PRIVACY POLICY_
> DRAFT PLACEHOLDER: not legal text, replaced by generated text before launch.
1. Who we are
[TO BE GENERATED]
2. Minimum age
Nyvo follows Discord's minimum age (13, or higher where local law requires) and never knowingly collects data from under-13s. Birthdays are optional personal data, with the year hidden by default.
3. Data collected and retention
| Data | Why | Kept for | Deletion path |
|---|---|---|---|
| Discord user id, username, avatar, email | Sign in to the panel | While the account exists | Delete my account |
| Discord refresh token (encrypted) | Refresh the guild list and linked accounts in the background | Until logout-everywhere, `invalid_grant`, or account deletion (the grant is revoked at Discord) | Logout everywhere, Delete my account |
| Server settings and feature configuration | Run the bot in a server | While the bot is installed, plus 30 days after removal | Remove the bot; purged after 30 days |
| XP, levels, achievements, challenges | Levels features | Same as server settings | Same; user deletion removes personal rows |
| Economy ledger (nyvos) | Balances, audit, dispute handling | Raw rows 30 days, then daily summaries | Same; user deletion removes personal rows |
| Moderation cases (action, target, moderator, reason) | Case history and appeals | While the bot is installed, plus 30 days after removal. Never compacted | Same |
| Appeal text (Discord appeals to moderators) | Review by moderators | 90 days, purged by the owner pod of the guild's partition | Same |
| Blocked-server appeal text and staff note | Staff review of a server block | 90 days after the decision, purged by the `core` retention sweep (triggered by `jobs`) | Delete my account removes the submitter's appeals |
| Closed reports (Report System) | Moderator reference | 90 days after closing, purged by the owner pod of the guild's partition | Same as server settings |
| Moderation log (the case history view) | Moderator reference | Same as moderation cases | Same |
| Ticket transcripts (message text) | Staff reference | 30 days | Same; deleted with the server's data |
| Application answers | Review by staff | To be confirmed | Same |
| Birthday (day and month; year only if the member opts in) | Birthday announcements | Until the member removes it | The member removes it; account deletion |
| Time zone, DM preferences | Local-time features, optional DMs | While the account exists | Delete my account |
| Linked Twitch user id | Linking and badges | Until unlinked | Unlink, Delete my account |
| Twitch read-only token (encrypted, streamers only) | Subscriber checks and EventSub | Until revoked or account deletion | Revoke, Delete my account |
| Vote records and streaks | Vote rewards | To be confirmed | Delete my account |
| Server statistics (counters, no message content) | Charts and exports | Hourly 90 days, daily 2 years | Same as server settings |
| Dashboard activity log | Show who changed what | 30 days | Same as server settings |
| Error records (error id, command, server, user id, context) | Support | 30 days, purged by the `core` retention sweep (triggered by `jobs`) | Expire automatically |
| Staff audit log | Accountability for staff actions | 1 year, purged by the `core` retention sweep | Not deleted on request while required for accountability |
| Sessions | Keep you signed in | Until expiry or logout | Logout everywhere |
RECIPIENTS
| Who | What they handle |
|---|---|
| Discord | Sign-in, the bot itself, linked accounts |
| Twitch | Linked accounts, EventSub, the streamer's own chat |
| Cloudflare | DNS, CDN (sees traffic metadata), R2 object storage for backups and installers, email routing |
| DigitalOcean | The production server |
| Bot-list voting sites (top.gg, Discord Bot List) | Vote webhooks (user id) |
| External uptime and heartbeat monitors | Health check pings, no user data |
Retention periods: [TO BE GENERATED]
4. How data is used
[TO BE GENERATED]
5. Sub-processors
[TO BE GENERATED] (list generated from the data map)
6. Your rights: access, export and deletion
Account deletion revokes the Discord login grant at Discord. Server admins can export their server's Nyvo configuration as a JSON file (member data such as XP and economy is not in that export). [TO BE GENERATED: how members request access, export and deletion, and timelines]
7. Security
[TO BE GENERATED]
8. Contact
Privacy requests: privacy@ (project domain). General support: support@. Security reports: security@. [TO BE GENERATED: full addresses]
9. Changes to this policy
[TO BE GENERATED]
<!-- OPEN: retention gaps marked in docs/privacy-data-map.md (no retention days stated in spec/requirements.md, so none are filled in here). OPEN: the domain's mail setup is not done, so full addresses are unknown. OPEN: member-facing access, export and deletion request process and timelines. OPEN: sub-processor list content (generated from the data map). -->