Privacy Policy

This privacy policy informs you which personal data is processed when you visit this website, sign in to the dashboard, use the Discord bot and take out a Premium subscription, for which purposes this happens and which rights you have.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

No data protection officer has been appointed, as the legal requirements for doing so are not met.

2. Hosting and technical logs

The website, dashboard, bot and database are run by the operator on their own hardware in Germany. No hosting takes place with external data centre providers.

Each time the website is accessed, access data is processed for technical reasons: IP address, date and time, page requested, referrer, browser type and operating system. This data is used to deliver the page, for security (defending against attacks, troubleshooting) and for anonymous reach statistics. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation).

Technical logs and page views are deleted after 90 days.

3. Sign-in via Discord (OAuth2)

You sign in to the dashboard with your Discord account. In doing so, the operator receives the following data from Discord: your Discord user ID, username and display name, avatar, profile banner, accent colour and avatar decoration, your public Discord badges, the language setting of your Discord account (locale), your Nitro status, whether two-factor authentication is enabled, your email address and its verification status, and the list of Discord servers you are a member of (including your permissions there). The server list is needed to show you the servers you are allowed to manage.

Profile data is re-read from Discord on every sign-in and every automatic renewal of access so that it stays up to date. In addition, when you use the bot, it takes over your name, avatar, badges and language at most once a day. The language setting is used to show you bot messages and the interface in your language; your Nitro status and badges are only shown in your own profile. Your email address is never visible to other users or server administrators; it is used solely for the operator to contact you about account, security and billing matters and – for a Premium subscription – for passing it to Stripe (section 6) and is only shown masked in the internal administration area (every reveal is logged). The legal basis is Art. 6(1)(b) GDPR, and for the email address additionally Art. 6(1)(f) GDPR (reachability in case of security incidents). The data is deleted as soon as you delete your account.

You are only added to the operator's support server automatically if the operator has switched this feature on; Discord then explicitly asks for the permission “Join servers for you” when you sign in. It is off by default – joining then remains your own choice via the button in your profile.

The legal basis is Art. 6(1)(b) GDPR (provision of the dashboard). The sign-in itself takes place at Discord; the privacy policy of Discord Inc., 444 De Haro Street, San Francisco, CA 94107, USA (https://discord.com/privacy) applies. Discord access tokens are stored encrypted and discarded when the session expires.

4. Data of the Discord bot

When the bot is invited to a Discord server, it processes the data required for its functions on behalf of the server's administrators. Depending on the enabled modules, this is:

• Server settings: server ID, channel and role IDs, module configuration, language, embed colour.
• Tickets: ticket metadata (creator, timestamps, category, status), the messages exchanged in the ticket and transcripts generated when a ticket is closed.
• XP and economy: user ID, experience points, level, virtual balances and transactions within the server.
• Moderation: warnings with user ID, responsible moderator, reason and time; automod logs.
• Rule acceptance: If a server uses rules with an accept button, yurna stores the user ID, the time, a fingerprint (SHA-256) of the accepted version of the rules as well as channel and message on every click. This lets the server staff prove who accepted which rules and when (Art. 6(1)(f) GDPR); for this purpose the posted rules texts (the last 25 versions) are kept as well. The entries are kept as long as the server uses yurna and are deleted together with the server data or with your account.
• Statistics: figures on messages, joins and command usage per server; also, per member and day, the number of messages and the minutes spent in voice channels (without content), voice channel sessions (channel, start, end) and invites (who invited whom). This data is used for the analytics in the dashboard, leaderboards and weekly reports of the respective server and is kept for at most 2 years.
• Server log: Discord events of the server (e.g. joins, role and channel changes, moderation actions, deleted or edited messages – message content only if the server has enabled the corresponding log). Retention of 7, 30 or 180 days depending on the plan.
• Command usage: which command was run when, by which user ID and in which server (for troubleshooting and abuse prevention).

Message content outside of tickets is only stored if the server has enabled the log for deleted or edited messages (server log, retention periods see above); automod only checks messages transiently. The legal basis is Art. 6(1)(b) GDPR (provision of the functions requested by the server) and Art. 6(1)(f) GDPR (security, abuse prevention). The server's administrators decide which modules are active and are in turn responsible for informing their members about the use of the bot.

5. Cookies and local storage

This website uses only technically necessary cookies; a consent banner is therefore not required (Section 25(2) No. 2 TDDDG). No tracking or advertising cookies are set.

• Session cookie: keeps you signed in to the dashboard after signing in with Discord (lifetime up to 30 days).
• yurna-locale: stores the selected interface language.
• yurna-bewegung: stores whether animations should be reduced.

The language and motion settings are additionally stored in your browser's local storage. You can delete cookies in your browser at any time; the dashboard can then not be used until you sign in again.

6. Payment processing via Stripe (Premium subscription)

For paid Premium subscriptions, the operator uses the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). Payment and management of the subscription (customer portal) take place directly at Stripe.

The following is transmitted to Stripe: your Discord user ID and the server ID (as a reference for the subscription), your email address and the selected plan. You enter payment details such as card number, IBAN or PayPal account exclusively at Stripe; the operator does not receive them. From Stripe, the operator receives the status of the subscription (active, cancelled, payment failure), the billing period and a customer and subscription identifier.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract). Stripe may transfer data to its parent company Stripe, Inc. in the USA. This transfer to a third country is covered by the EU standard contractual clauses (Art. 46(2)(c) GDPR) and Stripe's certification under the EU-US Data Privacy Framework. More information: https://stripe.com/privacy.

Billing-related data (invoices, payment receipts) is retained for up to ten years in accordance with tax and commercial law (Art. 6(1)(c) GDPR, Section 147 of the German Fiscal Code (AO)).

6a. Pokémon packages and Pokémon bot

If you purchase a Pokémon package, the operator stores with your Discord user ID: the package, the chosen game groups (and a scheduled change), the status and period of the subscription, the amount, the Stripe customer and subscription identifiers, and a history of changes (purchase, switch, renewal, cancellation). The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

Section 6 (Stripe) applies accordingly to payment and subscription management; instead of a server ID, Stripe receives your Discord user ID, the chosen package and the chosen game groups as a reference.

For every trade request, the Pokémon bot (operated by the operator itself) asks yurna over an encrypted, signed internal connection whether you may trade. Your Discord user ID and the server ID are transmitted; yurna replies with the approval, the daily limit and the remaining trades of the day per game group, the break between two trades, the package name with its term and the limits for saved presets. In turn, the Pokémon bot reports every trade (game, Pokémon, status) to yurna; yurna uses this to calculate the free quotas. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for abuse prevention.

Subscription data is stored for the duration of the contract and deleted afterwards unless there is a retention obligation (invoices: up to ten years, see section 6). Trade records are subject to the periods for bot data.

Note: this section is a draft (placeholder) and will be reviewed by a lawyer before sales start.

6b. Etsy module

Server admins can use the Etsy module. If the owner of an Etsy shop connects the shop via Etsy sign-in (OAuth 2.0), the operator stores: shop ID, shop name and icon, the Discord ID of the connecting person, the Etsy user ID and access and refresh tokens (encrypted, read-only access to listings, shop info and orders) with their expiry times. When a shop is only followed publicly, only public shop data is used.

The purpose is to post messages about new listings, price changes, shop announcements and – only if connected by the shop – orders on the Discord server. For order posts the bot fetches the order from Etsy and takes over only item titles, quantities, total and time. Name, address, email address, messages and other buyer data are discarded immediately, never stored and never posted. To detect changes the operator stores public listing data per shop (listing ID, price, quantity, image address) and the last shop announcement.

The legal basis is Art. 6(1)(b) GDPR (providing the feature requested by the server) or (f) (legitimate interest in a reliable service). Data is exchanged with Etsy, Inc. (USA) or Etsy Ireland UC for this; Etsy's privacy policy also applies.

When you disconnect in the dashboard, the tokens and all settings of the connection are deleted immediately; you can also revoke access on Etsy at any time. Public shop data is deleted as soon as no server uses the shop anymore. A confirmed deletion request for a server or account also deletes the related Etsy connections. The term “Etsy” is a trademark of Etsy, Inc.; yurna is not endorsed or certified by Etsy.

6c. BuiltByBit module

Server admins can use the BuiltByBit module. When a creator creates a connection, the operator stores: the Discord ID of the connecting person, a random webhook secret and – if provided – the private token for the BuiltByBit Ultimate API (both encrypted), plus the BuiltByBit member ID and name of the creator account and, to detect new content, the titles, version and review IDs of the creator's own resources. The token is used for reading only.

For every purchase BuiltByBit sends to the connection's webhook address: the buyer's BuiltByBit user ID, username and profile link, resource, add-on or bundle, price, renewal and time. These details are only stored until processing (at most 7 days) and then deleted; to prevent duplicate notifications only a non-reversible hash is kept for 30 days. The buyer's name only appears in the Discord channel if the server has switched “show buyer name” on (default: off); the same applies to reviewers' names.

For the buyer role the bot asks BuiltByBit for the Discord account the buyer linked in their BuiltByBit account, or – after clicking “Verify purchase” – for the BuiltByBit account linked to the person's own Discord account and whether an active license exists. These results are not stored; only the number of roles given is counted. Legal basis is Art. 6(1)(b) GDPR (function requested by the server) or (f) (the creator's legitimate interest in purchase notifications); data is exchanged with BuiltByBit for this, whose privacy policy also applies.

Disconnecting in the dashboard immediately deletes token, secret, notifications and role mappings; the creator removes the webhook in their BuiltByBit account themselves. On a confirmed deletion request for a server or account, the related BuiltByBit connections and events are deleted as well. yurna is not affiliated with BuiltByBit.

6d. TikTok feature (Premium)

On servers with active Premium, server owners and managers can connect their own TikTok account via TikTok's sign-in (“Continue with TikTok”, TikTok Login Kit) and upload server clips that yurna creates from templates to the TikTok app as a draft, or post them directly on their account. For this, the operator processes:

• Connected account: the TikTok account identifier (open_id), the display name, the address of the profile picture (avatar URL) and the permissions granted (user.info.basic, video.upload, video.publish).
• Access keys: TikTok access and refresh tokens, stored encrypted with AES-256-GCM.
• Clips: the videos and captions created.
• Post log: the chosen post settings (visibility, comments, Duet, Stitch, commercial content disclosure), the publish_id assigned by TikTok and the post status, the times, and the Discord user ID of the person who triggered the upload or post and the server ID.

The data is used solely to show the connected account in the dashboard and to upload or post clips at your express request. You trigger every upload and every post individually; for a direct post you choose visibility, interactions and commercial content disclosure yourself and expressly confirm the post. The legal basis is Art. 6(1)(b) GDPR (providing the requested feature) and, for connecting the TikTok account, additionally your consent under Art. 6(1)(a) GDPR.

The tokens are deleted as soon as you disconnect, or automatically at the latest when TikTok invalidates them (the refresh token after 365 days). The account data (open_id, display name, avatar URL, permissions) is deleted immediately when you disconnect. Clips and captions are deleted after 30 days and the post log (publish_id, status, settings) after 90 days – in both cases regardless of disconnecting. If an account or server deletion request is confirmed, the connection, clips and post log of the account or server concerned are additionally deleted immediately. Like all other data, it is stored on the operator's own hardware (section 2).

The only recipient is TikTok – for users in the European Economic Area, TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, which according to TikTok's privacy policy is a joint controller together with TikTok Information Technologies UK Limited. Only the data needed for the upload or post is transmitted: the video, the caption and the post settings. Processing at TikTok is governed by TikTok's privacy policy. Data is not passed on to any other third parties, not used for advertising and not used for profiling.

You can disconnect at any time and thereby withdraw your consent: “Disconnect” in the dashboard deletes the tokens and account data immediately and revokes the tokens at TikTok. You can also remove yurna's access in the TikTok app at any time (Settings → Security → App permissions). Withdrawal does not affect the lawfulness of the processing carried out before it.

7. Retention periods

• Technical logs and page views: 90 days
• Bot command usage: up to 1 year
• Server settings, tickets, XP/economy, warnings, statistics: as long as the bot is used in the server or until confirmed deletion (see section 9)
• Partial backup before a deletion: 30 days, then permanent removal
• Database backups (encrypted, not actively accessible): 14 days
• Billing data of the Premium subscription: 10 years (statutory retention obligation)

8. Recipients and disclosure

Personal data is only disclosed to third parties insofar as this is necessary to provide the service (Discord Inc. for operating the bot and the sign-in, Stripe for payment processing) or a legal obligation exists. Data is not sold and not used for advertising purposes.

9. Deletion of your data – by request with confirmation

Data is deleted upon request and after confirmation by the operator. This ensures that no unauthorised person deletes the data of a server or account:

• Your own account: Submit the request in your profile. Your account data and the data associated with you will be deleted.
• Server: Server administrators submit the request in the dashboard under the server settings. The settings, tickets, XP/economy, warnings and statistics of this server will be deleted.

After receipt, the operator reviews and confirms the request; you will be informed of the outcome. Before it is carried out, a partial backup is created, which is permanently deleted after 30 days. Note: Removing the bot from a server does not delete any data – please submit a request for this. You can also submit requests by email to mail@blackzack.dev; the operator may ask for proof of your identity (e.g. via your Discord account).

10. Your rights

You have the following rights vis-à-vis the controller with regard to the personal data concerning you:

• Right of access (Art. 15 GDPR) – you can also download a copy of your data directly in your profile
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR) – see section 9
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)

To exercise your rights, an email to mail@blackzack.dev is sufficient.

11. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. An overview of the German supervisory authorities can be found at bfdi.bund.de.

12. Minors

The service is aimed at people who are allowed to hold an account under Discord's terms of service (in Germany from the age of 13). Paid Premium subscriptions may only be taken out by adults or with the consent of a parent or guardian.

13. Changes

This privacy policy is updated when the processing or the legal situation changes. The version published on this page applies; the date of the last update is shown at the top.