Security

In short

Donation Wars never handles payments and can't see or spend your money. We only receive a notification that a donation has already gone through — so we can show it on screen as a fight.

What actually happens with a donation

Money goes directly from the viewer to the streamer through a service the streamer already uses — DonationAlerts or Streamlabs. Donation Wars is not part of that chain: we never accept payments, never see or store card data, and can never withdraw or hold anyone’s money. Our part starts only after a donation has already gone through the donation service — we receive a notification about the event from it and use that to spawn or power up a fighter on screen.

What access we request when connecting

When a streamer connects Donation Wars, the donation service asks them to confirm access via OAuth — and that same window shows exactly what is being requested: a subscription to donation events (amount, nickname, message — what we need to figure out who to spawn and how strong). We do not request, and technically cannot request, access to withdrawals, balance, or account management — that option simply isn't among the permissions the donation service grants to third-party apps.

We don't decide what's shown in that window — DonationAlerts or Streamlabs does. So it's worth reading it yourself rather than taking our word for it.

How to revoke access

One click — in the donation service’s own settings, under connected apps. Revocation happens on their side and requires nothing from you in Donation Wars: from that moment we simply stop receiving any events.

What we store

At the moment we process an event we see the donation amount — we need it right then to decide how much to power up or spawn a fighter. We do not keep a line-by-line history of "who donated how much": donation data that remains with us after processing is stored in aggregated form (e.g. for fight statistics), without linking a specific amount to a specific donor.

Infrastructure

The site and API run over HTTPS (certificates are issued and renewed automatically), and the connection to the database is also encrypted. We do not share donation data with third parties and do not use it for advertising.

Documents and contact

Full terms are in the Terms of Use and Privacy Policy. If you have a security question — email us at support@donowarlay.com.