Privacy Policy

1. Scope and sources

This policy applies to the Whiteout Survival Bot V2 deployment hosted by matthew. and its associated web panel. It does not cover independently operated copies of the software. Information comes from Discord’s API, your interactions with the service, authorized server or alliance administrators, game lookup and redemption services, and requests you send to our contact address.

2. Information we process

We do not ask for your Discord or game password, payment-card details, government ID or sensitive personal information. Do not include those details in messages, notes, uploads or support requests. Discord and authorized infrastructure may temporarily cache information necessary to operate the bot even when it is not a permanent database field.

3. Why we use information

We use information to authenticate and authorize users; manage game rosters, links, events, reservations and guides; retrieve game information and redeem codes; translate and deliver messages; send configured reminders and notifications; keep backups; diagnose faults; protect the service; respond to requests; and meet legal and platform obligations.

Where data-protection law requires a legal basis, the applicable basis depends on the feature: providing the service you request, legitimate interests in operating and securing a community tool, consent where required for an optional use, or a legal obligation. A server administrator’s decision does not waive an individual’s rights. Contact us about the basis for a particular use or to withdraw consent where consent applies.

4. How translation handles messages

In administrator-linked language channels, the bot reads new member messages and may retrieve them again to process edits or deletions. It sends the text to an operator-hosted LibreTranslate/Argos service for translation. This translation service runs on our own infrastructure; message text is not sent to a paid external translation API or used to train or fine-tune a model.

Automatic translations are posted to the other linked channels with the author’s display name and a link to the original. People who can read those destination channels can see the copies. The bot requires matching reading permissions and age restrictions when linking channels. Administrators should tell members which channels are linked.

A private translation is returned through a Discord response intended to be visible only to its requester. The bot verifies the requester’s access to the original channel. Discord still processes that interaction and response.

The translation job database stores IDs, target language, status, attempts, timestamps and copied-message IDs; it does not store the original message body. A bounded in-memory cache holds up to 500 translation results. Results are reused for up to ten minutes; entries can remain in memory until replaced, evicted or the process restarts. Pending requests also hold text in memory while being processed.

Tracked copies are updated or removed when relevant Discord edit/deletion events reach the bot and it still has access. An outage or lost permission can prevent synchronization. Deleting an original does not guarantee the removal of screenshots, other people’s copies or data held independently by Discord. Contact us if a tracked translation needs removal.

5. Who receives information

• Discord: receives commands, interactions, translated copies, notifications and reminders as needed to operate the bot. See Discord’s Privacy Policy.
• Authorized administrators and intended viewers: may see information within their configured access, including roster/event records, account-link requests, content and operational records. Published guides and reservation pages may be accessible to anyone with their URL, depending on their access settings. Do not put private information into public content.
• Game services: Whiteout Survival/Kingshot lookup and redemption endpoints receive relevant player IDs and redemption requests. Community gift-code synchronization services receive or supply codes and code metadata. These features do not require game passwords.
• Cloudflare: provides website delivery and security, including processing network/request metadata and necessary security cookies. See Cloudflare’s Privacy Policy.
• Google Drive: is configured for owner-controlled core database backups. Those backups can contain the core records described here. The service stores the operator’s Google authorization credentials to perform authorized backups; ordinary members do not need to connect Google accounts. See Google’s Privacy Policy.
• Email and optional payment services: an email request is processed by the operator’s email service. If you follow an optional PayPal support link, PayPal processes that transaction under its own terms. The bot does not collect full payment-card details.

We may also disclose information when legally required, to address security or abuse, or when you specifically direct a permitted disclosure. We do not provide API data to advertisers, data brokers or monetization services. Infrastructure providers receive information only as needed for their role; their own applicable privacy terms also apply.

6. Cookies, browser storage and login

The panel uses a necessary panel_token session cookie, with a maximum configured session duration of 30 days. Guide login/unlock features may set additional necessary cookies. Temporary OAuth state and one-time login links normally expire after five minutes. Discord authorization codes/tokens are processed to complete authorized login; member Discord OAuth refresh tokens are not stored as ongoing login credentials by the panel.

Local storage remembers settings such as theme, selected game, sidebar position and calculator preferences. Session storage tracks a pending login. Clear your browser’s site data to remove these preferences and cookies. The custom panel does not install advertising trackers; Cloudflare or third-party pages you choose to open may use their own necessary cookies or technologies.

7. Storage, retention and backups

Persistent service records are stored in operator-controlled databases and files. We keep records while they are needed for configured features, support, security or a legal requirement. User preferences, account links, rosters, events, attendance, guides, reservations, administrative history and translation delivery metadata do not all have automatic age-based expiration. You can request removal; records no longer needed for permitted functionality must be deleted.

System-log records are normally cleaned on a daily schedule once older than seven days. Completed/failed process records are normally cleaned at startup and daily. Other diagnostic, administrative and infrastructure logs may have different retention depending on operational need and provider settings.

Scheduled Google Drive core backups are configured to retain the latest five copies after successful cleanup. This is a copy-count limit, not a guaranteed number of days. Separate local deployment or recovery backups do not use that rotation. Data requests include relevant backups under our control: we will remove or sanitize affected copies as appropriate, limit any legally required retention, and avoid reintroducing deleted information during a restore. We will explain any lawful retention exception.

Removing the bot, leaving a server, logging out or clearing browser data does not automatically delete stored records or Discord messages. Contact us to request deletion across the records we control.

8. Security and international processing

We use HTTPS for the public website, permission checks, restricted administrator access and an internal translation service to reduce unauthorized access. No system or transmission can be guaranteed secure. If a data incident requires notification, we will notify affected users and relevant parties as required by applicable law and Discord’s requirements.

The operator is based in the United States. Information can be processed in the United States and other locations used by Discord, Google, Cloudflare and other necessary providers. Applicable data-protection obligations continue to apply to such processing; contact us for information relevant to your circumstances.

9. Your choices and rights

• Choose your translation language with /chatlanguage or in the panel. Use private translation or avoid linked channels if you do not want a new message automatically shared there.
• Ask an authorized administrator to remove a game link, correct a roster or participation record, change channel settings or remove content they manage. Contact the operator if you cannot use those controls.
• Revoke the application’s authorization in Discord, block bot messages, or ask an authorized server administrator to remove it. Separately request deletion of stored data if desired.
• Depending on applicable law, request access, a copy, correction, deletion, restriction, portability, withdrawal of consent or objection to particular processing. You may also have the right to complain to a relevant data-protection authority. We will not deny legally protected rights for exercising them.

10. Access, correction and deletion requests

Email matthew@matthewzusa.dev with “Bot privacy request” in the subject. Describe your request and include your Discord user ID, any relevant game player ID and, if useful, the server/channel or affected record. Request only data you are entitled to control. Never send passwords, login tokens or government identification.

We may ask for a proportionate confirmation through your Discord account or other relevant account-control evidence before disclosing or deleting information. We will respond promptly and within any deadline that applicable law requires. If we cannot fulfill part of a request, we will explain the reason and any available next steps. An authorized representative may contact us, subject to reasonable verification.

Deletion can include preferences, links, event/reminder references, relevant records and tracked copies within our control. Some shared records may be corrected or de-identified instead where lawful and appropriate. We cannot delete data held independently by Discord, game publishers, other members or providers outside our control; we can explain where a separate request may be needed.

11. Children and policy changes

The service is not intended for anyone under 13 or below Discord’s higher local minimum age. We do not knowingly seek their personal information. If you believe it has been processed, contact us so we can investigate and remove it as appropriate.

We will publish changes here with an updated date and provide additional notice of material changes where required. A revised policy does not authorize unrelated new uses of existing information without any permission required by law or Discord.