🔒 Privacy Policy & GDPR

The controller is the operator of the PogXyz project (an individual, Czech Republic). The fastest way to reach us about privacy is our support Discord server.

• 🏠server ID, name and icon; settings chosen by admins (channels, roles, texts, prefix),
• ⚠️warnings and moderation actions (user ID, moderator ID, reason, time — capped per server),
• 🎫ticket records (channel ID, opener ID, form answers, status); ticket transcripts are saved as a file to the log channel chosen by admins on Discord — not in our database,
• 📈leveling data (user ID + XP) and aggregate statistics (daily counts of messages, joins/leaves, member totals — never message content),
• 🎛️role-menu and info-panel mappings (message and role IDs).

• 🎁giveaways (prize, host ID, entrant user IDs, winner IDs) and giveaway templates,
• 🪙economy accounts (user ID, virtual balances, cooldown timestamps, daily streak, purchased items),
• 🛍️shop items configured by admins,
• 🧾operational status and error logs (technical messages without personal data).

When you sign in via Discord OAuth2 the website receives your Discord ID, username, avatar and server list — solely to display the dashboard and verify permissions. This data lives in an encrypted session cookie (JWT) and is not stored in our database. The site also uses Cloudflare Turnstile for bot protection.

If you submit a staff application on the /application page, we additionally store:

• 👤your Discord ID, username and avatar (so the team knows who applied),
• ✍️your answers to the application questions — the only personal question is a confirmation that you are 16 or older; the rest covers previous experience, names of servers you have worked on, and role-specific questions,
• ⚖️the decision (approved/rejected), when it was made and the ID of the staff member who decided.

Applications are visible only to the bot's staff team. Decided applications are deleted regularly by senior staff, and you can request deletion of your application at any time on the support server.

• 💬the content of regular messages (we only count them in aggregate; prefix commands are processed in memory),
• 🔑passwords (login is handled entirely by Discord),
• 💳payment details (payments are processed by Ko-fi),
• 📍IP addresses, device fingerprints or location data in our database.

Data is stored in an Upstash Redis database and with our hosting partners (PebbleHost — bots, Vercel — website). Access is protected by secrets known only to the operator. Retention:

• ⏳giveaway entries are deleted automatically 14 days after the giveaway ends,
• ⏳statistics are kept for 31 days, moderation logs and error logs are capped,
• ⏳when a bot is removed from a server, all of that server's data is deleted automatically and irreversibly within 7 days (a grace period in case of an accidental kick); you can request immediate deletion on the support server.

The website uses only technical cookies: the sign-in session, your language choice and Cloudflare Turnstile verification. No tracking or advertising cookies, no analytics profiling.

We never sell data. Data is processed by these services solely to run the project:

• 💬Discord (platform), 🗄️ Upstash (database), ▲ Vercel (website hosting),
• 🖥️PebbleHost (bot hosting), ☁️ Cloudflare (Turnstile), ☕ Ko-fi (payments).

Some providers operate outside the EU (USA). Transfers rely on the EU Standard Contractual Clauses (SCC) or an adequacy decision (EU–US Data Privacy Framework).

We process data under Art. 6(1)(b) GDPR (providing the service you requested by adding the bot or signing in) and Art. 6(1)(f) (legitimate interest in security, abuse prevention and operational logs). Under GDPR you have the right to:

• 👁️access the data we hold about you,
• ✏️have inaccurate data corrected,
• 🗑️erasure (“right to be forgotten”) — e.g. your economy account or your server's data,
• ⏸️restriction of processing and objection,
• 📦data portability (we can export your data in a machine-readable format),
• 🏛️lodge a complaint with a supervisory authority — in the Czech Republic the ÚOOÚ (uoou.gov.cz).

To exercise any right, contact us on the support server — we respond without undue delay, at the latest within 30 days. We perform no automated decision-making or profiling, and the service is not directed at children under 13.