Bear Den Initiative
Sleuth Command Portal
Legal Documentation
Effective Date: October 12, 2026 · Version 1.1
Table of Contents
Bear Den Initiative ("BDI," "we," "us," or "our") operates the Sleuth Command community portal at beardeninitiative.org. We are a community-focused organization supporting the KarebearXP streaming community.
For privacy inquiries, you may contact us at: admin@beardeninitiative.org
We collect the following categories of data:
| Data Type | Source | Purpose |
|---|---|---|
| Twitch username, display name, avatar URL, user ID | Twitch OAuth API | Authentication & profile display |
| Twitch follow date, subscription months, bits gifted, subs gifted | Twitch Helix API | Community stats & runestone display |
| Chat command usage, emote usage counts | BDI internal tracking (Twitch chat bot) | Community engagement runestones |
| Discord username (optional) | Discord OAuth API (user-initiated) | Account linking & Discord verification |
| Sleuth handle, primary game, platform URL, hardware specs | User-submitted profile form | Personalized community profile |
| Cave motif, ambient glow color, rune selections, cabin PNG, cabin flags | User-generated via portal tools | Personalized cabin/den display |
| Session scheduling requests, equipment applications | User-submitted forms (Google Apps Script) | Community operations |
| Check-in streaks, achievement records | BDI portal activity tracking | Engagement recognition |
| Session cookie (den_portal_session) | BDI server | Maintaining authenticated sessions |
| TikTok live status (public data) | TikTok API | Displaying live stream indicator |
| YouTube live stream status, video ID, title, and stream format (horizontal/vertical) for KarebearXP's channel | YouTube Data API (YouTube API Services) — public data | Live status display & finding the live chat |
| Live chat messages on KarebearXP's streams (chatter display name, channel/user ID, message text, message ID, mod/member/sub badges) | Twitch, Kick, YouTube (YouTube API Services), Velora, and TikTok (via Lumia Stream) | Showing a combined live chat to KarebearXP's moderators in Den's Echoes |
| Moderator platform links: encrypted access/refresh tokens, platform user ID, and username (Twitch, Kick, YouTube/Google, Velora) | OAuth sign-in initiated by the moderator | Letting moderators delete, time out, ban, or unban using their own accounts |
| Moderation action log (moderator, action, platform, target name/ID, message text, time) | Den's Echoes moderator tools | Accountability, undoing bans, moderator recognition |
| Den's Echoes filter preferences | Moderator's own settings | Remembering each moderator's chosen filters |
| Standard server logs (IP address, browser, timestamps) | Web server | Security, debugging, abuse prevention |
We do not collect payment information directly. Any donations are processed externally and only aggregated totals are stored.
We use the data we collect for the following purposes:
We do not use your data for advertising, behavioral profiling, or sale to third parties.
BDI uses the following third-party services to operate the portal. Each has its own privacy practices:
We do not share your personal data with these third parties beyond what is required to deliver their specific function within our Service.
Bear Den Initiative integrates with the TikTok API to display the live stream status of the KarebearXP TikTok account (@karebearxp) within the portal's live status bar.
What TikTok data we access:
What we do NOT do with TikTok data:
Our use of the TikTok API complies with TikTok's Developer Terms of Service. If you have questions about how TikTok handles data related to their platform, please review TikTok's own privacy policy.
Data minimization: We request only the minimum API scopes necessary to determine live stream status. We do not request scopes that provide access to TikTok user account management, content posting, or private user information.
Security: All API communication between our server and TikTok occurs over HTTPS. API credentials are stored securely as server-side environment variables and are never exposed to the browser.
When you authenticate with Twitch, we receive and store:
When you optionally link your Discord account, we receive and store:
You may revoke BDI's access to your Twitch account at any time via Twitch Connection Settings. Revoking access will prevent future data sync but will not automatically delete previously stored data. To request deletion, contact us.
You may revoke BDI's access to your Discord account at any time via Discord Authorized Apps.
We use the following cookies:
We do not use advertising cookies, tracking pixels, or cross-site analytics cookies. The only session storage used is a brief browser-session cache of your own stats data to reduce API load during your visit (stored in sessionStorage, cleared when your browser tab closes). Moderators using Den's Echoes also have their filter choices saved in the browser's localStorage (and on our server, so they follow the moderator between devices). This holds display settings only.
You can disable cookies in your browser settings, but this will prevent you from logging into the portal.
Your data is stored in a MySQL database hosted on BDI's server infrastructure. We implement the following security measures:
Secure, HttpOnly, and SameSite=None (required for cross-subdomain portal functionality)While we take security seriously, no system is perfectly secure. In the event of a data breach that affects your personal information, we will notify affected users and relevant authorities as required by applicable law.
We retain your profile and stats data for as long as your account is active or as needed to provide the Service. If you have been inactive for more than 24 months with no login, we may purge your data from our systems.
Server log data is retained for a maximum of 90 days for security and debugging purposes.
If you request deletion of your data, we will remove your personally identifiable information from our systems within 30 days (within 7 days for data obtained through YouTube API Services), subject to any legal obligations to retain certain records.
YouTube data is kept for no longer than 30 days, as described in Section 15.
Depending on your location, you may have the following rights regarding your personal data:
To exercise any of these rights, contact us at admin@beardeninitiative.org. We will respond within 30 days. We may require verification of your identity before processing requests.
Residents of California (CCPA), the European Economic Area (GDPR), and the United Kingdom (UK GDPR) have additional rights under their respective laws. We honor all applicable legal rights regardless of your jurisdiction.
The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected data from a child under 13, we will delete it promptly.
If you are a parent or guardian and believe your child has provided us with personal data, please contact us at admin@beardeninitiative.org.
Twitch's own terms require users to be at least 13 to use their platform, which provides an additional layer of age-gating at the authentication step.
We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page. Significant changes will also be announced in the BDI portal or Discord server.
Your continued use of the Service after any changes constitutes your acceptance of the revised Privacy Policy. We encourage you to review this page periodically.
For any privacy-related questions, data requests, or security concerns, please contact:
We treat all security, privacy, and compliance inquiries as high priority and aim to acknowledge them immediately, with full response within 5 business days.
When enabled, the BDI mobile app reads the following data from Android Health Connect (the on-device health data store, which may be populated by a connected Samsung Galaxy Watch or similar device):
How this data is used: Step and distance totals for the current day are periodically sent from the app to our server and displayed as a live walking-distance counter on a stream overlay, alongside a countdown timer that can be extended by subs, bits, and donations from viewers.
What we do NOT do with this data:
Revoking access: Health Connect permissions can be reviewed or revoked at any time from the device's Health Connect app (Settings → Health Connect → App permissions), or via the "Open Health Connect Settings" option within the BDI app itself.
Public YouTube data (no sign-in needed). Using an API key, the portal reads public information about KarebearXP's own YouTube channel:
Live chat is shown in real time to KarebearXP's moderators in Den's Echoes. Messages are held in server memory only while needed to show them and avoid duplicates; they are not saved to our database unless a moderator takes action on one (see below).
Moderators who link a Google account. Moderators can choose to link their own Google/YouTube account in Den's Echoes so that moderation actions are made as them. We request the youtube.force-ssl permission, which is used only to delete chat messages, time out, ban, and unban chatters in KarebearXP's live chat, and only when that moderator clicks the action. When a moderator links, we store:
We do not read their email, subscriptions, videos, comments, or any other YouTube or Google data, and we never post, upload, or change anything on their channel.
Moderation records. When a moderator acts on a YouTube message, we log the action, the moderator, the chatter's name and channel ID, the message text, and YouTube's ban ID (needed to undo a ban).
How YouTube data is shared. YouTube chat is visible only to KarebearXP and her moderators inside the portal. Moderators' action history may be shown to KarebearXP and portal administrators. We do not sell YouTube data, share it with outside parties, use it for advertising, or combine it with other data to build profiles. We do not allow third parties to serve ads or other content in the portal.
How long we keep it.
Removing access. Moderators can remove their YouTube link at any time with the Unlink button in Den's Echoes, which deletes their stored tokens and account details right away. You can also revoke the portal's access through the Google security settings page at https://security.google.com/settings/security/permissions. If access is revoked there, we delete the stored YouTube data for that account within 7 days of noticing the revocation, and always within 30 days.
Google API Services User Data Policy. BDI's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
Questions or complaints about how we handle YouTube data: admin@beardeninitiative.org. Requests to delete your YouTube data are completed within 7 days.
Den's Echoes is a page for KarebearXP's moderators that shows live chat from Twitch, Kick, YouTube, Velora, and TikTok in one feed. Only portal accounts marked as moderators can open it.
Chatters: If you chat on one of KarebearXP's streams, your public display name, user ID, badges, and message are shown to her moderators while the stream is live. We do not store your messages unless a moderator acts on one.
Moderators: Moderators can link their own Twitch, Kick, YouTube, and Velora accounts. Each link asks only for the moderation permissions needed on that platform. Tokens are encrypted and used only when the moderator takes an action. Each action is logged so moderators are accountable and bans can be undone. Moderators can unlink any account at any time from Den's Echoes, or revoke access from that platform's connected-apps settings.
TikTok chat and stream alerts are forwarded from Lumia Stream on KarebearXP's own PC. They contain only the public username and message or alert, and are not stored.
Also see: Terms of Service · Return to Portal