Privacy Policy – Summary

Last updated: 20 October 2026

yurna is a Discord bot with a web dashboard and optional Premium subscriptions, run privately by Blackzack. Contact details of the controller are listed in the Imprint.

Where your data lives

Website, dashboard, bot and database run on the operator's own hardware in Germany – no external data centre. Technical access logs (IP address, time, requested page, referrer, browser) are kept for security and anonymous reach statistics and deleted after 90 days.

Signing in with Discord

The dashboard uses Discord OAuth2. The operator receives your Discord user ID, names, avatar and profile styling, public badges, language, Nitro and 2FA status, your email address and the list of servers you are a member of (to show which ones you may manage). Your email address is never shown to other users or server admins; it is only used to contact you about account, security and billing matters and, for Premium, passed to Stripe. Discord access tokens are stored encrypted and discarded when the session ends.

What the bot stores

Depending on the modules a server enables: server settings, tickets and transcripts, XP and economy balances, warnings and automod logs, activity statistics (counts only, no message content, at most 2 years), the server log (7, 30 or 180 days depending on plan) and command usage. Message content outside tickets is only kept if the server enabled logging of deleted or edited messages. Server admins decide which modules are active.

Cookies

Only technically necessary cookies: the session cookie (up to 30 days), yurna-locale (language) and yurna-bewegung (reduced motion). No tracking or advertising cookies.

Payments

Premium subscriptions are processed by Stripe Payments Europe, Ltd. (Dublin, Ireland). Stripe receives your Discord user ID, the server ID, your email address and the chosen plan; payment details are entered only at Stripe. Billing records are kept for ten years as required by German tax law.

Etsy module

If a server uses the Etsy module, a shop owner can connect their Etsy shop via Etsy's own sign-in (OAuth). yurna then stores the shop ID, shop name and icon, who connected it (Discord user ID) and encrypted access tokens with read-only permissions (listings, shop info, orders). For order notifications yurna reads the order from Etsy and posts only the items, quantities, total and time – never the buyer's name, address, email or messages; buyer data is discarded immediately and never stored. Following a shop publicly only uses public shop data. Disconnecting in the dashboard deletes the tokens and settings immediately; access can also be revoked on Etsy at any time. The term "Etsy" is a trademark of Etsy, Inc. This application uses the Etsy API but is not endorsed or certified by Etsy, Inc.

BuiltByBit module

If a server uses the BuiltByBit module, a creator can send purchase notifications from their BuiltByBit account to a webhook address of their own (protected by a random secret) and optionally store a BuiltByBit API token, which yurna keeps encrypted and only uses for reading (own resources, updates, reviews, licenses). For each purchase BuiltByBit sends the buyer's BuiltByBit user ID and name, the resource, add-on or bundle, price and time. yurna keeps these details only until the notification has been processed (at most 7 days), then deletes them; only a hash of the purchase remains for 30 days to prevent duplicates. The buyer's name is only shown in Discord if the server has switched "show buyer name" on (off by default). For the buyer role, yurna asks BuiltByBit for the Discord account the buyer linked in their BuiltByBit account (or, when a member clicks "Verify purchase", for the BuiltByBit account linked to their Discord account) and whether they hold an active license – nothing of this is stored. Disconnecting in the dashboard immediately deletes token, secret and settings. BuiltByBit is not affiliated with yurna.

TikTok feature (Premium)

On servers with active Premium, server owners and managers can connect their own TikTok account via TikTok's sign-in (“Continue with TikTok”, TikTok Login Kit) and upload server clips that yurna creates from templates to the TikTok app as a draft, or post them directly. See how the TikTok feature works.

• Data: the TikTok open_id, display name and avatar URL, the permissions granted (user.info.basic, video.upload, video.publish), access and refresh tokens (stored encrypted with AES-256-GCM), the clips and captions created, the post settings (visibility, comments, Duet, Stitch, commercial content disclosure), TikTok's publish_id and the post status, the times, and the Discord user and server that triggered the upload or post.
• Purpose: solely to show the connected account in the dashboard and to upload or post clips at your express request. You trigger every upload and post yourself; for a direct post you choose visibility, interactions and disclosure yourself and expressly confirm it.
• Legal basis: Art. 6(1)(b) GDPR; for connecting the TikTok account additionally your consent under Art. 6(1)(a) GDPR.
• Retention: tokens until you disconnect, or automatically when TikTok invalidates them (the refresh token after 365 days); account data (open_id, name, avatar, permissions) until you disconnect; clips and captions 30 days; post log (publish_id, status, settings) 90 days, regardless of disconnecting. If an account or server deletion request is confirmed, the connection, clips and post log of the account or server concerned are additionally deleted immediately. Everything is stored on the operator's own hardware.
• Recipient: only TikTok – for users in the European Economic Area TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (according to TikTok's privacy policy a joint controller with TikTok Information Technologies UK Limited) – and only what an upload or post needs: the video, the caption and the post settings. TikTok's own Privacy Policy applies there. No sharing with other third parties, no advertising, no profiling.
• Withdrawal: “Disconnect” in the dashboard deletes tokens and account data immediately and revokes the tokens at TikTok. You can also remove yurna's access in the TikTok app (Settings → Security → App permissions). Withdrawal does not affect the lawfulness of processing before it.

Retention at a glance

• Technical logs and page views: 90 days
• Bot command usage: up to 1 year
• Server data: while the bot is used, or until a confirmed deletion request
• Partial backup before a deletion: 30 days
• Encrypted database backups: 14 days
• Premium billing data: 10 years
• TikTok feature: tokens and account data until you disconnect, clips and captions 30 days, post log 90 days

Deleting your data

Deletion happens on request and after confirmation by the operator: for your account in your profile, for a server in its dashboard settings. Removing the bot from a server does not delete any data – please submit a request.

Your rights

You have the rights of access, rectification, erasure, restriction, data portability and objection under the GDPR, and the right to lodge a complaint with a supervisory authority. An email to the address in the Imprint is enough to exercise them.