BotPrivacyPolicy

GorBot

Privacy Policy

Effective Date: August 17, 2026
Last Updated: August 17, 2026

This Privacy Policy explains how GorBot collects, uses, stores, shares, protects, and deletes information when you use the GorBot Discord application, web dashboard, roleplay systems, server-management features, websites, integrations, and related services.

Privacy Summary: GorBot processes information needed to provide its Discord, roleplay, moderation, security, web-dashboard, subscription-entitlement, and integration features. GorBot does not sell Discord API data or personal information to data brokers and does not use Discord API data for unrelated targeted advertising. GorBot is not designed to collect passwords, full payment-card numbers, government identification numbers, medical records, or other highly sensitive information from ordinary users.

Privacy & Data Rights Contact: privacy@gorbot.onlyotaku.com
Security Contact: security@gorbot.onlyotaku.com
General Contact: contactus@gorbot.onlyotaku.com

1. Scope of This Policy

This Privacy Policy applies to GorBot, the GorBot web dashboard, and the related informational MediaWiki website operated by the GorBot Operator at https://gor.onlyotaku.com/.

This includes, where applicable:

• The GorBot Discord application.
• Discord slash commands and configurable message-command features.
• Character profiles and public character presentation.
• Webhook-based character speech.
• Personal Notes.
• NPC creation and management.
• Shared or global NPC features.
• Conversation memory and adaptive roleplay systems.
• Server Discovery and other opt-in public listings.
• Embeds, reaction roles, custom commands, timed messages, tickets, welcome tools, and automations.
• Moderation, audit, anti-abuse, security, and administrative features.
• Discord OAuth sign-in.
• The GorBot web dashboard.
• The informational Gor Wiki / MediaWiki website hosted at https://gor.onlyotaku.com/.
• Free and Premium plan entitlements.
• Billing and subscription metadata when customer billing is enabled.
• Optional third-party artificial-intelligence features.
• Optional game-server, GameBridge, NPC, item, equipment, or other integrations.
• Backups, failover, synchronization, and operational infrastructure used to provide GorBot.

This Policy applies to information processed by GorBot and the Operator. Discord and other third-party services have their own privacy policies and act under their own terms when they independently process information.

Use of GorBot is also governed by the GorBot Terms of Service.

2. Who Operates GorBot

For purposes of this Policy, the “Operator” means the person or legal entity responsible for operating GorBot.

The Operator is based in Utah, United States.

Until a separate business entity is formally identified in an updated version of this Policy, official privacy and legal communications should use the role-based contacts listed in this Policy rather than relying on an individual’s personal contact information.

Official contacts include:

• Privacy & Data Rights: privacy@gorbot.onlyotaku.com
• Legal Notices: legal@gorbot.onlyotaku.com
• Security Vulnerabilities: security@gorbot.onlyotaku.com
• Abuse / Safety: abuse@gorbot.onlyotaku.com
• Billing: billing@gorbot.onlyotaku.com
• Support: support@gorbot.onlyotaku.com
• General Contact: contactus@gorbot.onlyotaku.com

3. Information GorBot May Collect

The information GorBot processes depends on which features you use, which features a Server has enabled, and whether you use Discord, the web dashboard, or an integration.

3.1 Discord Account Information

GorBot may receive or store information available through Discord or supplied during Discord OAuth authentication, including:

• Discord user ID.
• Discord username.
• Global display name.
• Discord avatar reference.
• Server nickname.
• Locale or language information where available and relevant.
• Whether the account represents a bot or application.
• Information needed to associate a GorBot account with the correct Discord account.

GorBot does not need your Discord password.

Do not provide your Discord password, account token, recovery code, or other Discord credentials to GorBot staff or through GorBot features.

3.2 Discord Server, Channel, Role, and Permission Information

GorBot may process:

• Discord Guild/Server IDs.
• Server names and icons.
• Channel IDs and channel metadata.
• Thread or forum-post IDs.
• Role IDs and role metadata.
• Discord permission values.
• Server ownership information.
• Membership information needed to determine whether you belong to a Server.
• Information needed to determine whether you may manage a Server or use a protected feature.
• Message IDs and webhook identifiers where needed for tracked messages or roleplay features.

Numeric Discord identifiers are commonly used so information can be associated with the correct user, Server, channel, role, message, profile, NPC, or configuration record.

3.3 Commands, Messages, and Discord Content

GorBot may process message content when it is relevant to an enabled feature.

Examples include:

• Slash-command inputs.
• Message-command text.
• Messages that begin with a configured GorBot prefix.
• Direct mentions or interactions with GorBot.
• Character dialogue.
• NPC dialogue and interactions.
• Messages in configured roleplay or automation contexts.
• Biography, profile, lore, journal, relationship, contract, marketplace, or similar roleplay content.
• Messages involved in moderation, security, ticketing, anti-abuse, or diagnostic workflows.
• Messages needed to maintain configured conversation or NPC memory.
• Content required to execute an automation or scheduled workflow.

GorBot is not designed to permanently store every message in every Discord channel merely because the Bot can technically receive an event.

Message content should be processed only when reasonably relevant to an enabled GorBot function, security requirement, moderation action, or operational need.

3.4 Character and Roleplay Profile Information

Character records may include:

• Character ID and owner Discord ID.
• Character name.
• Biography and descriptive fields.
• Avatar or image references.
• Profile style or template.
• Custom profile fields.
• Gender or pronouns.
• Fictional social role or status.
• Caste, profession, culture, city, homeland, affiliation, or similar setting information.
• Fictional ownership, relationship, or roleplay-status information.
• Speech style and preferred forms of address.
• Lore and background.
• Privacy and visibility selections.
• Active-character selection.
• Creation and modification timestamps.

GorBot supports extensive customizable roleplay profiles. Users should remember that free-text or custom fields can contain whatever information the User chooses to submit.

Do not place private real-world information in fields intended for public roleplay presentation.

3.5 NPC, Memory, Relationship, and Adaptive Roleplay Data

NPC or adaptive-roleplay features may store or derive:

• NPC names and identifiers.
• NPC descriptions and portraits.
• NPC owners or publishers.
• NPC personality settings.
• Mood or disposition.
• Relationship state.
• Forms of address.
• Fictional social roles.
• Gossip, knowledge, memories, or learned associations.
• Recent roleplay topics.
• Character-to-NPC or User-to-NPC relationship information.
• Adaptive-learning state used to maintain continuity.
• Timestamps and metadata associated with updates.

These records are roleplay state. They are not intended to represent factual psychological, medical, employment, credit, insurance, housing, or other real-world assessments of a person.

3.6 Personal Notes

GorBot may allow a User to maintain Personal Notes or similar private-to-account roleplay information.

Personal Notes are intended for roleplay organization and convenience.

They are not designed as:

• A password manager.
• An encrypted personal vault.
• A medical-record system.
• A financial-record system.
• A legal-record repository.
• Storage for government identification information.
• Storage for API keys, tokens, private keys, recovery codes, or credentials.

Personal Notes are restricted in normal application presentation, but they are not represented as end-to-end encrypted from the Operator. Authorized access may occur when reasonably necessary for technical support, security, legal compliance, abuse investigation, recovery, or maintenance.

3.7 Published, Shared, and Cross-Server Content

Some GorBot features allow Users or Server Owners to intentionally publish information outside a single private Server.

This may include:

• Global/shared NPC entries.
• NPC portraits.
• NPC information offered for cloning.
• Server Discovery profiles.
• Server names and descriptions.
• Server invite links.
• Server images or external gallery links.
• Activity or listing-bump information.
• Other content clearly marked as public, shared, discoverable, global, published, or cross-server.

Published Content should be treated as information that other GorBot users may view.

Where a feature allows an NPC or similar object to be cloned, a clone may become an independent record owned or managed by the receiving User or Server. Removing or unpublishing the original may not automatically delete copies that were legitimately created before removal.

3.8 Server Configuration and Automation Data

GorBot may store Server-specific settings such as:

• Command-prefix configuration.
• Enabled or disabled features.
• Role and channel selections.
• Welcome and goodbye settings.
• Reaction-role configuration.
• Embed templates.
• Custom commands.
• Timed-message configuration.
• Ticket-panel configuration.
• Automations, triggers, actions, and conditions.
• Moderation and security settings.
• Bot presentation settings.
• Configuration backups.
• Feature limits and entitlement state.

Some configuration may contain text or identifiers supplied by Server administrators.

3.9 Moderation, Audit, and Security Information

GorBot may process or retain information needed for moderation, reliability, fraud prevention, and security, including:

• Warnings and moderation actions.
• Moderator or administrator actions.
• Role changes or protected administrative actions.
• Dashboard audit events.
• Action target identifiers.
• Success or failure state.
• Login attempts.
• IP addresses associated with login or dashboard-security events.
• Rate-limit events.
• Abuse or security findings.
• Automation execution records.
• Error and diagnostic information.
• Relevant message, user, channel, Guild, role, or case identifiers.
• Security-incident records.
• Subscription or entitlement changes.
• Webhook/provider event identifiers.
• Backup or restoration activity.

Security records may be retained longer than ordinary activity records when reasonably necessary to investigate abuse, fraud, attacks, account compromise, legal claims, or repeated policy violations.

3.10 Web Dashboard and Browser Information

When you use a GorBot website or dashboard, GorBot or its hosting providers may process:

• IP address.
• Request date and time.
• Requested page or route.
• Browser or User-Agent information.
• Session identifier.
• Discord OAuth state.
• CSRF/security tokens.
• Authentication state.
• Selected Server/Guild context.
• Error and diagnostic information.
• Referrer or ordinary web-server request information where provided.
• Feedback information you voluntarily submit.

GorBot uses browser-session technologies necessary for authenticated dashboard operation and security.

GorBot is not designed to use Discord API data to build advertising profiles.

3.11 Discord OAuth Information

The web dashboard may use Discord OAuth to identify you and determine which Servers you belong to or can manage.

Depending on the authorized scopes, GorBot may obtain:

• Your Discord identity.
• Your Discord ID and profile information.
• Your Server/Guild list.
• Server ownership and permission information.
• OAuth access and refresh-token information needed to maintain authorized dashboard functionality.

Sensitive OAuth token values are administrative authentication data and are not intended to be displayed to ordinary users.

GorBot may use encrypted or protected storage for OAuth tokens where needed for the Service.

GorBot should request only OAuth scopes reasonably required for the feature being provided.

3.12 Billing, Subscription, and Entitlement Information

When customer billing is enabled, GorBot may process limited billing-related metadata, such as:

• GorBot user/account ID.
• Discord user ID.
• Discord Guild/Server ID receiving Premium.
• Plan or product.
• Price and currency.
• Subscription status.
• Subscription start date.
• Renewal date.
• End or cancellation date.
• Whether cancellation is scheduled for the end of a billing period.
• Payment-provider name.
• Provider customer, order, invoice, checkout, or subscription identifiers.
• Provider event identifiers.
• Refund, dispute, failure, or charge-status metadata.
• Premium entitlement and feature-limit records.

GorBot is not designed to store full payment-card numbers, CVV/security codes, or online-banking credentials.

Those payment details should be collected and processed by the applicable payment provider or Discord payment system.

Customer Premium checkout may not yet be available when this Policy is published. This section describes the data practices intended to apply when billing is activated.

3.13 Support, Contact, and Feedback Information

If you contact GorBot by email, support ticket, feedback form, or another official support channel, GorBot may retain:

• Your email address if you send an email.
• Your Discord ID or username if provided.
• The Server involved.
• The feature or page involved.
• Browser information included in feedback.
• Screenshots or attachments you voluntarily submit.
• Error references.
• Your support message.
• Staff notes and resolution information.

Do not send passwords, tokens, full payment-card information, private keys, recovery codes, or other highly sensitive credentials in support requests.

3.14 GameBridge and Other Integrations

Where a GorBot feature is connected to a game server or another authorized integration, GorBot may process identifiers and roleplay information needed to perform that integration.

This may include:

• Game-side character or NPC identifiers.
• Discord-to-game linkage information.
• NPC or roleplay state.
• Commands or events sent through the integration.
• Operational status or error information.

The exact information depends on the integration and whether the feature has been enabled.

4. Gor Wiki / MediaWiki Website

The informational Gor Wiki is hosted at https://gor.onlyotaku.com/ and uses MediaWiki software.

The Wiki is presently intended to be publicly readable. Public account registration, public posting, public comments, and public editing are not offered as ordinary Wiki features. Authorized administrative or editor accounts may exist for maintenance and publication.

A visitor does not need to submit a character profile, Discord message, Personal Note, payment method, or other GorBot application content merely to read an ordinary public Wiki article.

However, visiting the Wiki can still cause ordinary website and security information to be processed.

4.1 Ordinary Web Requests

When a visitor requests a Wiki page, the Wiki, web server, hosting provider, security layer, or related infrastructure may process information such as:

• IP address.
• Date and time of the request.
• Requested URL or Wiki page.
• HTTP method and response status.
• Browser / User-Agent information.
• Referrer information where supplied by the browser.
• Network, security, error, or diagnostic information.
• Cookies or session identifiers where technically applicable.
• Information needed to detect abuse, attacks, excessive traffic, or malfunction.

This information may appear in ordinary web-server, application, security, or diagnostic logs.

4.2 MediaWiki Sessions and Cookies

MediaWiki supports session management and may use cookies or equivalent session mechanisms for functionality such as authentication, maintaining a session, preferences, or security.

Because the Wiki does not presently offer ordinary public account registration or editing, most public visitors are expected to use the Wiki primarily as anonymous readers. Administrative or authorized editor sessions may use additional authentication/session functionality.

The Operator does not intend to use Wiki session cookies to build cross-site advertising profiles.

If the Wiki later adds non-essential analytics, advertising, tracking pixels, third-party marketing cookies, or similar technologies, this Privacy Policy and any legally required consent mechanism should be updated before or when those technologies are deployed.

4.3 MediaWiki Administrative and Action Logs

MediaWiki can maintain logs relating to administrative or content-management actions, such as page creation, deletion, restoration, movement, protection, account actions, or other supported events.

Because public editing is disabled, these logs ordinarily concern authorized editors, administrators, maintenance activity, or attempted abuse rather than ordinary public contributions.

Where a log contains an account identifier, username, IP address, timestamp, affected page, or similar information, it may be retained as reasonably necessary for Wiki administration, security, accountability, debugging, or legal compliance.

4.4 Wiki Search and Navigation

If a visitor uses a Wiki search function, the requested search term and resulting request may be processed by MediaWiki and ordinary server infrastructure to return results and diagnose problems.

The Operator does not intend to use ordinary Wiki searches to construct advertising profiles about visitors.

4.5 External Links and Embedded Resources

Wiki pages may link to third-party websites, images, videos, documents, or other resources.

When you follow an external link or load a resource hosted by another provider, that third party may independently receive information from your browser and apply its own privacy policy.

The Operator does not control a third party’s independent data practices.

Where practical, the Operator should avoid embedding unnecessary third-party tracking technology into informational Wiki pages.

4.6 No Public Wiki Contributions

Because ordinary visitors cannot publicly post or edit Wiki content, GorBot does not presently use the Wiki to solicit public encyclopedia contributions, public comments, or public discussion posts.

If public account creation, editing, comments, uploads, forums, or other contribution features are enabled in the future, the Operator should update this Privacy Policy before or when those features become available to describe the additional information collected and the visibility of contributions, account names, IP addresses, revision history, or logs.

5. Information GorBot Does Not Intentionally Seek from Ordinary Users

GorBot is not designed to intentionally collect the following from ordinary Users:

• Discord passwords.
• Discord account tokens.
• Full payment-card numbers.
• Card verification codes.
• Online-banking passwords.
• Social Security numbers.
• Passport or driver-license numbers.
• Government identification numbers.
• Medical or health records.
• Protected health information.
• Biometric identifiers.
• Private cryptographic keys.
• API keys or Bot tokens.
• Authentication recovery codes.
• Precise real-world GPS location.
• Advertising profiles for sale to advertisers or data brokers.

Do not submit this information through GorBot.

If you accidentally submit highly sensitive information, contact privacy@gorbot.onlyotaku.com promptly and identify where the information was submitted so the Operator can evaluate appropriate removal.

6. How GorBot Uses Information

GorBot may use information to:

• Authenticate Users.
• Link a dashboard account to a Discord identity.
• Determine Server membership and permissions.
• Operate Discord commands.
• Create and manage character profiles.
• Create and manage NPCs.
• Provide webhook roleplay.
• Maintain roleplay continuity and memory.
• Provide Personal Notes.
• Publish User-directed Server Discovery or shared NPC content.
• Execute automations and scheduled operations.
• Manage embeds, reaction roles, tickets, roles, and Server configuration.
• Perform moderation and security functions.
• Detect abuse, fraud, spam, or attacks.
• Enforce rate limits and permission checks.
• Investigate technical failures.
• Provide customer support.
• Operate Free/Premium feature limits.
• Maintain subscription entitlements.
• Reconcile verified billing events when billing is enabled.
• Maintain backups and disaster recovery.
• Perform failover and distributed processing.
• Improve reliability and fix defects.
• Operate and secure the informational Wiki.
• Deliver requested Wiki pages and search results.
• Diagnose Wiki errors and maintain administrative/action logs.
• Comply with legal requirements.
• Protect GorBot, Users, Discord, Servers, Wiki visitors, infrastructure, and third parties.

GorBot does not intentionally use Discord API data for unrelated advertising, data-broker products, or eligibility decisions involving employment, housing, credit, insurance, or similar real-world benefits.

7. Legal and Operational Bases for Processing

Depending on the jurisdiction and the feature involved, GorBot may process information because:

• Processing is necessary to provide a Service or feature requested by the User.
• Processing is necessary to perform or administer the Terms of Service.
• A User or authorized Server administrator has chosen to enable or use a feature.
• The Operator has a legitimate interest in operating, securing, debugging, maintaining, and protecting the Service.
• Processing is needed to prevent fraud, abuse, or security incidents.
• Processing is needed to enforce Server or GorBot rules.
• Processing is needed to maintain records of a paid subscription or transaction.
• Processing is required to comply with law or a valid legal process.
• Consent has been provided where consent is the appropriate or legally required basis.

Where applicable law gives you a right to withdraw consent for optional processing, withdrawal does not invalidate processing lawfully performed before withdrawal and may prevent the affected feature from continuing to operate.

8. Discord API Data

GorBot receives some information through Discord’s APIs.

GorBot intends to use Discord API Data only as reasonably necessary to provide, secure, maintain, or support GorBot functionality permitted by Discord.

GorBot does not intentionally:

• Sell Discord API Data.
• Rent Discord API Data.
• License Discord API Data to data brokers.
• Disclose Discord API Data to advertising networks.
• Use Discord API Data for unrelated targeted advertising.
• Mine or scrape Discord for unrelated datasets.
• Use Discord API Data for employment, housing, insurance, credit, or similar eligibility decisions.
• Use Discord message content obtained through Discord APIs to train GorBot’s own machine-learning or large-language models.

Discord may require GorBot to update or delete Discord API Data when it is no longer necessary for GorBot functionality, when the applicable User requests deletion, when Discord requests deletion, when GorBot stops operating, or when applicable law requires deletion.

GorBot will handle Discord API Data subject to Discord’s applicable developer requirements.

For information about Discord’s own data practices, review:

• Discord Privacy Policy
• Discord Terms of Service

9. Dashboard Sessions, Cookies, and Security Tokens

The GorBot dashboard uses technical session mechanisms needed for authentication and security.

These may include:

• A session cookie.
• Discord OAuth state.
• CSRF tokens.
• Authentication-state values.
• Selected Guild/Server context.
• Short-lived cached authorization or directory information needed to reduce unnecessary repeated requests.

Session cookies are intended to support the Service rather than behavioral advertising.

Where supported by the application and browser, session cookies may use protections such as:

• Secure transport.
• HTTP-only access.
• SameSite restrictions.
• Session regeneration after login.
• Server-side session validation.

Logging out ends the active GorBot dashboard session, although security, audit, OAuth, or account records stored separately from the browser session may remain according to this Policy.

10. Webhook Character Speech

When a User sends character dialogue through a supported roleplay command, GorBot may:

1. Identify the User’s selected character.
2. Read the character’s display name and avatar.
3. Use a Discord webhook.
4. Post the User-supplied dialogue under the fictional character identity.
5. Delete the original command message after successful replacement where the feature is configured to do so.
6. Record operational information needed for security, debugging, or continuity.

The visible webhook identity may differ from the Discord User’s visible account identity.

GorBot still associates the character internally with its owner where needed for ownership, moderation, security, or account management.

Authorized Server administrators or GorBot staff may be able to determine which account controls a character where necessary.

11. Public Profiles, Server Discovery, and Shared NPCs

Some information becomes public or shared only because a User or Server administrator intentionally enables a publishing feature.

Examples include:

• Public character profiles.
• Character names or avatars used for roleplay speech.
• Shared NPCs.
• Global NPC database entries.
• Server Discovery listings.
• Server descriptions.
• Invite links.
• Public gallery or image links.
• Public roleplay fields.

Users should review privacy/visibility controls before publishing content.

Do not publish:

• A real-world home address.
• Private phone numbers.
• Private email addresses.
• Financial information.
• Medical information.
• Credentials.
• Information about another person that you are not authorized to publish.

The Operator may remove Published Content that violates law, Discord policy, the Terms of Service, privacy rights, intellectual-property rights, or Service rules.

12. Optional Third-Party Artificial Intelligence

Some GorBot features may optionally connect to a third-party artificial-intelligence provider.

Third-party AI processing should be disabled unless an authorized configuration enables it.

When enabled, information sent for a requested AI-assisted function may include:

• The User’s current message.
• Recent conversation context.
• Character or NPC name.
• Biography or roleplay profile information.
• Personality traits.
• Fictional relationship state.
• Relevant memories.
• Gossip or knowledge.
• Other minimum context reasonably needed to generate the requested response.

GorBot does not use Discord message content obtained through the Discord API to train GorBot’s own machine-learning models.

Third-party AI providers process submitted information under their own terms, privacy policies, security practices, retention rules, and service configurations.

The Operator should use data-minimizing provider configurations where reasonably available and should avoid sending credentials or unnecessary highly sensitive information.

Users should not submit confidential, medical, financial, government-identification, authentication, or other highly sensitive information to AI-enabled roleplay features.

13. Payments and Payment Providers

When Premium billing is enabled, checkout may be provided by Discord or an authorized third-party payment provider.

The payment provider may independently collect:

• Name.
• Billing email.
• Billing address.
• Payment method details.
• Tax information.
• Fraud-prevention signals.
• Invoice and receipt information.
• Charge, refund, dispute, and subscription information.

GorBot should receive only the information reasonably needed to confirm and administer the purchase, such as provider identifiers, transaction/subscription status, billing-period dates, plan information, and the Discord Server that receives the entitlement.

GorBot does not intentionally store full card numbers or card verification codes.

Billing records may be retained after cancellation where reasonably required for:

• Accounting.
• Tax compliance.
• Fraud prevention.
• Chargebacks or disputes.
• Refund administration.
• Provider reconciliation.
• Legal obligations.
• Establishing or defending legal claims.

Billing questions may be sent to billing@gorbot.onlyotaku.com.

14. Storage and Distributed Processing

GorBot uses shared persistent storage and distributed runtime systems to provide reliable service.

Information may be stored or processed using:

• SQL/database storage.
• Application storage.
• Configuration storage.
• Local runtime caches.
• Image or avatar storage/caches.
• Logs.
• Backups and recovery snapshots.
• Multiple GorBot processing nodes.
• Hosting, infrastructure, or database service providers.
• MediaWiki application/database storage and administrative logs.

GorBot’s managed architecture may allow more than one runtime node to process the same authoritative shared Service state so another healthy node can continue operating when one node is unavailable.

A runtime node may therefore temporarily receive or cache information needed to process a command, deliver a Discord interaction, perform a health check, or provide an authorized dashboard request.

Distributed processing does not change the ownership or privacy classification of the underlying User information.

15. Backups and Recovery Copies

GorBot may make backups, snapshots, or configuration copies for:

• Disaster recovery.
• Rollback.
• Service continuity.
• Failed-update recovery.
• Database recovery.
• Security incident response.

Backups are rotated under operational retention schedules.

Deleting information from the active database may not immediately remove every copy from an existing backup.

Where practical, deleted information will disappear from backups as those backups expire or are overwritten in the ordinary retention cycle, unless a backup must be preserved for security, fraud, legal, or recovery reasons.

Backups are not intended to be used to restore a User’s deleted personal information merely to circumvent a valid deletion request.

16. Data Security

GorBot uses technical and administrative safeguards intended to reduce the risk of unauthorized access, disclosure, alteration, or destruction.

Depending on the component, safeguards may include:

• HTTPS/TLS for web traffic.
• Discord OAuth rather than collecting Discord passwords.
• Encrypted or protected storage for OAuth and other sensitive tokens.
• Restricted administrative access.
• Permission and role checks.
• CSRF protections.
• OAuth state validation.
• Secure/HTTP-only session cookies where supported.
• Session regeneration.
• Secret redaction.
• Separation of public and private infrastructure.
• Authenticated service-to-service communication.
• Restricted management interfaces.
• Input and file validation.
• Rate limiting.
• Login-attempt monitoring.
• Audit and security logging.
• Backups and rollback.
• Redundant processing and failover.

No Internet service or storage system can guarantee absolute security.

If you discover a potential vulnerability, report it privately to security@gorbot.onlyotaku.com and do not publicly disclose credentials, private User information, or exploit details.

17. When Information May Be Shared

GorBot may share or make information available only when reasonably necessary for the Service or another lawful purpose described in this Policy.

Recipients may include:

• Discord — to deliver Discord interactions, messages, webhooks, roles, moderation actions, and other requested Discord functionality.
• Hosting and infrastructure providers — to host the web application, database, files, backups, or runtime services.
• Authorized GorBot processing nodes — to process Discord events and dashboard requests as part of the distributed Service.
• Payment providers — when a User initiates or manages a Premium purchase.
• Artificial-intelligence providers — only when an enabled feature requires third-party AI processing.
• Image or content-hosting services — when a User supplies or links externally hosted content.
• Authorized Server administrators — where their role gives them access to Server-owned configuration, moderation data, or information necessary to administer their Server.
• Professional advisers or service providers — where reasonably necessary for legal, accounting, security, or technical assistance and subject to appropriate duties.
• Law enforcement, courts, regulators, or government authorities — when disclosure is legally required or otherwise permitted for a valid legal or safety purpose.
• A successor operator — if operation of GorBot is lawfully reorganized, transferred, merged, or sold, subject to applicable privacy obligations.

GorBot does not disclose Discord API Data to advertising networks or data brokers.

18. No Sale of Personal Information and No Targeted Advertising Use

GorBot does not intentionally:

• Sell personal information.
• Sell Discord API Data.
• Rent personal information to data brokers.
• Share Discord API Data with advertising networks.
• Build advertising profiles from Discord API Data.
• Use Discord API Data for cross-context behavioral advertising.

If GorBot’s business model changes in a way that materially changes these practices, this Privacy Policy must be updated before that new processing is implemented where required.

Premium subscription fees are payment for GorBot features and capacity; they are not payment for the sale of User data.

The same no-sale principle applies to ordinary Wiki visitor information collected through routine web requests.

19. Data Retention

GorBot retains information only for as long as reasonably needed for the purposes described in this Policy, subject to technical, operational, security, legal, and Discord requirements.

Different categories may have different retention periods.

19.1 Account and OAuth Data

Account-linkage information may be retained while the GorBot account remains active or while needed to provide requested dashboard functions.

OAuth access information may be replaced, expire, be revoked, or be deleted when no longer needed.

Guild/Server-access information may be refreshed when you authenticate with Discord so stale access can be removed.

19.2 Character, NPC, Profile, and Personal Notes Data

Persistent roleplay records may remain stored until:

• The User deletes them using an available feature.
• An authorized Server administrator deletes Server-owned content where permitted.
• The User makes a valid deletion request.
• The Server is removed and applicable cleanup rules delete or archive the data.
• The Operator removes the information under the Terms.
• Retention is no longer necessary for the feature.

Published or cloned content may require separate deletion from each independent record.

19.3 Audit and Operational Logs

Routine audit and operational records may be automatically trimmed according to configured retention limits.

Current GorBot plan design may provide different audit/history retention or capacity for Free and Premium Servers. The current Plans & Features page describes applicable plan limits:

GorBot Plans & Features

Security, abuse, fraud, legal, or incident records may be retained longer when reasonably necessary even if routine audit records would otherwise expire.

19.4 Login and Security Records

Login-attempt information, IP addresses, authentication failures, and security events may be retained for a reasonable period needed to:

• Detect repeated attacks.
• Enforce rate limits.
• Investigate compromise.
• Prevent abuse.
• Establish or defend legal claims.
• Comply with law.

19.5 Billing Records

Billing and subscription metadata may be retained after a subscription ends when reasonably required for accounting, taxes, fraud prevention, disputes, provider reconciliation, refunds, legal obligations, or claims.

19.6 Support and Feedback

Support requests and feedback may be retained while the request is active and afterward for a reasonable period needed to maintain support history, prevent abuse, diagnose recurring issues, or establish what action was taken.

19.7 Backups

Deleted information may remain temporarily in rotating backups until the applicable backup expires or is overwritten.

19.8 Wiki Access, Security, and Administrative Logs

Ordinary Wiki access, error, security, and administrative logs may be retained for a reasonable operational period needed to operate the site, investigate abuse, detect attacks, diagnose failures, maintain administrative accountability, or comply with law.

The Operator may retain specific security or legal records longer when reasonably necessary for an incident, abuse investigation, legal hold, or claim.

20. Removal of GorBot from a Discord Server

Removing GorBot from a Server stops GorBot from receiving new Server events through the ordinary installed-app relationship.

Removal does not necessarily delete all existing information immediately.

Existing records may include:

• Server configuration.
• Character information.
• NPC information.
• Published or shared content.
• Personal account information.
• Moderation records.
• Audit logs.
• Security records.
• Subscription records.
• Backups.
• Support records.

A Server Owner may contact privacy@gorbot.onlyotaku.com about deletion of Server-associated information.

GorBot may automatically delete, archive, anonymize, or restrict information associated with inactive or removed Servers according to operational retention practices.

21. Your Privacy Rights

Depending on where you live and which laws apply, you may have rights concerning personal information about you.

These may include the right to:

• Ask whether GorBot processes information about you.
• Request access to certain information.
• Request correction of inaccurate information.
• Request deletion.
• Request a portable copy of certain information you provided.
• Object to or restrict certain processing where applicable.
• Withdraw consent for optional processing where consent is the basis.
• Opt out of certain sale or targeted-advertising processing where applicable.
• Appeal a denied privacy request where applicable law provides that right.
• File a complaint with an appropriate privacy regulator.

Not every right applies in every jurisdiction or to every category of information.

GorBot does not currently sell personal information or use Discord API Data for targeted advertising, so an opt-out from those practices ordinarily should not be necessary while this Policy remains accurate.

22. How to Make a Privacy Request

Send privacy requests to:

Privacy & Data Rights: privacy@gorbot.onlyotaku.com

To help locate the correct records, include only the information reasonably necessary for the request, such as:

• Your Discord user ID.
• Your Discord username.
• The affected Server/Guild ID or Server name.
• The affected character or NPC name/ID if relevant.
• The type of request: access, correction, deletion, portability, objection, or another privacy right.
• Enough detail to identify the information involved.

Do not send a Discord password, Discord token, payment-card number, private key, or recovery code.

The Operator may need to verify that the requester controls the relevant Discord account or is otherwise authorized to make the request before disclosing or deleting information.

Verification may be performed through:

• A logged-in GorBot dashboard session.
• An interaction from the relevant Discord account.
• An official support workflow.
• Other reasonable verification appropriate to the sensitivity of the request.

GorBot will respond within the period required by applicable law. Requests involving Discord API Data will also be handled subject to applicable Discord deletion and retention requirements.

23. Limits on Deletion Requests

A deletion request may not require GorBot to immediately delete every record where retention is lawfully or reasonably necessary for:

• Security.
• Fraud prevention.
• Abuse investigation.
• Moderation records.
• Accounting or tax obligations.
• Payment disputes or chargebacks.
• Compliance with law.
• A valid legal hold.
• Establishing, exercising, or defending legal claims.
• Protecting other Users or the Service.
• Temporary backup retention.
• Preventing a banned or abusive actor from immediately evading enforcement.
• Preserving records that cannot reasonably be separated from another User’s lawful record.

When information must be retained for one of these reasons, GorBot should limit further use to the reason supporting retention where reasonably possible.

Deletion of a User’s source record may not delete independent content lawfully created by another User, such as an NPC clone, quoted material, moderation record, or Discord message controlled by Discord or another User.

24. Account Closure

A User may stop using GorBot at any time.

Closing or ceasing use of GorBot does not automatically erase every record.

A User seeking deletion should submit a privacy request when deletion is not available directly through a supported feature.

Account closure may result in some information being:

• Deleted.
• Anonymized.
• Disassociated.
• Archived.
• Retained for the limited purposes described in this Policy.

25. Children and Underage Users

GorBot is intended for adult communities and is governed by an adult-use requirement in the Terms of Service.

GorBot is not directed to children.

The Operator does not knowingly intend to collect personal information through GorBot from persons who do not meet the Service’s age requirements.

If the Operator learns that an underage person is using GorBot contrary to the Terms, the Operator may:

• Suspend or terminate access.
• Remove or restrict content.
• Delete information where appropriate and reasonably possible.
• Take other action needed to comply with Discord requirements or law.

A parent or guardian who reasonably believes GorBot has improperly collected information from a child may contact privacy@gorbot.onlyotaku.com.

26. International Processing

GorBot is operated from the United States.

Discord, hosting providers, payment providers, AI providers, infrastructure providers, or other service providers may process information in other states or countries.

Those locations may have privacy laws different from the laws where you live.

Where applicable law requires safeguards for an international transfer, the Operator or applicable service provider should use a legally recognized transfer mechanism or other required safeguard.

27. Server Owner and Administrator Responsibilities

Server Owners and administrators who configure GorBot should:

• Use only the Discord permissions needed for desired features.
• Enable only features appropriate for their community.
• Review public/private visibility settings.
• Avoid placing sensitive personal information into roleplay, gossip, memory, automation, moderation, or custom fields.
• Protect access to Server-management functions.
• Limit staff access appropriately.
• Review automations before enabling them.
• Inform members of Server-specific processing where the Server itself has a legal obligation to do so.
• Use moderation and security records responsibly.
• Respect User privacy rights.
• Remove GorBot if they no longer accept the Service’s data practices.

A Server Owner’s independent collection or use of information outside GorBot is governed by that Server Owner’s own responsibilities and is not automatically controlled by this Policy.

28. Security Incidents and Data Breaches

If the Operator becomes aware of unauthorized access, disclosure, loss, or misuse that may materially affect protected User information, the Operator may take steps such as:

• Investigating the incident.
• Containing unauthorized access.
• Resetting or revoking affected credentials.
• Repairing affected systems.
• Preserving necessary evidence.
• Reviewing logs and backups.
• Notifying affected Users where required by law or reasonably appropriate.
• Notifying Discord where required by Discord’s developer requirements.
• Notifying regulators or authorities where legally required.

Potential vulnerabilities should be reported privately to:

security@gorbot.onlyotaku.com

Abuse or safety reports may be sent to:

abuse@gorbot.onlyotaku.com

29. Legal Requests and Required Disclosure

The Operator may preserve or disclose information when reasonably believed necessary to:

• Comply with applicable law.
• Respond to valid legal process.
• Protect the rights, property, or safety of GorBot, the Operator, Users, Discord, or others.
• Investigate fraud, abuse, attacks, or violations.
• Establish, exercise, or defend legal claims.

The Operator may challenge, narrow, or reject a request that appears invalid, overbroad, or unlawful where legally permitted.

Legal notices should be sent to:

legal@gorbot.onlyotaku.com

30. Automated Systems and Significant Decisions

GorBot may use automated systems for:

• Roleplay responses.
• NPC behavior.
• Spam or abuse detection.
• Security checks.
• Rate limits.
• Feature entitlements.
• Server automations.
• Moderation workflows configured by Server administrators.

GorBot does not intend to use Discord API Data to make automated decisions about a person’s eligibility for employment, housing, insurance, credit, education admission, government benefits, or similarly significant real-world opportunities.

Server administrators are responsible for reviewing the consequences of moderation or automation rules they configure.

31. Business Transfers or Change of Operator

If GorBot is reorganized or transferred to another lawful operator, relevant information may be transferred as part of that transaction where permitted by law.

Any successor receiving personal information would be expected to handle it subject to applicable privacy obligations.

If the transfer materially changes the purposes for which information is processed, this Privacy Policy should be updated and additional notice or consent provided where legally required.

32. Changes to This Privacy Policy

This Policy may be updated when GorBot features, infrastructure, payment systems, laws, Discord requirements, or operating practices change.

The latest version will be posted on this page with an updated revision date.

Material changes may also be announced through:

• GorBot’s website.
• Discord.
• The GorBot dashboard.
• Another appropriate official communication channel.

Where applicable law requires notice or consent before a material new use of personal information, the Operator will follow that requirement.

33. Contact Information

Privacy & Data Rights: privacy@gorbot.onlyotaku.com
General Contact: contactus@gorbot.onlyotaku.com
Customer / Technical Support: support@gorbot.onlyotaku.com
Billing & Subscriptions: billing@gorbot.onlyotaku.com
Legal Notices & Intellectual Property: legal@gorbot.onlyotaku.com
Security Vulnerabilities: security@gorbot.onlyotaku.com
Abuse / Safety Reports: abuse@gorbot.onlyotaku.com

Additional official resources:

• Terms of Service: GorBot Terms of Service
• Support: GorBot Support
• Contact: Contact Us
• Plans & Features: GorBot Plans & Features
• Discord Privacy Policy: discord.com/privacy

These role addresses may be implemented as separate mailboxes or aliases/forwarders, but privacy, legal, billing, security, and abuse communications should be monitored and handled according to their purpose.

Users should never email passwords, Discord account tokens, API keys, Bot tokens, database credentials, payment-card security codes, private keys, TOTP secrets, or recovery codes.

GorBot • Privacy Policy
GorBot is an independent community project and is not affiliated with or endorsed by Discord Inc., Electronic Arts, Broadsword Online Games, Ultima Online, the Gor literary rights holders, or other referenced third-party rights holders.