Privacy Policy

This Privacy Policy explains what data Dungeon Keeper collects, how we use it, and the choices you have. It covers the Discord bot, the web portal, and this website.

The data controller for the Service is the Dungeon Keepers team. You can reach us about privacy matters at [email protected].

• Discord account data. When you sign in, Discord OAuth with the identify scope returns your Discord user ID and your username or display name. We do not receive your email address or password.
• Session data. The portal sets a signed, httpOnly session cookie named portal_session. It contains your Discord user ID and an expiry, and lasts up to seven days.
• Server configuration. Settings submitted through the portal or bot commands, such as roles, channels, messages, automations, moderation rules, and availability schedules, are stored for each server.
• Member and moderation data. In servers where the bot is installed, we process Discord user IDs and related records needed for features such as levels and XP, counting stats, verification state, reaction roles, moderation actions, audit events, auctions, and partnerships.
• Billing data. Payments are handled by Lemon Squeezy. We receive the order or subscription status and identifiers needed to grant a plan. We do not receive your full card details.
• Technical data. We may log IP addresses, user agents, and diagnostic information to keep the Service secure and working.

• provide, operate, and maintain the Service and its features;
• authenticate you and keep your session active;
• grant and manage paid plans and entitlements;
• prevent abuse, fraud, and security incidents;
• respond to support requests;
• improve and troubleshoot the Service;
• comply with legal obligations.

We share data only as needed to run the Service, including with:

• Discord, as the platform the bot and login operate on;
• Lemon Squeezy, for payment processing and billing;
• hosting and infrastructure providers that run the Service.

We may also disclose data where required by law. We do not sell your personal data.

Server configuration is kept while the bot is in a server and for a reasonable period after it is removed. Session cookies expire after seven days. Member, moderation, and audit records are kept according to each server's settings or until a valid deletion request is actioned. We delete or anonymize data when it is no longer needed.

We use measures such as signed, httpOnly, sameSite session cookies, access controls, and encrypted connections to protect data. No method of storage or transmission is completely secure.

Report a security concern to [email protected].

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, and to object to or restrict certain processing. To make a request, contact us at [email protected].

You can also remove the bot from a server, and server owners can manage or delete much of their configuration directly in the portal.

The Service may process and store data in countries other than the one you live in. We take reasonable steps to protect data wherever it is processed.

The Service is not directed to children under 13, or under the minimum age required by Discord in their country. We do not knowingly collect personal data from children below that age.

We may update this Privacy Policy from time to time. Material changes will be posted on this page with a new effective date.

For privacy questions or requests, contact [email protected].