Privacy Policy

This Privacy Policy explains what data Dungeon Keeper collects, how we use it and the choices you have. It covers the Discord bot, the web portal and this website. We do not sell your data.

The data controller for the Service is the Dungeon Keepers team ("us", "we"). You can reach us about privacy matters at [email protected]. We will reply as soon as possible.

• Discord account data. When you sign into the bot, you do so through Discord OAuth with the identify scope. Discord gives us your user ID and your username or display name. We do not receive or manage your email address or password. What we do receive is your server list and it is used to provide you with a list of servers where the bot can be operated by you.
• Session data. The portal uses a signed, httpOnly session cookie named portal_session. It contains your Discord user ID, a Discord access token and an expiry. This cookie lasts up to seven days. This cookie is encrypted to ensure security of information and is rotated occasionally.
• Server configuration. Settings submitted for the bot, either through the portal or bot commands are stored for each server on our infrastructure and are kept safe for your usage.
• Member and moderation data. In the servers where the bot is installed, we use Discord IDs, Display names, usernames and other information needed for features such as levels and XP, counting stats, verification state, reaction roles, moderation actions, audit events, auctions and partnerships. These may be message content, role lists or channel listings.
• Billing data. Payments are handled by Polar as merchant of record. We only receive the order you submitted or the state of your subscription and unique identifiers we created with them to know who you are. We do not receive your full card details.
• Technical data. IP addresses, user agents and diagnostic/analytic information are saved on our infrastructure to keep the Service secure and working at all times. Analytics and diagnostics are anonymised so no information leaks.

• To provide, coordinate, maintain and execute the features offered by the service
• To log you in and identify your server list.
• To grant you the features you paid for through subscriptions or licenses.
• Prevent abuse of our terms, Discord's own terms and remediate security incidents.
• To reply to support tickets and issues as soon as possible.
• To diagnose errors in the system and respond to them accordingly.
• Comply with the law internationally and locally.

We do not overshare data, we only give the minimum needed to ensure we run the service smoothly and only shared with the following third parties:

• Discord as an auth provider and an operations platform.
• Polar for managing payments, subscriptions and tax as well as billing.
• Hosting and infrastructure providers that the Service is run on as required by their policies.

If required by law, we will disclose information to the appropriate authorities. We do not sell your personal data.

Server configuration is kept while the bot is in a server and for a reasonable period after it is removed for our servers to ensure complete deletion and wiping. Session cookies expire after seven days after sign in if no interaction happens on the web portal. Member, moderation and audit records are kept according to each server's settings or until a valid deletion request is sent to us. We delete or redact data when it is no longer needed based on our operational needs.

We use industry standard measures such as signed, httpOnly, sameSite session cookies, access controls, middleware gating by user id and encrypted connections to protect data. No method of storage or transmission is completely secure so ensure you do not send sensitive info.

If you'd like to report a security concern, contact us at [email protected].

Depending on which country you operate from, you may have the right to access, correct, delete or receive a copy of your personal data that we store or you may object to or restrict the processing of some specific kind of data. To make a privacy request, contact us at [email protected].

You can also remove the bot from a server and server owners can manage or delete much of their configuration directly in the portal.

The Service may process and store data in countries other than the one you live in. We take reasonable steps to protect data wherever it is processed. This is required to run the Service.

The Service is not directed to children under 13 or under the minimum age required by Discord in their country. We do not knowingly collect personal data from children below that age. Children under 13 are also not allowed to use the Service.

We may update this Privacy Policy from time to time. Material changes will be posted on this page with a new effective date to keep everyone informed of changes.

For privacy questions or data requests, contact us at [email protected].