Studio86 / Legal · Policy

Privacy Policy

v.1 · Last updated 15 June 2026

The short version: we collect what we need to answer your email, run your account, and protect the site — nothing more. We don't sell or rent your data, and we don't use third-party ad networks.

This policy describes how Studio86 (“we,” “us”) collects, uses, and protects personal information when you visit studio86.dev, use our products (TwitchGuard, Redacted, 86Sheets), or contact us by email or web form. It applies to visitors and customers in the United States and Canada. If you access our services from another jurisdiction, additional local rules may apply; this policy is the floor, not the ceiling.

We collect personal information in three narrow situations:

  1. When you submit a form on this site. The contact form, support form, and Redacted free-scan form ask for name, email address, the subject and content of your message, and a URL when relevant. We receive whatever you choose to type.
  2. When you use a Studio86 product.
    • TwitchGuard. We process your email address, the Discord and Twitch identifiers required for the bot to work, and the metadata of moderation events (timestamps, action type, the message body that triggered the action) so the bot can do its job and so moderators can audit it. Subscriptions are processed through Stripe; we receive a subscription record and a customer email, never your card number.
    • Redacted. When you open a managed-service ticket we receive the aliases, sample files, and contact details you share with us. Sample files are processed to produce mathematical fingerprints; we do not keep copies of the original files past that step.
    • 86Sheets. When you sign in with Google we receive your email address and a scoped OAuth token that lets the app push data into a Google Sheet you designate. We do not read other sheets in your Drive.
  3. Automatically, as a normal part of running a website. Our server records the IP address, user agent, page URL, and timestamp of incoming requests. Cloudflare, our content delivery and security provider, processes the same information at the network edge to filter bots and abuse. We do not run third-party analytics, advertising, or fingerprinting scripts.
  • To answer you. Forms exist so we can reply.
  • To deliver the service you signed up for. Subscriptions, license activation, takedown notices, and spreadsheet pushes all require knowing who you are and what you asked for.
  • To bill you and meet our tax and accounting obligations. Payment records are kept for as long as applicable law requires.
  • To keep the site online and secure. Request logs are used to detect abuse, debug errors, and meet our obligations under applicable law.
  • To improve our products. We may review aggregated, non-identifying patterns (which features get used, where errors happen) to make the products better.

We share personal information only with vendors we need to operate. They process data on our behalf under contract and only for the purpose we engaged them for.

  • Cloudflare — content delivery, DDoS protection, DNS, and edge security for studio86.dev.
  • Stripe — payment processing for TwitchGuard subscriptions and any future paid products. Stripe is responsible for handling card data; we never see it.
  • Google (OAuth) — sign-in for 86Sheets. Google authenticates the user and returns a scoped token to us.
  • Resend — transactional email (receipts, license keys, support replies).
  • Sentry — server error monitoring. We configure Sentry to scrub sensitive request data before it leaves our servers.
  • DigitalOcean — our hosting provider.

We do not sell your personal information. We do not share it with advertisers, data brokers, or marketing networks.

The marketing site at studio86.dev uses no cookies. Our products use the minimum cookies required to keep you logged in (a session cookie on 86Sheets, a CSRF token, and a theme preference). These are first-party, essential, and not shared. We do not use tracking pixels, behavioral advertising, or cross-site identifiers.

  • Form submissions are retained in our email inbox and ticket system for as long as needed to resolve and document the conversation.
  • Account and subscription data is retained for as long as the account is active, plus the period required by our tax and accounting obligations.
  • Server request logs are retained for up to 90 days before being deleted or aggregated.
  • You can ask us to delete your data sooner; see your rights below.

Depending on the state you reside in, you may have the right to access the personal information we hold about you, ask us to correct or delete it, opt out of any "sale" or "sharing" of personal information (we do neither), and limit the use of sensitive personal information. California residents have these rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). Residents of other states with comprehensive privacy laws (including Colorado, Connecticut, Utah, Virginia, Texas, Oregon, and others as they come into effect) have analogous rights under their state law.

To exercise a right, email [email protected] with the subject “Privacy request.” We will respond within the timeframe required by applicable law. We will not retaliate against you for exercising a right.

We handle personal information of Canadian residents in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, substantially similar provincial legislation including Quebec's Act respecting the protection of personal information in the private sector (Law 25), British Columbia's Personal Information Protection Act, and Alberta's Personal Information Protection Act.

You have the right to:

  • Know what personal information we hold about you and how we use it;
  • Request access to that information;
  • Request correction of inaccurate or incomplete information;
  • Withdraw your consent to our processing (which may end our ability to provide a service);
  • Lodge a complaint with the Office of the Privacy Commissioner of Canada or your provincial regulator.

To exercise a right, email [email protected]. Studio86 acts as the controller of the personal information described above; you can reach us at the same email address for any privacy-related question.

Our products are not directed at children under 13 (United States) or 13 (Canada, where parental consent for younger users is required under PIPEDA). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

When we update this policy we revise the version number and the “last updated” date at the top of the page. Material changes (changes that broaden how we use your data) are announced on the site for at least 14 days before they take effect.

Questions about this policy, requests to exercise a right, or anything else privacy-related: [email protected].

This document is the controlling Studio86 privacy policy. Nothing in it is legal advice; if you are a customer with a regulated workload (healthcare, financial, EU/UK), we are happy to discuss additional safeguards as part of your engagement.