Privacy Policy

Last updated: 2026-10-19

1. What we collect

• Discord profile data — user ID, username, display name and avatar, received via OAuth2 (identify scope) when you sign in. We never receive your Discord password.
• License data — keys, redemption times, expiry dates, transfers and administrative grants.
• Usage data — an internal audit log of security-relevant actions (sign-ins, license redemptions and transfers, sensitive field reveals, admin actions), including IP address and timestamp.
• Backend data — the dashboard reads the same operational database as the AutoSecure bots. Records shown to you are scoped to your Discord user ID by ownership checks.

2. What we don't collect

We do not collect your Discord password, and we do not use third-party analytics, tracking pixels or advertising networks on this site.

3. How data is used

Data is used to authenticate you, operate the licensing system, show your own assets (licenses, bots, accounts, quarantine entries), enforce expiry, and maintain security audit trails. Sensitive values are masked in all list views; revealing a masked value is logged to the audit trail.

4. Storage & retention

Data lives in the same SQLite database operated by the AutoSecure backend. Sessions expire after 14 days of inactivity. Audit records are retained for security and dispute resolution purposes.

5. Sharing

We do not sell or rent personal data. Data is shared only when required by law or with the infrastructure your own deployment runs on (your own servers).

6. Your controls

You can update notification preferences in Dashboard Settings. To request deletion of your web account data, contact the team via Discord.

7. Security

Sessions use HttpOnly, SameSite cookies; state-changing requests require CSRF tokens; OAuth uses PKCE; and the API supports short-lived, license-bound bearer tokens. No system is perfectly secure — use a strong Discord account (with 2FA).