Privacy policy

1. What we collect

• Fluxer account: user ID, username, display name and avatar. The dashboard requests only the identify and guilds scopes. It does not request the email scope, so this deployment does not receive your email address.
• Guilds you manage: guild ID, name, icon, cached channel and role lists, your permission mask in that guild, and whether the bot is installed.
• Login and session data: a SHA-256 hash of the session token (the raw token stays in your browser cookie), OAuth access and refresh tokens encrypted with AES-256-GCM, the IP address and user agent seen at sign-in, and session timestamps.
• Configuration and audit data: module settings, prefix, per-command overrides, level rewards, role mappings, and audit entries recording who changed what, including before/after values.
• Engagement data: XP totals, level, message counts and leaderboard position. Message text is not stored by the levels module.
• Product analytics: command name, guild, user ID and timestamp. The dashboard displays the last seven days of these events.

The current modules do not store message content. Future logging or automod features will be opt-in per guild and will document their retention before release.

2. Cookies

• fluxbot_session keeps you signed in. It is HttpOnly, SameSite=Lax, marked Secure on HTTPS deployments, and lasts up to 30 days.
• fluxbot_oauth holds the short-lived login state and PKCE verifier. It expires after 10 minutes.

There are no advertising cookies and no third-party analytics scripts on the dashboard.

3. Why we process it

• To authenticate you and decide which guilds you may configure.
• To run the modules and commands you enable.
• To keep an audit trail of administrative changes.
• To secure the service, diagnose failures and understand feature usage.

We do not sell personal data, build advertising profiles, or share data with data brokers.

4. Where it is stored and for how long

• Data is stored in a PostgreSQL database on the operator's infrastructure, encrypted in transit with TLS where the deployment is correctly configured.
• Sessions expire after 30 days; expired sessions are pruned automatically.
• Command analytics are shown for seven days and may be retained until the operator prunes them.
• Configuration, audit entries and XP data remain until a guild admin or the operator deletes them.
• Backups may retain copies for a limited period after deletion. Keep the encryption key separate from database dumps; without it, stored OAuth tokens cannot be decrypted.

5. When data leaves this deployment

• The Fluxer instance you sign in on receives the API calls needed to authenticate you and read your guilds.
• If the deployment is behind Cloudflare or a similar proxy, that provider processes traffic to terminate TLS and forward requests.
• If a Discord bridge is enabled in the future, messages in linked channels will be sent to the other platform. Bridges are opt-in and disabled by default.

6. Your choices

Depending on where you live, you may have the right to access, correct, delete, export or object to the processing of your personal data. Contact hello@steamworks.cafe to make a request. We may need to verify that you control the Fluxer account in question.

Guild configuration is controlled by that guild's administrators. Removing the bot from a guild does not automatically delete its stored configuration; ask the operator if you want it removed. Some data may be retained where the law requires it or in backups for a limited period.

7. Security

The dashboard uses least-privilege OAuth scopes, encrypts OAuth tokens at rest, stores only hashes of session tokens, re-checks Fluxer permissions on every request, and records administrative changes in an audit log. No system is perfectly secure; report suspected issues through hello@steamworks.cafe.

8. Children

Fluxbot is not directed at children under 13, or under the minimum age required to use Fluxer in your jurisdiction, whichever is higher.

9. Changes

This policy may be updated as Fluxbot changes. The date at the top of the page always reflects the current version. Material changes will be announced in the dashboard or the project repository.

10. Contact

This deployment is operated by the operator named above. For privacy questions or deletion requests, use hello@steamworks.cafe.