Privacy Policy

1. Information We Collect

• Discord Account Information: your Discord user ID, username, discriminator, and avatar, obtained via Discord OAuth2 when you log in to the dashboard.
• Email Address (optional): if you grant the "email" OAuth scope during login, we store the email address Discord provides. You are not required to grant this scope to use core Bot features; if you decline it, no email is collected or stored.
• Guild List and Membership: the list of Discord servers ("guilds") you belong to. Separately, if you grant the "guilds.join" OAuth scope and additionally opt in on our own consent screen (not just Discord's), we use that permission to add you to the Wabbit Community support server. Granting Discord's scope alone does not add you to any server; our own separate opt-in is what triggers the action, and you can change your mind at any time from your Account page (wabbit.gg/account).
• Device and Connection Information: IP address and browser/user-agent string, recorded per login session for account security (detecting suspicious logins, rate-limiting, and abuse prevention).
• Command Usage: which Bot commands you run, in which server, and the parameters supplied, so the Bot can execute and log the requested action.
• Server (Guild) Configuration: settings server administrators configure via the dashboard (channel IDs, role IDs, economy settings, custom commands, moderation rules, and similar).
• Economy and Gameplay Data: in-Bot virtual currency balances, inventory, pets, and related gameplay state associated with your Discord user ID within each server.
• Consent Records: when you respond to a consent choice (such as the marketing-email or community-server opt-ins described in Section 10), we keep a record of what was granted, when, and from what IP address/device, as evidence that consent was properly obtained.
• Purchase Metadata: if you make a purchase through the dashboard, your Discord user ID, username, and avatar are shared with our payment processors (see Section 8) as order metadata. Your data is processed and stored by Stripe or Coinbase Commerce, but we may receive some information about your transaction.

2. Legal Basis for Processing (GDPR Art. 6)

• Performance of a contract: processing your Discord ID, username, avatar, guild list, command usage, server configuration, and economy data is necessary to provide the Bot and dashboard services you request by using them.
• Consent: collecting your email address depends on you granting the "email" OAuth scope. Using that email for marketing/product updates, and adding you to the Wabbit Community server, each depend on a further, separate opt-in on our own consent screen. You may withdraw any of this consent at any time from your Account page (wabbit.gg/account), or by revoking the Bot's Discord authorization in your Discord "Authorized Apps" settings.
• Legitimate interest: recording IP address, user-agent, and session metadata is necessary for our legitimate interest in securing accounts, preventing fraud and abuse, and maintaining Service integrity.

3. How We Use Your Information

• To provide, operate, and maintain the Bot and dashboard.
• To persist your server configuration and gameplay state between sessions.
• To detect, investigate, and prevent fraud, abuse, and violations of our Terms of Service.
• To diagnose and fix technical errors (error logs may include your Discord ID, but not your email, IP address, or message content).

4. Featured Servers

By adding WabbitBot to your server, your server may be featured on wabbit.gg marketing surfaces (such as the homepage and the Premium page), showing your server's public Discord name, icon, and approximate member count as provided by Discord. If you would prefer your server not be featured, email support@wabbit.gg and we will remove it.

5. Message Content

The Bot processes message content in real time to power features such as AutoMod, XP tracking, and chat-based rewards. Message content is not cached or persisted after processing. Exception: if a server administrator has configured a moderation log channel, the content of messages that are edited or deleted may be forwarded to that log channel as part of the moderation feature the administrators enabled. This is visible only within that server, and is never stored, viewed, or processed externally by TeamWabbit.

6. Data Retention

Account data (Discord identity, email, guild configuration, economy/gameplay state) and session metadata (IP address, user-agent, login records) are retained together, for as long as your account exists, so the Service continues to function correctly and your sessions stay secure. We do not currently run an automatic time-based purge of this data. Deletion and anonymization requests submitted through your Account page (wabbit.gg/account) are completed immediately; requests submitted by contacting us directly are completed within 30 days, in line with GDPR's "without undue delay" standard. Consent records (Section 1) are kept for as long as your account exists, as evidence of what was consented to and when.

7. Cookies

We use only strictly necessary cookies required for the Service to function: an httpOnly access-token cookie (15-minute lifetime), an httpOnly refresh-token cookie (30-day lifetime), and a short-lived httpOnly cookie used only during the Discord login redirect. These are not used for advertising, tracking across other websites, or analytics, and are exempt from cookie-consent requirements under GDPR/ePrivacy as strictly necessary cookies. Checkout is handled entirely on Stripe's own hosted payment page; we do not load Stripe's client-side scripts on wabbit.gg, so no Stripe cookies are set by this Service. We do not currently use any advertising or analytics tracking of any kind. If that ever changes, we will add a consent mechanism before deploying it and update this section.

8. Third-Party Data Processors

• Discord Inc. (USA): the platform WabbitBot operates on. All Bot functionality depends on the Discord API; your use of Discord is separately governed by Discord's own Privacy Policy.
• Stripe, Inc. (USA): processes card payments for dashboard purchases via Stripe's own hosted checkout page. Receives your Discord user ID, username, and avatar as order metadata; card details are handled entirely by Stripe and never reach our servers.
• Coinbase, Inc. / Coinbase Commerce (USA): processes cryptocurrency payments for dashboard purchases, under the same limited-metadata terms as Stripe.
• Hetzner Online GmbH (Germany): our infrastructure provider. Our servers and self-hosted database are located in Hetzner's Nuremberg, Germany data center, meaning your core account and server data is stored within the European Union.

9. International Data Transfers

Your core account and server data is stored on servers located in Nuremberg, Germany, within the European Union. Discord, Stripe, and Coinbase are United States companies and, as described in Section 8, receive a limited set of data (primarily your Discord ID, username, and avatar) in the course of providing their services. Each of these providers maintains its own GDPR-compliant transfer safeguards (including Standard Contractual Clauses) governing any transfer of personal data outside the EEA/UK; we do not transfer data to any other third party or country beyond what is described in Section 8.

10. Your Rights

• Access and portability: you can download a machine-readable copy of your stored data, including your consent history, at any time from your Account page (wabbit.gg/account), under "Privacy & Data."
• Erasure: you can request deletion of your account data from the same "Privacy & Data" section. We anonymize your Discord identity (ID, username, avatar, email) rather than deleting shared server records outright, so that other members' economy history, trades, and leaderboards in servers you participated in are not corrupted; contact us (Section 12) if you specifically require full record deletion instead.
• Rectification: your Discord profile information (username, avatar) is refreshed automatically on each login; contact us to correct any other inaccurate data we hold.
• Restriction and objection: you may object to processing based on legitimate interest (Section 2) or request we restrict processing, by contacting us.
• Withdraw consent: turn off marketing emails or the Wabbit Community auto-join anytime from your Account page (wabbit.gg/account), or revoke the Bot's authorization entirely in your Discord "Authorized Apps" settings.
• Lodge a complaint: EU/UK residents may lodge a complaint with their local data protection supervisory authority, or with the authority for the location of our infrastructure provider, the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), https://www.lda.bayern.de.

11. Children's Privacy

The Service is not directed to, and may not be used by, anyone under 13 years of age, consistent with Discord's own Terms of Service. We do not knowingly collect data from children under 13. If we learn we have collected such data, we will delete it.

12. Data Security

OAuth access and refresh tokens are encrypted at rest (AES-256-GCM). Dashboard authentication cookies are httpOnly and transmitted only over HTTPS in production. Access to stored data is restricted to authorized systems and personnel. No method of transmission or storage is 100% secure; we cannot guarantee absolute security, but we take reasonable technical measures appropriate to the sensitivity of the data described in this policy.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced via the Bot's status or announcement channels, and the "Last Updated" date above will be revised. Continued use of the Service after a change takes effect constitutes acceptance of the revised policy.

14. Contact Information

TeamWabbit's principal address is 7901 4th St N, Suite 300, St. Petersburg, FL 33702. For any question about this policy, or to exercise the rights described in Section 10, contact us at support@wabbit.gg or via our Support Server. By using WabbitBot, you acknowledge that you have read and understood this Privacy Policy.