Privacy Policy

Last updated: 13.10.2026

This privacy policy informs you which personal data is processed when you visit this website, sign in to the dashboard, use the Discord bot and take out a Premium subscription, for which purposes this happens and which rights you have.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

No data protection officer has been appointed, as the legal requirements for doing so are not met.

2. Hosting and technical logs

The website, dashboard, bot and database are run by the operator on their own hardware in Germany. No hosting takes place with external data centre providers.

Each time the website is accessed, access data is processed for technical reasons: IP address, date and time, page requested, referrer, browser type and operating system. This data is used to deliver the page, for security (defending against attacks, troubleshooting) and for anonymous reach statistics. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation).

Technical logs and page views are deleted after 90 days.

3. Sign-in via Discord (OAuth2)

You sign in to the dashboard with your Discord account. In doing so, the operator receives the following data from Discord: your Discord user ID, username and display name, avatar, profile banner, accent colour and avatar decoration, your public Discord badges, the language setting of your Discord account (locale), your Nitro status, whether two-factor authentication is enabled, your email address and its verification status, and the list of Discord servers you are a member of (including your permissions there). The server list is needed to show you the servers you are allowed to manage.

Profile data is re-read from Discord on every sign-in and every automatic renewal of access so that it stays up to date. In addition, when you use the bot, it takes over your name, avatar, badges and language at most once a day. The language setting is used to show you bot messages and the interface in your language; your Nitro status and badges are only shown in your own profile. Your email address is never visible to other users or server administrators; it is used solely for the operator to contact you about account, security and billing matters and – for a Premium subscription – for passing it to Stripe (section 6) and is only shown masked in the internal administration area (every reveal is logged). The legal basis is Art. 6(1)(b) GDPR, and for the email address additionally Art. 6(1)(f) GDPR (reachability in case of security incidents). The data is deleted as soon as you delete your account.

You are only added to the operator's support server automatically if the operator has switched this feature on; Discord then explicitly asks for the permission “Join servers for you” when you sign in. It is off by default – joining then remains your own choice via the button in your profile.

The legal basis is Art. 6(1)(b) GDPR (provision of the dashboard). The sign-in itself takes place at Discord; the privacy policy of Discord Inc., 444 De Haro Street, San Francisco, CA 94107, USA (https://discord.com/privacy) applies. Discord access tokens are stored encrypted and discarded when the session expires.

4. Data of the Discord bot

When the bot is invited to a Discord server, it processes the data required for its functions on behalf of the server's administrators. Depending on the enabled modules, this is:

• Server settings: server ID, channel and role IDs, module configuration, language, embed colour.
• Tickets: ticket metadata (creator, timestamps, category, status), the messages exchanged in the ticket and transcripts generated when a ticket is closed.
• XP and economy: user ID, experience points, level, virtual balances and transactions within the server.
• Moderation: warnings with user ID, responsible moderator, reason and time; automod logs.
• Rule acceptance: If a server uses rules with an accept button, yurna stores the user ID, the time, a fingerprint (SHA-256) of the accepted version of the rules as well as channel and message on every click. This lets the server staff prove who accepted which rules and when (Art. 6(1)(f) GDPR); for this purpose the posted rules texts (the last 25 versions) are kept as well. The entries are kept as long as the server uses yurna and are deleted together with the server data or with your account.
• Statistics: figures on messages, joins and command usage per server; also, per member and day, the number of messages and the minutes spent in voice channels (without content), voice channel sessions (channel, start, end) and invites (who invited whom). This data is used for the analytics in the dashboard, leaderboards and weekly reports of the respective server and is kept for at most 2 years.
• Server log: Discord events of the server (e.g. joins, role and channel changes, moderation actions, deleted or edited messages – message content only if the server has enabled the corresponding log). Retention of 7, 30 or 180 days depending on the plan.
• Command usage: which command was run when, by which user ID and in which server (for troubleshooting and abuse prevention).

Message content outside of tickets is only stored if the server has enabled the log for deleted or edited messages (server log, retention periods see above); automod only checks messages transiently. The legal basis is Art. 6(1)(b) GDPR (provision of the functions requested by the server) and Art. 6(1)(f) GDPR (security, abuse prevention). The server's administrators decide which modules are active and are in turn responsible for informing their members about the use of the bot.

5. Cookies and local storage

This website uses only technically necessary cookies; a consent banner is therefore not required (Section 25(2) No. 2 TDDDG). No tracking or advertising cookies are set.

• Session cookie: keeps you signed in to the dashboard after signing in with Discord (lifetime up to 30 days).
• yurna-locale: stores the selected interface language.
• yurna-bewegung: stores whether animations should be reduced.

The language and motion settings are additionally stored in your browser's local storage. You can delete cookies in your browser at any time; the dashboard can then not be used until you sign in again.

6. Payment processing via Stripe (Premium subscription)

For paid Premium subscriptions, the operator uses the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). Payment and management of the subscription (customer portal) take place directly at Stripe.

The following is transmitted to Stripe: your Discord user ID and the server ID (as a reference for the subscription), your email address and the selected plan. You enter payment details such as card number, IBAN or PayPal account exclusively at Stripe; the operator does not receive them. From Stripe, the operator receives the status of the subscription (active, cancelled, payment failure), the billing period and a customer and subscription identifier.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract). Stripe may transfer data to its parent company Stripe, Inc. in the USA. This transfer to a third country is covered by the EU standard contractual clauses (Art. 46(2)(c) GDPR) and Stripe's certification under the EU-US Data Privacy Framework. More information: https://stripe.com/privacy.

Billing-related data (invoices, payment receipts) is retained for up to ten years in accordance with tax and commercial law (Art. 6(1)(c) GDPR, Section 147 of the German Fiscal Code (AO)).

6a. Pokémon packages and Pokémon bot

If you purchase a Pokémon package, the operator stores with your Discord user ID: the package, the chosen game groups (and a scheduled change), the status and period of the subscription, the amount, the Stripe customer and subscription identifiers, and a history of changes (purchase, switch, renewal, cancellation). The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

Section 6 (Stripe) applies accordingly to payment and subscription management; instead of a server ID, Stripe receives your Discord user ID, the chosen package and the chosen game groups as a reference.

For every trade request, the Pokémon bot (operated by the operator itself) asks yurna over an encrypted, signed internal connection whether you may trade. Your Discord user ID and the server ID are transmitted; yurna replies with the approval, the daily limit and the remaining trades of the day per game group, the break between two trades, the package name with its term and the limits for saved presets. In turn, the Pokémon bot reports every trade (game, Pokémon, status) to yurna; yurna uses this to calculate the free quotas. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for abuse prevention.

Subscription data is stored for the duration of the contract and deleted afterwards unless there is a retention obligation (invoices: up to ten years, see section 6). Trade records are subject to the periods for bot data.

Note: this section is a draft (placeholder) and will be reviewed by a lawyer before sales start.

7. Retention periods

• Technical logs and page views: 90 days
• Bot command usage: up to 1 year
• Server settings, tickets, XP/economy, warnings, statistics: as long as the bot is used in the server or until confirmed deletion (see section 9)
• Partial backup before a deletion: 30 days, then permanent removal
• Database backups (encrypted, not actively accessible): 14 days
• Billing data of the Premium subscription: 10 years (statutory retention obligation)

8. Recipients and disclosure

Personal data is only disclosed to third parties insofar as this is necessary to provide the service (Discord Inc. for operating the bot and the sign-in, Stripe for payment processing) or a legal obligation exists. Data is not sold and not used for advertising purposes.

9. Deletion of your data – by request with confirmation

Data is deleted upon request and after confirmation by the operator. This ensures that no unauthorised person deletes the data of a server or account:

• Your own account: Submit the request in your profile. Your account data and the data associated with you will be deleted.
• Server: Server administrators submit the request in the dashboard under the server settings. The settings, tickets, XP/economy, warnings and statistics of this server will be deleted.

After receipt, the operator reviews and confirms the request; you will be informed of the outcome. Before it is carried out, a partial backup is created, which is permanently deleted after 30 days. Note: Removing the bot from a server does not delete any data – please submit a request for this. You can also submit requests by email to [E-Mail-Adresse]; the operator may ask for proof of your identity (e.g. via your Discord account).

10. Your rights

You have the following rights vis-à-vis the controller with regard to the personal data concerning you:

• Right of access (Art. 15 GDPR) – you can also download a copy of your data directly in your profile
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR) – see section 9
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)

To exercise your rights, an email to [E-Mail-Adresse] is sufficient.

11. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. An overview of the German supervisory authorities can be found at bfdi.bund.de.

12. Minors

The service is aimed at people who are allowed to hold an account under Discord's terms of service (in Germany from the age of 13). Paid Premium subscriptions may only be taken out by adults or with the consent of a parent or guardian.

13. Changes

This privacy policy is updated when the processing or the legal situation changes. The version published on this page applies; the date of the last update is shown at the top.