1. Data controller
The operator identified below is responsible for the website's personal data processing. Individual Discord server administrators may independently determine certain processing on their servers. The precise allocation of responsibilities must be assessed against real configurations and relationships.
2. Discord sign-in
If you choose to sign in, Discord provides your Discord user ID, display name and avatar information. With the guilds permission, we temporarily retrieve your server list to display servers that your account may manage. We do not request your email, password, direct messages or server messages through OAuth. OAuth access and refresh tokens are held in your server-side session rather than our community account table. They can be revoked by Discord and are not intentionally exposed to browser JavaScript.
3. Community content and support
We store proposals, votes, submissions, replies and relevant timestamps linked to your website community account. Support requests and attachments are private to their owner and authorized staff. Public suggestions, once approved, may be visible to other visitors. Administrators may store internal notes and audit logs. Contact form submissions can include any details that you voluntarily enter; do not include confidential data unnecessarily.
4. Website administration and security
Administrator accounts contain names, roles, securely hashed passwords, sign-in timestamps and activity records. Limited request-rate data and a one-way hash associated with contact form submissions may be retained to reduce abuse. Depending on your hosting provider, web server access logs may include IP addresses, request times and user-agent information; verify these records with your host.
5. Purpose and legal basis
We process account data to provide requested features, handle requests, maintain security and operate the service. Depending on the activity, the legal basis may be performance of a contract, steps requested before providing a service, legitimate interests or a legal obligation. Consent is only relied upon where appropriate and must be freely withdrawable when applicable. Merely installing Buddy is not unlimited consent to all data processing.
6. Recipients and international transfers
Hosting providers may act as processors; Discord independently processes data under its own policies. Cross-border data transfers and additional third-party services depend on actual hosting and integrations. The operator must verify and document recipients and any necessary safeguards before claiming them here. We do not operate an advertising data sales program.
7. Retention and deletion
Aggregated telemetry history is pruned on the next received heartbeat after a record is more than 30 days old. Website account data can be exported or deleted from the account page; deletion removes proposals, votes and support tickets linked to the account, including stored attachments where technically possible. Other records, including server logs, bot data or previously supplied third-party content, may have different retention rules. Staff activity logs are retained until removed under the operator's policy. The operator must document the real retention schedule.
8. Your rights
Subject to applicable GDPR requirements and exceptions, you may request access, correction, erasure, restriction, portability or object to certain processing. You may also lodge a complaint with your competent supervisory authority; in Czechia this is the Office for Personal Data Protection (ÚOOÚ). Contact the address below for an individualized request. Some requests may require verification of identity.
9. Security and incidents
We use access controls, session security, prepared SQL queries, auditing and restricted storage areas. No technical system can promise absolute protection. Security incidents are assessed under applicable reporting and notification requirements. Do not publish exploit details; contact support privately.
10. Children and changes
Discord's age restrictions and local law apply. Where special safeguards or legal representative consent are required for minors, those safeguards must be implemented. We may update this notice to reflect actual service changes; significant changes should be announced appropriately.
Operator and contact
Operator: [Legal name / operator identification pending]
Contact address: [Address pending]
Support email: [Email pending]
Privacy requests: [Privacy contact pending]
Project: Buddy, an independent Discord application.