Who operates Poco Loco
Poco Loco is operated by BrokenChairMedia. This policy explains how we handle personal data when creators host races through supported streaming providers, players join racing sessions, and people use the website, desktop app, or mobile app.
Data we use
We use creator account data supplied by connected providers, such as username, avatar, immutable provider ID, and email when available, to identify creators and open the Arena. We also store the independent Poco Loco profile, connected Twitch, Kick, YouTube, and Steam identities, player names, race entries, race results, XP totals, leaderboard rows, and the technical data needed to keep the service secure and reliable.
Twitch and Kick accounts, chat, and live status
Creators may sign in with Twitch or Kick so we can grant Arena access and connect races to the correct creator account. During active races, Poco Loco processes provider identity, message identifiers, selected human-written message fragments or supported commands, channel and live-status data, and Twitch Cheer Bits amounts where enabled. We use this data to join races, trigger supported gameplay, prevent duplicate handling, and score gameplay. Twitch and Kick remain independent services with their own terms and privacy notices.
YouTube channel and live chat access
When you connect YouTube through Google authorization, Poco Loco requests read-only YouTube access. We use your channel ID, display name, and avatar to identify your account, and live broadcast and live chat data to connect your selected channel to an active Grid or Race. We process chat author identities, message identifiers, timestamps, and supported chat commands to join races, trigger gameplay, and prevent duplicate handling. Public gameplay may display YouTube names, avatars, channel links, and race results as described below. OAuth access and refresh tokens are encrypted on our server so the connection can continue without repeated sign-in. Poco Loco does not upload videos, modify your YouTube content, or post live chat messages. Disconnecting YouTube in Settings deletes the local YouTube credentials and chat connection state; another connected sign-in method is required to keep access to your Poco Loco account. You can also revoke Poco Loco access in your Google Account permissions. Google handles its services under its own privacy policy.
Twitch Extension and Bits
If Poco Loco offers a Twitch Extension, viewers may use Bits for permitted in-extension gameplay experiences such as unlocking a racer, revealing a track option, or adding race time. When the Extension uses Twitch Identity Link, also called ID Share, or when a viewer confirms a Bits action, Twitch may share the viewer display name, numeric Twitch user ID, product SKU or action, transaction ID, transaction receipt metadata, channel/session details, and action time with Poco Loco. We use that data to fulfill the Bits-triggered gameplay action, prevent duplicate transaction handling, attribute gameplay and leaderboard activity, maintain admin reporting, prevent abuse, and respond to privacy or security requests. Twitch handles Bits balances and payment flows; Poco Loco does not collect payment-card data.
Connected accounts, Steam tickets, and account merges
You may connect Twitch, Kick, YouTube, and Steam identities to one Poco Loco account. A Steam build sends a short-lived Steam authentication ticket directly from the protected desktop process to Poco Loco so Valve can verify the local SteamID and AppID. We retain a one-way ticket hash to reject reuse, not the raw ticket. When you explicitly merge two verified Poco Loco accounts, we retain an audited record of the merge, redirect former profile slugs, move connected identities and creator-owned history to the surviving account, revoke the source sessions, and keep the source account as a merged tombstone.
PocoPoints (PP), Mollie, Steam Wallet, and Microsoft Store
When you buy PocoPoints (PP), we store purchase UUIDs, payment provider, provider order and transaction references and statuses, amount, currency, bundle, credited time, wallet balance movements, credit lots, debit allocations, settlement or callback handling data, and refund, reversal, or support correspondence. Web checkout is hosted by Mollie. Steam checkout is authorized through the Steam Overlay and reconciled against Valve settlement reports. In the Microsoft Store edition, Microsoft handles checkout. We use Microsoft Store customer identifiers, encrypted customer authorization keys, product and SKU identifiers, purchase and transaction records, and Collections verification reports to verify purchases, credit PocoPoints, report fulfillment, prevent duplicate credits, and reconcile refunds or revocations. Microsoft customer identifiers are purchase proofs, not Poco Loco login identities or account-merge keys. Mollie, Valve, and Microsoft handle payment method details; Poco Loco does not store card, bank account, wallet, iDEAL, PayPal, or other payment method credentials.
Apple App Store and Google Play purchases
In the iOS and Android apps, Apple or Google handles native payment details and localized prices. We store the native platform, product ID, account-bound order UUID, transaction reference, verification state and wallet outcome to verify purchases and prevent duplicate credits. Google Play purchase tokens are stored encrypted for interrupted-purchase recovery and refund reconciliation; native authentication secrets are kept in the device keychain or encrypted storage. We periodically query the originating store to reconcile verified refunds and revoke affected credits through the existing wallet rules. The originating store receipt is the record of the amount and currency actually charged; a web reference price is not a native purchase receipt. Poco Loco does not receive payment-card details from Apple or Google. Native purchase proofs and authentication secrets are redacted from error reporting.
Why and on what basis we process data
We process data to provide the service you request, build lobbies, assign cars, run races, award XP, show leaderboards, process purchases, prevent abuse, troubleshoot service issues, and comply with legal obligations. Depending on the activity, we rely on performing our contract with you, our legitimate interests in operating and securing Poco Loco, consent where required, or a legal obligation. We do not sell player or creator personal data.
Public gameplay and creator pages
Public track, creator, race, and leaderboard surfaces may show provider display names, avatars, creator channel links, track ownership, scores, ranks, race results, and related gameplay statistics. This lets communities find tracks, recognize creators, and compare race performance.
Analytics and third parties
We do not currently use Google Analytics or other third-party analytics on Poco Loco or a Poco Loco Twitch Extension. We use first-party aggregate counts to understand guide visits, tutorial opens and steps, hosting links, successful provider connections, first completed hosted races, and first published tracks. Counts contain only dates, allowlisted source categories, guide identifiers, event names, and supported platforms. We do not store raw referral URLs or query strings, chat, tokens, IP addresses, or player names in discovery measurement. The existing first-party session may carry source and guide context through sign-in; we introduce no new tracking cookie or cross-site tracking. Minimal account attribution expires after at most 30 days and is deleted by scheduled maintenance; afterward only aggregate counts without user identifiers remain. Reports are restricted to administrators. Missing source information is reported as unknown.
Desktop runtime diagnostics
The desktop app has crash diagnostics enabled by default and lets you disable them in Settings. If an app rendering, graphics, or utility process fails, Poco Loco sends only the process category, standardized failure reason, exit code, app version, operating-system platform, and processor architecture to our authenticated operational logging. We do not upload a memory dump, page URL, username, provider identity, OAuth or session value, local path, or raw error text. Disabled diagnostics are not sent or queued for later. Reports, including standardized categories for bundled renderer errors, are also sent to Sentry.
Retention, security, and your choices
We keep data only for as long as needed for gameplay history, leaderboards, account-link and merge integrity, security, operations, and legal obligations. Purchase, ledger, settlement, refund, reversal, and support records may be kept for accounting, dispute handling, tax, abuse prevention, and legal obligations. Access is limited to operational needs and protected with appropriate technical and organizational measures. Depending on applicable law, you may ask to access, correct, delete, restrict, object to, or receive a copy of your personal data, withdraw consent, or complain to your local data protection authority. Contact [email protected] for account, privacy, payment, or refund requests. We may need to verify your identity before completing a request.