OUTPOST XLII // PRIVACY

Privacy policy

Last updated 6 November 2026.

This privacy policy covers naraxian.net and xlii.gg, the XLII bot in Twitch chat and the XLII app on Discord: what they do with data about you, why, for how long, and what your rights are. Both sites run on one server with one database, and one person runs them.

Who is responsible

Nara, who runs naraxian.net, xlii.gg and the XLII bot. You can reach me through the contact form.

In Twitch chat, where the XLII bot is

Streamers add the XLII bot to their Twitch channel. In those channels the bot follows chat and the channel's events all the time, live and offline, and keeps a record. About you, that record holds:

• your Twitch account ID, user name and display name, and the earlier names it saw you use;
• what you write in chat and when, with the stream it was written in;
• when you follow or unfollow the channel, subscribe, gift subs, cheer, raid or redeem channel points;
• when a moderator times you out, bans or unbans you, or deletes one of your messages;
• when you were in the chat list of a live stream, also without writing anything, your moderator or VIP status, and how many streams in a row you were there;
• what you ask the bot for: song requests, tasks, a signature in the crew manifest, a clip, a name or voice for text-to-speech;
• what the streamer keeps about you: the name and pronunciation the bot uses for you, your text-to-speech voice, an "about" file and private notes.

The bot uses this to do its work in that channel: greetings, counters, song requests, text-to-speech, the alerts and the chat on the stream. And it gives the streamer a memory of their community on their dashboard. Two streamers who agree to share their audience see each other's records of the people who chat with them. What the bot shows on stream, everyone watching sees. Some of it is also on the channel's public pages: the crew manifest shows signatures, the community playlist who suggested a track, the portal the song requests and the co-working tasks.

A few parts go to other services:

• When text-to-speech is on in a channel, the lines it reads out, with your name, go to ElevenLabs to be turned into speech. The spoken audio is kept with the stream, so the streamer can play it again.
• A chat line that the bot's own language check finds is not English goes to Anthropic's Claude to be translated, when the streamer has the live page open or text-to-speech reads the line. The translation is kept with the line, and if the channel turned it on, the bot posts it in chat as a reply.
• When a streamer turns on AI-written bot lines, Claude writes some of them: a greeting, a thank-you that names the stream's new followers and subscribers, a shoutout or a raid message. It gets the names that line is about.
• After a stream, the chat of that stream goes to Claude to write a summary for the streamer, together with the "about" files of the people in it. Claude may propose additions to an "about" file; nothing is added until the streamer accepts it. When the streamer asks, Claude also tidies one "about" file, so that it says everything in it once; that file alone goes to it, and nothing changes until the streamer saves it.
• When the streamer turns on the voice module of the XLII companion app, what their microphone picks up goes to ElevenLabs to be written down. The transcript is kept with the stream.
• The station intercom answers questions the streamer asks out loud. Claude writes the answer and reads the "about" files and the recent chat and transcript for it, so what is in them may be said on stream. It also keeps what the streamer asks it to remember. The private notes never go to a model.
• When the streamer plays Fortnite or PUBG with the XLII tracker, the bot keeps the names and account IDs of the players in the same matches, and looks up their public game stats through fortnite-api.com and the PUBG API.

I do this out of the streamer's and my legitimate interest in running a bot for a community, in a chat that is public. The record stays as long as the channel uses the bot; nothing in it is deleted automatically. If you want out of it, write to me through the contact form: I delete what the bot keeps about you, and take you off the public pages.

Signing in on xlii.gg

You sign in on xlii.gg with Twitch. Twitch tells me your account ID, user name and display name; no email address and no password. That makes you an account here, which the streamer dashboard, the portal and the book club all use. A streamer who adds the bot to their channel also gives it the Twitch permissions it needs there, and the bot keeps the keys Twitch hands out for that. A streamer who connects Spotify for song requests gives it the same for Spotify, with the Spotify account's name.

Accounts with an email address exist only for people I set up myself. They hold the email address, a name, and a scrambled form of the password or a link to my own single sign-on service.

This is what you sign up for, so I need it to give you the service. Your account stays until you ask me to delete it.

The book club

The XLII Book Club keeps, for each member: the request to join and when you joined or left, the name the club uses for you and what your profile shows, your bookmark in each book you read (chapter, page, finished, your rating and review), your posts and the images you add to them, your suggestions and votes for the next book, which chapters you have seen, the day of your last visit, and which books' private copies you may download. Some books are private reads: for those, the club keeps which members may see them, and only those members see the book, its readers and its posts. Any other book's page shows its readers and how far each one is to anyone, signed in or not. Profiles and posts are for members. The images you add to a post are stored at an address that is hard to guess, but anyone who has that address can open them. The reader leading a book, and whoever runs the club, see the day each reader last visited. On stream, the bot's !bookclub card shows the Twitch pictures of up to seven readers, unless they hide their club books.

All of this is there because you join and use the club. Leaving keeps your posts and your name, so they come back if you return; ask me through the contact form and I delete them.

The rest is your choice, and you can switch each part off again in the club's settings:

• Email. The address you give, after you confirm it, gets the club's mail: a confirmation link, new books, and a digest of new posts. Postmark sends it. To limit confirmation mails, the times they went out are kept for one day. To see when mail does not arrive, each email the club sends is logged: when, to which address, its subject, and what Postmark reports back (delivered, bounced and why, or marked as spam). That log is kept for 13 months, and deleted when you take your address off or give another.
• Notifications. Your browser's push address and keys. The notification goes through your browser's push service (Google, Mozilla, Apple or Microsoft, depending on the browser). The book club's pages install a small service worker for this; it only shows notifications and keeps nothing.
• Hardcover. Linking your Hardcover account keeps your Hardcover ID, user name and the keys to update your reading there, plus a copy of the books on your Hardcover profile that you made public. Your progress in the club then goes to Hardcover.
• Discord. Linking your Discord account keeps its ID and names. The XLII app gives you the club's role on the XLII Discord server and, if you ask for it, sends you direct messages. The club's General posts are copied into the club's forum on that server, under your club name and Twitch picture, and a daily line there says who moved to which chapter, unless you hide your club books.

The guestbook on naraxian.net

When you sign the guestbook, I keep your name, your message and the time. You may sign in with Twitch first; the entry then carries your Twitch user name and display name instead of a typed name, and your browser remembers that sign-in for 30 days, until you press "unlink" on the guestbook. An entry the spam check flags waits for me before it shows; every other entry is public right away. Entries stay until I delete them, and I delete yours when you ask.

The contact form

The contact form asks for your email address, your message and, if you like, a name. It sends them to me as an email through Postmark, so I can answer you; the site itself keeps nothing of it. I keep the mail only as long as I need it to answer you. Postmark keeps a copy for 45 days.

Statistics

I count visits with Plausible Analytics, a European service, on naraxian.net and on the public pages of xlii.gg. Plausible uses no cookies, stores no IP addresses and does not follow you to other websites: I only see totals, like the number of visitors per page. The streamer dashboard is not counted. I do this out of my legitimate interest in seeing how the sites are used.

Cookies

These are all the cookies the sites set. None are for ads or tracking.

• csrf_token (both sites): protects the forms against requests sent from other websites. 30 days.
• session (xlii.gg): keeps you signed in. 24 hours.
• gb_identity (naraxian.net): your Twitch sign-in for the guestbook. 30 days.
• twitch_oauth_state (both sites), login_return, spotify_oauth_state, hardcover_oauth, discord_oauth and xlii_pair (xlii.gg): carry a sign-in, a link to another account or the pairing of the XLII companion app from one step to the next. 10 minutes.
• session, __Host-oidc_flow and keel_admin_site (the admin of naraxian.net, only for people I set up): keep you signed in for 24 hours, carry a single sign-on for 10 minutes, and remember which site you manage until you close the browser.

They are all strictly necessary for what you ask the site to do, so they need no consent. Besides cookies, a few pages keep a setting or an unsent draft in your browser's own storage: the portal, the book club and the streamer dashboard. That stays in your browser.

Server logs

The server in front of both sites logs every request: your IP address, the time, the address you asked for, the answer, the page you came from and your browser's name. The sites themselves log the address asked for too, without your IP address. That serves only to keep the sites safe and working (my legitimate interest). The logs are kept for about a week at most, then overwritten.

Who else processes data

• The sites, the database and the uploaded files are on servers of Hetzner in the European Union.
• Bunny.net (BunnyWay, Slovenia, European Union) carries every request to naraxian.net through its network to the server, and sees your IP address when it does.
• Twitch (United States) is where chat, the streams and the sign-in come from. Profile pictures and emotes load from Twitch's servers, and emotes also from 7TV. Book covers on the book club's pages load from Hardcover.
• Anthropic (United States) runs Claude for the translations, the AI-written bot lines, the stream summaries, tidying an "about" file, the station intercom and the streamer's title suggestions.
• ElevenLabs (United States) makes the text-to-speech and writes down the streamer's microphone.
• Postmark (ActiveCampaign, United States) sends the email.
• Plausible Analytics (European Union) counts the visits.
• Discord (United States) runs the XLII server and the app's messages; Hardcover (United States) holds the reading of members who link it; Spotify (Sweden) plays the song requests of streamers who connect it.
• fortnite-api.com and the PUBG API (KRAFTON) answer the game lookups.
• Your browser loads the fonts from Google Fonts (United States), and Google sees your IP address when it does. A YouTube video or a Twitch clip on a page is embedded from YouTube or Twitch.

Data that goes to a service in the United States leaves the European Union. I don't sell your data or give it to anyone else, unless the law makes me.

Your rights

You may always see the data I hold about you, have it corrected or deleted, have its use limited, object to it, or get it in a common format. Where something runs on your choice (email, notifications, a linked account) you can switch it off at any time. Ask through the contact form; you get an answer within a month.

If you are not happy with how I handle your data, you can complain to the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels (www.dataprotectionauthority.be).

Outside these sites

The XLII crew lookup browser extension has its own privacy policy. Twitch, Discord, Hardcover and Spotify have theirs for what you do there.

Changes

When something changes on the sites that touches your data, this policy changes with it. The date at the top says when that last happened.