Privacy Policy

Last updated: April 14, 2026

1. What Data We Collect

KingTubbyBots collects and stores the following data to provide its services. Only data required for features you enable is collected.

Discord Bot

Identifiers: Server (guild) IDs, channel IDs, role IDs, user IDs, and usernames — only as needed for configured features.
Leveling: Per-user XP and level data per server.
Voice tracking: Voice channel join/leave times, per-user voice minutes, hourly usage heatmaps, and weekly time cards.
Invite tracking: Invite codes, usage counts, and which invite a new member used to join.
Emoji analytics: Emoji usage counts per user (custom and unicode).
Moderation logs: Action type, moderator, target user, reason, and timestamp (up to 500 entries per server).
Stream stats: User ID, game, stream title, platform, URL, and session timestamps (up to 100 sessions per server).
Server Wrapped: Aggregated annual statistics including message counts and voice time per user.
Tickets: Ticket creator user ID, ticket channel, and ticket count.
Other modules: Giveaway entries, poll votes, counting game state, starboard messages, reaction role mappings, and auto-responder triggers — all stored as server configuration.

Twitch Bot

Watchtime: Per-user watch duration in minutes and last-seen timestamp per channel.
Loyalty points: Point balances, earn timestamps, and transaction history per user.
Quotes: User-submitted quote text and author.
Viewer map: Self-reported location strings (voluntarily provided by users via chat command).
Analytics: Channel metrics, stream performance data, and viewer behavior patterns sourced from the Twitch API.

Web Dashboard

Sessions: When you log in, we store your Discord user ID, username, avatar, and a list of servers you manage. If you link Twitch, that username is also stored in your session.
Account settings: Email address (optional, for login alerts and shared access invites), 2FA enabled status, and 2FA secret.
Trusted devices: A one-way cryptographic hash of your browser's user-agent and your IP address, used to identify recognized devices for login alerts. These hashes cannot be reversed back to the original values.
Shared access: Invite tokens, email addresses of invitees, and the services/servers you choose to share.
Login alerts: When enabled, your IP address is used with GeoIP lookup to determine approximate location for the alert email. This location data is not stored.

Discord Premium Bot

Anti-Nuke: Tracks action counts per user in a short sliding window (seconds) to detect abuse. Only user IDs and action timestamps are stored in memory — no data is written to disk. When triggered, a log embed is sent to the configured Discord channel.
Verification: Temporarily stores pending verification attempts (user ID, challenge answer, attempt count) in memory until the member verifies or times out. No verification data is persisted to disk.
Advanced Moderation: Moderation cases (case number, action type, moderator ID, target user ID, reason, and timestamp) are stored per server. Capped at 5,000 cases per server; oldest cases are pruned automatically.
Advanced Logging: Log embeds are sent directly to configured Discord channels. The bot does not store message content, member activity, or event data on disk — it only relays events to Discord in real time.
Advanced Tickets: Stores ticket creator user ID, ticket channel ID, ticket category, claim status, and form responses. Form responses are posted to the ticket channel and stored as part of ticket metadata.
Server Scan: The /scan command reads your server's current configuration and permissions. No scan results are stored — they are displayed ephemerally.
AI prompts: Text prompts submitted via /ask and /imagine are sent to Cloudflare Workers AI for processing. Prompts are logged locally with your user ID, username, command type, and timestamp.
AI usage tracking: Per-server daily usage counts for chat and image commands. Capped at 1,000 log entries; entries older than 7 days are automatically pruned.
AI blacklist: User IDs of users blocked from AI commands by server administrators or bot operators.
AI-generated images: Generated images are sent directly to Discord and are not stored by us.

Premium Licenses & Purchases

License keys, activation timestamps, and the server/user they are associated with.
Shop orders: When you purchase a license, we store your email address (collected by Stripe at checkout), the generated license key, Stripe customer ID, and subscription ID. We do not store credit card numbers or billing details — all payment processing is handled entirely by Stripe.

2. What We Do NOT Collect

We do not store message content (unless a specific feature like tickets or modmail is in use for that conversation). AI prompts are an exception — they are logged temporarily for abuse prevention and automatically pruned after 7 days.
We do not sell, share, or distribute your data to third parties.
We do not use analytics cookies, advertising trackers, or any third-party tracking scripts.
We do not collect or store payment card details. All payment processing is handled by Stripe; we only receive your email, subscription status, and customer ID.

3. How Data Is Stored

All data is stored locally on the bot's host machine in JSON files. Data is not transmitted to external databases or cloud services. The web dashboard is served exclusively over HTTPS via Cloudflare.

4. Third-Party Services

KingTubbyBots integrates with the following platforms and services. Your use of these platforms is governed by their own privacy policies. We only access data through their official APIs with permissions you grant:

Discord: OAuth2 login (scopes: identify, guilds), bot API for server management.
Twitch: OAuth2 login, Helix API for channel and stream data.
Cloudflare: HTTPS tunnel and DNS — Cloudflare may process request metadata (IP addresses, headers) per their own privacy policy.
Cloudflare Workers AI: AI prompts from /ask and /imagine commands are sent to Cloudflare's AI inference service for processing. Cloudflare's data handling for Workers AI is governed by their own privacy policy.
Stripe: Payment processing for premium license purchases. Stripe collects your email, billing details, and payment card information per their own privacy policy. We do not receive or store card details.
SMTP (Zoho Mail): Used to send login alert, shared access invite, and license key delivery emails. Your email address is transmitted to the mail provider for delivery only.

5. Data Retention

Dashboard sessions: Expire after 30 days of inactivity and are automatically cleaned up.
Moderation logs: Capped at 500 entries per server; oldest entries are pruned automatically.
Stream stats: Capped at 100 sessions per server.
Moderation cases (Premium): Capped at 5,000 cases per server; oldest cases are pruned automatically.
AI usage logs: Capped at 1,000 entries total; daily counts and log entries older than 7 days are automatically deleted.
Leveling & analytics data: User entries inactive for 90 days are automatically pruned. Daily analytics data older than 90 days is deleted.
Streaming data (Twitch, Kick, YouTube): Loyalty points, watchtime, and streak data for users inactive for 60 days is automatically pruned.
Trusted devices: Device records not seen for 90 days are automatically removed.
Bot configuration: Retained as long as the bot is active in your server or channel.
Shared access invites: Pending invites remain until accepted or manually cancelled.
If the bot is removed from a server or channel, associated data is automatically deleted immediately. You may also contact us to confirm deletion.

6. Your Rights

You may request deletion of your server's or channel's data at any time by removing the bot and contacting us.
You may delete your account settings (email, 2FA, trusted devices) from the Account Settings page on the dashboard.
You may revoke shared access grants at any time.
Twitch viewer map locations are self-reported and can be cleared by the channel owner.

7. Security

All dashboard traffic is encrypted via HTTPS.
Session cookies are HTTP-only, secure, and SameSite protected.
Internal bot APIs are not exposed to the public internet.
Two-factor authentication (TOTP) is available for dashboard accounts.
Shared access tokens are cryptographically generated.

8. Children's Privacy

KingTubbyBots is not intended for use by anyone under 13 years old. We do not knowingly collect data from children under 13.

9. Changes to This Policy

We may update this policy at any time. Changes take effect immediately upon posting. Continued use of the Bot or Site constitutes acceptance.

10. Contact

For privacy questions or data deletion requests, contact us at [email protected].