Privacy Policy

What we collect

Pandora stores the following, tied to Discord identifiers (your user ID and the server ID):

• Account & server identifiers — Discord user IDs, server (guild) IDs, and cached display names.
• Activity & progression — experience points, levels, message and voice activity counts, and streaks used by the leveling features.
• Economy records — an append-only ledger of in-server currency transactions (see “Retention” — these are permanent by design), plus balances, inventory, and game/quest/achievement records.
• Configuration history — changes made to a server’s settings, including which administrator made each change, retained as an audit trail.
• Safety records — verification, anti-bot (honeypot), and moderation records, including a short excerpt of a message that triggered a moderation action (see “Message content”).
• Birthdays — if the birthday feature is used, the birthday date you provide (this is personal data and is treated as such).
• Voice session timing — timestamps of voice activity used for voice XP and temporary voice channels.

Message content

Pandora reads message content for two purposes only, and never for advertising or profiling:

• Anti-spam & quality (transient). Message text is scored to filter low-effort and duplicate/near-duplicate messages so automated spam and copy-paste farming do not earn engagement rewards. This processing is transient — a normalized form of recent messages is held briefly in a cache with a short expiry and is not stored in our database.
• Moderation evidence. When a member is actioned for a rule violation, a truncated excerpt (up to ~200 characters) of the triggering message is retained in an append-only moderation log so the action is auditable.

How we use data

Data is used to provide the features a server’s administrators have enabled — leveling, economy, giveaways, welcome/birthday messages, verification, anti-bot protection, and moderation — and to keep those systems auditable and abuse-resistant. We do not sell data, and we do not share it with advertising or analytics networks.

Who processes data

Data is received from and sent to Discord as part of operating the bot, and is stored on infrastructure operated by [hosting provider — confirm before publish]. No advertising or third-party analytics networks receive your data.

Retention and erasure

When Pandora is removed from a server, that server’s configuration and gameplay data are deleted. On request, we erase a user’s profile and gameplay data across all servers (see “Your rights”).

The economy ledger is a tamper-evident, cryptographically hash-chained record with publicly verifiable checkpoints: entries cannot be altered or removed after the fact, which is what makes the economy provably fair. Because we cannot delete individual ledger rows, your identity is stored there pseudonymously from the start: the tamper-evident record holds only an opaque token, and your Discord ID is kept in a separate field. When you request erasure, we remove that link, so the retained integrity records can no longer be tied to you.

The financial and moderation-audit records that remain after erasure are therefore anonymized. Some transactional metadata (such as amounts and timing) stays in the integrity ledger, but it is no longer connected to your identity, and we do not keep your Discord ID in any record once an erasure request is completed.

Your rights

You can request access to, export of, or deletion of your data by contacting the Pandora support server. Deletion removes your profile and gameplay data across the servers Pandora is in; integrity and audit records are retained as described above, and we will tell you plainly what is deleted and what is kept. Depending on your location you may have additional rights under laws such as the GDPR or CCPA; contact us to exercise them.

Children

Pandora is intended for use in communities appropriate for ages 13 and over, consistent with Discord’s Terms of Service. We do not knowingly collect data from anyone under the minimum age permitted by Discord in their region.

Changes

We may update this policy; material changes will be reflected by an updated effective date. Continued use after an update constitutes acceptance of the revised policy.