channel name and, if known, links to the affected videos or comments.
3. You receive an acknowledgement with a confirmation code.
4. The operator deletes all data stored about you (metadata, comments, material, transcripts, still frames) and takes affected videos offline:
5. data from X: within 24 hours
6. data from YouTube: within 7 days
7. all other data: without undue delay, within one month at the latest
8. You receive confirmation once deletion is complete. You can ask about the status at any time by email, quoting your confirmation code.

The only exceptions are data that must be kept for legal reasons and a minimal block entry in the creator register, which prevents your material from being used again.

Option B – Disconnecting the app (for account holders)

Anyone who has connected an account to riffbox can revoke access at any time in the platform's settings. riffbox then deletes the tokens and handles the remaining data as in Option A.

Option C – Deletion requested by a platform

If a platform reports a deletion request, it is handled as in Option A.

14. Other mandatory information

• Obligation to provide data: you are not obliged to provide data to the operator. Without contact details, however, no request can be answered and no permission can be documented.
• Children: riffbox is not directed at children. Material showing recognisable minors is not used; permissions are accepted only from adults.
• Special categories: riffbox does not deliberately process special categories of personal data (Art. 9 GDPR). Images and voices are not analysed to uniquely identify a person. Material that reveals e.g. health data is not used.

15. Planned features and changes to this policy

Planned features such as livestreams with chat interaction are not currently active. Before they launch, this policy will be extended to cover the additional processing.

The operator updates this policy when processing, the law or platform requirements change. The version published on this page applies. The date at the top shows when it was last updated.