Privacy policy

1. Controller

The controller for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

Ingo Seidel
Kreuzstraße 11, 64331 Weiterstadt
E-Mail: jackydog89+discordbot@gmail.com

2. Scope and purpose

The Discord Dynamic Voice Manager is a self-hosted Discord bot with an accompanying web dashboard. The bot manages voice channels automatically (creating, renaming and removing group channels) and can split the members of a voice channel into random teams. The dashboard exists solely for configuration by server administrators.

The service is not offered publicly and is intended exclusively for the controller’s own community servers. No data is passed to third parties for their own purposes.

3. What data is processed

3.1 Server and channel configuration

Stored are the Discord server ID, the server name, the IDs of the configured categories, voice and text channels and, where applicable, roles, together with the corresponding settings (channel names, group sizes, grace periods). These relate to the server, not to individual people.

3.2 Voice channel occupancy

To determine whether a channel is empty, the bot evaluates Discord voice state events in real time. Only the number of people present is derived. Who is, or was, in which channel is never stored. For a bot-managed channel, only technical values are persisted: the channel ID, its status (standby / active / draining), a sequential group number, and a boolean recording whether the channel was ever occupied. None of this relates to an identifiable person.

3.3 Dashboard sign-in

Sign-in happens exclusively through Discord (OAuth2) using the identify and guilds scopes. This processes the Discord user ID, the display name, the avatar URL, and Discord’s access and refresh tokens.

This data is not stored in the database. It lives only in an encrypted session cookie in the signing-in person’s browser (AES-256-GCM) and ends when they sign out or the cookie expires.

3.4 Two-factor authentication (optional)

If an administrator enables two-factor authentication, the following are stored: their Discord user ID, the encrypted TOTP secret, hashes of the recovery codes, and counters for failed attempts and lockout periods. The secret is stored encrypted and the recovery codes only as hashes. Disabling the feature deletes all of it.

3.5 Change log

Configuration changes and operational events are logged: the type of action, the time, the object concerned and - for changes made through the dashboard - the Discord user ID of the person who made them. The log exists to make administrative changes traceable and to diagnose faults. Automatic actions taken by the bot are recorded without any personal reference.

3.6 Team shuffle (/shuffle-group)

When the command runs, the members currently present in the configured voice channel are read and distributed randomly across groups. The result is posted as a message in the configured text channel and mentions the people involved. The assignment is not stored; it exists only in the Discord message, subject to that server’s own deletion behaviour.

4. What is explicitly not processed

• No message content. The bot deliberately does not request the required Message Content Intent and is technically unable to read message text.
• No email addresses, phone numbers or payment data.
• No online status, activity or presence data.
• No member lists beyond the specific voice channel concerned.
• No analytics, tracking or advertising services, and no profiling.

5. Cookies

Only strictly necessary cookies are used:

• dvm_session - encrypted session cookie that keeps you signed in. Lifetime up to 30 days.
• dvm_oauth_state - short-lived cookie protecting the sign-in flow against cross-site request forgery. Lifetime 5 minutes.
• dvm_locale - stores the chosen interface language. Lifetime up to 12 months.

All are required for operation; no consent is needed for them under § 25(2) TDDDG. No analytics or marketing cookies are set.

6. Legal bases

• Art. 6(1)(f) GDPR (legitimate interests) for operating the bot, the automatic channel management, the change log and securing the dashboard. The legitimate interest lies in running the community infrastructure reliably and traceably.
• Art. 6(1)(b) GDPR (performance of a contract) for providing the dashboard to administrators.
• Art. 6(1)(a) GDPR (consent) for voluntarily enabling two-factor authentication; it can be withdrawn at any time by disabling the feature.

7. Recipients

No data is transmitted to third parties for their own purposes. Technically involved are:

• Discord - operator of the platform itself. Every interaction necessarily runs through Discord; their privacy policy applies in addition.
• The hosting provider of the server this service runs on, as a processor.

8. Transfers to third countries

Discord is operated by Discord Inc., based in the USA. Using Discord therefore transfers data to the USA. The controller has no influence over this transfer; it is inherent in using the platform. Discord’s own data protection terms govern it.

9. Retention

• Configuration data - until the configuration is deleted or the bot is permanently removed from the server.
• Managed channels - the record is removed as soon as the channel is deleted.
• Change log - up to 12 months, then deleted.
• Two-factor data - until disabled by the person concerned.
• Session cookie - until sign-out, at most 30 days.

10. Server log files

When the dashboard is accessed, the server software may log technical access data (including IP address, time and requested path). The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is operational security and fault diagnosis. This data is not combined with the processing described above.

11. Your rights

You have the following rights in relation to the controller:

• Access to the data processed about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with future effect (Art. 7(3) GDPR)

An informal message to the contact address above is enough to exercise them. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

12. Security

Credentials are processed exclusively server-side and are never delivered to the browser. Session data is encrypted and protected against tampering, and access to a server’s configuration is re-checked against the actual Discord permissions on every operation. Access can optionally be secured further with two-factor authentication.

13. Changes to this policy

This policy is updated when the underlying processing changes. The version published on this page is the applicable one; the date of the last change is shown above.