Privacy Policy

Effective date: [Effective date] Last updated: [Last updated date] Website: {{DOMAIN}}

1. Who we are and what this covers

GuildMarshal helps online game guilds organize on Discord. It currently supports World of Warcraft and may add other games; this Policy applies the same way to every game we support. GuildMarshal is made up of a Discord bot (the "Bot") and an officer website (the "Website"), together the "Service." The Service is operated by {{LEGAL_NAME}} ("we," "us," "our").

The Website is only for guild Officers, GMs, and GuildMarshal Admins. Members use the Service through the Bot's Discord commands.

This Policy explains:

• what personal data the Service collects, and why;
• who can see it;
• how long we keep it; and
• the choices and rights you have.

It covers members, Officers, GMs, and payers who use the Service. It also covers people whose data appears in a guild's records because their Discord server uses the Bot.

World of Warcraft is a trademark of Blizzard Entertainment. GuildMarshal is not affiliated with or endorsed by Blizzard. It is also not affiliated with Discord. Discord's and game publishers' own privacy policies cover data you give to them.

Questions: {{CONTACT_EMAIL}}.

2. Who is responsible for your data

Your guild's Officers and GMs choose whether to use GuildMarshal, what to record, and how to use the results. If you have questions about how your guild uses your data, you can ask your guild's leadership or contact us directly. Either way, you can use the /privacy commands yourself (Section 7).

Retention is fixed by GuildMarshal policy. The retention periods in Section 6 are set by us and apply to every guild. Officers, GMs, and server owners can't change, lengthen, shorten, or turn them off.

[COUNSEL REVIEW — FLAG: controller/processor split for informal guilds; household exemption; joint-controller option; whether a data processing addendum must be accepted by whoever installs the Bot; routing of rights requests.]

3. What we collect

We collect only what the Service needs:

• We do not ask for your email address.
• We do not read Discord message content.
• We do not receive Discord presence (online status or activity) or the full server member list.
• We do not record, listen to, or store voice audio.

3.1 From Discord when an officer signs in (Discord OAuth)

Only Officers, GMs, and GuildMarshal Admins sign in to the Website. We request these scopes:

We do not receive your Discord password. [VERIFY — whether OAuth access tokens are stored after login, and if so, how they are encrypted and when they expire.]

Sessions and log out everywhere. A signed-in session lasts 7 days. Activity on the Website extends it back to 7 days, at most once an hour, so continued use keeps the session open. Log out ends the current session. Log out everywhere asks you to confirm, then ends every session for your account. We record logins, logouts, and "log out everywhere" in the audit log, without session IDs.

Refused logins. If someone without an Officer, GM, or Admin role tries to sign in, including a regular member, we don't create a session. We keep a short record of the refused attempt (Discord ID, reason, and time) for security, and delete it after 30 days. An auth.denied entry also goes into the audit log and follows the audit log rules in Section 6.

3.2 From the Bot in servers that use it

The Bot uses only two non-privileged Discord gateway intents. It does not use the privileged Server Members, Presence, or Message Content intents.

• Guilds: server ID and name, channels, roles, and whether the Bot was added or removed. This lets the Bot work in the server, map roles, and track when it was removed.
• GuildVoiceStates: Discord's live view of who is in which voice channel. The Bot keeps this in memory only. It does not store a running log of voice joins and leaves.

Voice attendance. Attendance is saved only when an Officer runs /attendance. At that moment we save a snapshot of which members are in the chosen voice channel, linked to the event. If someone in the channel has no GuildMarshal profile yet, their Discord user ID and presence are held for up to 14 days so they can receive attendance credit if they set up a profile, and are otherwise deleted automatically (Sections 6 and 7.1). We never record, listen to, or store audio, and we don't keep raw voice-state events.

• The channel sees one public line saying attendance was recorded. The names are shown only to the officer, privately.
• The first time a member links a character, and the first time an officer signs in, they see a one-time notice explaining attendance tracking.
• Any member can use /privacy opt-out at any time. It keeps their name off member-visible lists, Discord roster posts, and signup posts. It does not stop attendance recording: they still count in attendance totals, and Officers, GMs, and the Discord server owner still see their Discord name and character name marked "Opted out" in on-screen officer views. Officer-only exports (export summaries and both CSVs) leave out their Discord name and Discord ID and show only the character name with opted_out = yes. To stop recording entirely, a member can use /privacy delete, which anonymizes their existing data by default (or erases it if they choose "Delete everything") and blocks all future recording until they run /privacy resume, or, in the EU/UK, object under GDPR Article 21 (Sections 7.1, 7.2, 10.1).

The Bot has limited permissions and no Administrator or Manage Roles permission.

3.3 Guild data created in GuildMarshal

Officers, GMs, and members create this data while using the Service:

• characters (name, class, spec, role, and similar game details) and rosters;
• raid events and signups (status and any signup note);
• absences: dates a member says they will miss, with an optional reason;
• attendance records, including voice snapshots (Section 3.2) and officer corrections;
• roster assignments;
• officer notes and tags about members, visible only to Officers, GMs, and Admins. Officers must not put sensitive personal information in them (see ToS Section 8);
• soft reserves, wishlists, loot council decisions, and loot history;
• an append-only audit log of actions (for example, who changed an assignment and when).

3.4 Role sync and Inactive status

GuildMarshal reads members' Discord roles to set their GuildMarshal level. The Website rechecks a signed-in officer's roles at most every 30 minutes.

• A member who is still in the Discord server but holds no mapped Member, Officer, GM, or Admin role is marked Inactive. Their history is kept, and they become Active again if a mapped role comes back.
• We record that a member has left the server when a Discord membership lookup says they are gone. This happens without the privileged Server Members intent.
• Members who have left are anonymized after 90 days (Section 6).

3.5 Billing data (paid plans)

Payments are processed by Discord (in-app purchases) or by [payment processor]. We never receive or store full card numbers or bank details. For each paid guild we keep:

• the payer's Discord user ID and username;
• the plan, its status, start, renewal, and cancellation dates;
• the provider's transaction or subscription reference;
• the amount and currency; and
• billing events such as failed payments, refunds, and chargebacks.

We use this to provide the plan, send renewal and billing reminders, handle refunds and chargebacks, and meet tax and accounting duties.

3.6 Technical data and cookies

• Cookies: one strictly necessary session cookie, plus a short-lived security cookie during Discord sign-in. No analytics, advertising, or third-party tracking cookies. Because only strictly necessary cookies are used, there is no cookie banner. [VERIFY — confirm no analytics; if added, update this section and add consent.]
• Logs: our servers may log IP address, browser/user agent, request times, and errors, for security and debugging. They are kept for [30] days. [VERIFY — what is logged and for how long.]

4. How we use data

Reminder DMs. We send Discord direct messages to the guild's GM(s) and payer (inactivity warnings go to the GM(s), or to the Discord server owner if no GM is mapped) about the following. These are service messages, not marketing:

• the cancellation read-only period (around day 60 and day 83);
• inactivity (around day 150 and day 173);
• the guild-deletion undo window;
• billing; and
• material changes to our Terms or this Policy.

We do not sell personal data, "share" it for cross-context behavioral advertising, show ads, or use it to train AI models. [C.B. DECIDE — confirm the AI-training commitment.]

5. Who can see your data

• Your guild's leadership. Officers, GMs, and GuildMarshal Admins see guild data on the Website according to their level. Members don't use the Website. Members see their own data and the guild's public Bot posts (event signups and roster posts) in Discord, and can export their own data with /privacy export.
• Attendance exports. Once an officer downloads a CSV, the guild controls that file and this Policy no longer covers it.
• Service providers (Section 5.1), only on our instructions.
• Legal and safety. When the law requires it, or to protect the rights, safety, or property of users, the public, or us.
• Business transfers. If the Service is transferred, data may be transferred subject to this Policy, with notice to you. [COUNSEL REVIEW]

5.1 Service providers

6. How long we keep data

These periods are fixed by GuildMarshal policy and apply to every guild. Officers, GMs, and server owners can't change them. If this Policy and the Terms of Service ever disagree, the shorter period applies.

We may keep specific data longer only if the law requires it, or to deal with an active dispute or abuse report. We delete it once that need ends.

7. Your choices: export, delete, opt out

7.1 Self-service in Discord

Any member can use these Bot commands in a server that uses GuildMarshal:

• /privacy export returns your own GuildMarshal data as a JSON file, shown only to you. Session IDs aren't included.
• /privacy delete, after asking you to confirm, anonymizes your existing data by default or, if you choose "Delete everything", erases it, and blocks all future recording of you (Section 7.2).
• /privacy resume lifts that block so recording can start again. It does not restore any deleted or anonymized history.
• /privacy opt-out keeps your name off member-visible lists, Discord roster posts, and signup posts. Opting out does not stop attendance recording. Your attendance is still recorded, and you still count in attendance totals.
  • What officers see: Officers, GMs, and the Discord server owner ("Guild Administrators") continue to see your Discord display name and character name in officer-facing roster views, marked "Opted out". This is necessary to operate the roster builder (assigning members to raid groups and roles).
  • Guild Administrators can already see your Discord display name (and, if Developer Mode is enabled, your Discord user ID) through Discord itself because you are a member of the server. GuildMarshal additionally links that identity to your character name, attendance, sign-ups, absences, officer notes and opt-out status.
  • Use of GuildMarshal is voluntary. If you do not want your Discord name or ID linked to roster and attendance data, do not use the Service.
  • EU/UK users: This advice does not limit your rights. You may still request erasure (/privacy delete) or object to processing under GDPR Article 21 at any time, regardless of whether you continue to use the Service.
  • Certain features (including voice-channel attendance snapshots) may record your Discord user ID and presence if you are in a monitored channel while the bot is active, even if you have never run a GuildMarshal command. This occurs because you are present in the Discord server. If a voice-channel attendance snapshot records a Discord user who does not have a GuildMarshal profile, GuildMarshal holds that Discord user ID and presence for up to 14 days solely so that attendance credit can be applied if the user sets up a profile; if a profile is set up within that period, the attendance is credited and the hold is cleared, and otherwise the held data is automatically deleted after 14 days. Discord user IDs blocked by /privacy delete are never held, and the audit log records only the number of such users, not their Discord user IDs. You can stop all future recording and anonymize your existing data (or erase it entirely by choosing "Delete everything") by running /privacy delete, or by objecting under Article 21 (see below).
  • Exports: Officer-only exports (export summaries and both CSVs) leave out your Discord name and Discord ID and show only your character name with opted_out = yes. GuildMarshal does not collect legal names.
  • GuildMarshal (the operator) stores the opt-out flag so it can enforce it.
  • You can check your own status and reverse it at any time by running the command again.
  • To stop attendance recording: run /privacy delete (Section 7.2). Running /privacy delete also blocks all future recording of you: GuildMarshal stores only a one-way hash of your Discord user ID (never the ID itself) and uses it solely to prevent new attendance, sign-up, or roster records from being created for you. You may lift the block at any time with /privacy resume; resuming permits recording going forward but does not restore any deleted or anonymized history.
  • EU/UK users: You may also object to attendance recording (and any other processing based on legitimate interests) under GDPR Article 21 by contacting {{CONTACT_EMAIL}}. Upon a valid objection we will stop the objected processing for you unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims. We will inform you of the outcome. [LAWYER REVIEW — whether a legitimate-interest basis allows attendance recording to continue after a member objects under Article 21, or whether recording must stop for that member.]

Officers, GMs, and GuildMarshal Admins can carry out an anonymize or full deletion on the Website for a member who asks. The Website requires a confirmation step.

GMs and Admins deleting their own data. A GM or GuildMarshal Admin can delete their own data from the Officer Desk privacy form on the Website. They choose anonymize or full purge, confirm, and are then signed out.

Lawful basis (EU/UK): Roster and attendance processing is based on our legitimate interests in providing a functional guild roster tool (GDPR Art. 6(1)(f)). You may object as described above. Further detail is available in Section 10.

7.2 What deletion does

Anonymize (default):

• your Discord ID, username, display name, and avatar are replaced by a random "Former member #NNNN", and no table links that placeholder back to your Discord identity;
• your character names are removed (class, spec, and role stay);
• officer notes about you, and all your sessions, are deleted;
• your signups, attendance, and roster history stay under the placeholder, with your Discord identity removed, so guild totals are still right.

Full erasure ("Delete everything") purges your attendance, sign-up, and roster history and removes every row that belongs to you. Where a record must survive for another person, for example an attendance snapshot an officer took, the link to you points to a shared "deleted user" placeholder instead.

Blocking future recording. In either mode, running /privacy delete also blocks all future recording of you: GuildMarshal stores only a one-way hash of your Discord user ID (never the ID itself) and uses it solely to prevent new attendance, sign-up, or roster records from being created for you. You may lift the block at any time with /privacy resume; resuming permits recording going forward but does not restore any deleted or anonymized history. The hash is kept for as long as the block is in place. [LAWYER REVIEW — whether anonymized history held under "Former member #NNNN", together with the retained one-way hash of the Discord user ID, qualifies as anonymous data under GDPR (Recital 26), or is pseudonymous personal data that remains subject to GDPR, given that GuildMarshal can recompute the hash from a Discord user ID it later observes.]

Deleting in GuildMarshal doesn't delete your Discord account. You can also remove GuildMarshal from Discord's Authorized Apps to stop future sign-ins. That alone doesn't delete stored data.

7.3 The audit log

The audit log can't be edited or deleted, so officer actions can't be secretly changed. When you use /privacy delete, your Discord ID in the log is replaced with a placeholder, and the deletion itself is logged without your Discord ID. All audit-log Discord IDs are anonymized automatically after 24 months. [COUNSEL REVIEW — confirm this satisfies erasure requests.]

7.4 Guild-level deletion

Removing the Bot is what starts the guild-data clock in Section 6. The data stays available for 90 days, is then hidden, and is permanently deleted 30 days after it is hidden. Re-adding the Bot during those 30 hidden days restores it. There is no separate control that deletes the guild immediately.

7.5 CSV exports

We can't delete attendance CSVs that officers have already downloaded. Ask your guild's leadership to delete them.

8. Security and breach notice

We use reasonable technical and organizational measures, including:

• sign-in only through Discord OAuth, so we never hold passwords;
• encryption in transit (HTTPS/TLS) [VERIFY for the current environment];
• encrypted secrets and tokens [VERIFY];
• role-based access from Discord roles, rechecked regularly;
• a Bot with no privileged intents and no Administrator permission;
• an append-only audit log;
• 7-day sessions that slide with activity, with log out everywhere; and
• restricted staff access to production data [VERIFY].

No system is perfectly secure. [C.B. DECIDE — whether to collect real guild data before the move to production hosting.]

If there is a breach. If a breach of personal data is likely to affect your rights, we will:

• notify the relevant data protection authority within 72 hours of becoming aware of it, where GDPR or UK GDPR requires;
• tell affected guild GMs and members without undue delay, by Discord DM, a Bot message, or a Website notice; and
• explain what happened, what data was involved, what we are doing, and what you can do.

We also meet U.S. state breach-notification laws where they apply. [COUNSEL REVIEW]

To report a security issue: {{CONTACT_EMAIL}}.

9. Children

The Service isn't meant for children under 13, or under the higher minimum age where you live (up to 16 in some EEA countries) [VERIFY]. We don't knowingly collect data from children under that age. If we learn that we have, or a parent or guardian tells us, we will delete it. Paid plans require an adult payer, or a minor with a parent's or guardian's consent (ToS Section 2). [COUNSEL REVIEW — COPPA / GDPR Art. 8.]

10. Your privacy rights

10.1 EEA, UK, and Switzerland (GDPR / UK GDPR)

You may have the right to:

• access your data;
• correct it;
• erase it;
• restrict how we use it;
• receive it in a portable format;
• object to processing based on legitimate interests, including voice attendance recording, by contacting {{CONTACT_EMAIL}} under GDPR Article 21. (Guild Administrators, as defined in Section 7.1, continue to see your Discord display name and character name, marked "Opted out", in officer-facing roster views, because this is necessary to operate the roster builder. This does not limit your rights of erasure or objection described in Section 7.1 and this Section. /privacy delete anonymizes your history by default, or erases it with "Delete everything", and blocks future recording until you run /privacy resume (Section 7.2).) /privacy opt-out only hides your name from member-visible places and does not stop recording (Section 7.1). [LAWYER REVIEW — whether a legitimate-interest basis allows recording to continue after an objection.]
• withdraw consent where we rely on it; and
• complain to your local data protection authority.

[COUNSEL REVIEW — need for an Article 27 EU/UK representative.]

10.2 California (CCPA/CPRA)

[COUNSEL REVIEW — whether the Operator meets the thresholds; may be included voluntarily.]

You may have the right to:

• know what personal information we collect;
• delete it;
• correct it;
• opt out of sale or sharing (we don't sell or share it);
• limit the use of sensitive personal information (we don't collect any as defined by the CCPA [VERIFY]); and
• not be discriminated against for using these rights.

Categories collected:

• identifiers (Discord user ID, username);
• commercial information (plan and billing records);
• internet activity (sessions, logs); and
• gaming-related information (characters, attendance, signups, absences, loot).

Sources: you, your guild's officers, and Discord. Purposes: Section 4.

10.3 Other places

Other laws (for example, in other U.S. states, Canada, Brazil, or Australia) may give you similar rights. We honor them as required.

10.4 How we handle requests

• Fastest: use /privacy export or /privacy delete in Discord. Running the command proves it's you. GMs and GuildMarshal Admins can also delete their own data from the Officer Desk privacy form on the Website (anonymize or purge, then you are signed out).
• Otherwise: email {{CONTACT_EMAIL}} with your Discord user ID. We verify you by asking you to run a /privacy command or sign in with Discord. You can use an authorized agent where the law allows.
• Response time: within one month (45 days for California), extendable where the law allows. We will tell you if we need more time.
• Guild data: we may let your guild's leadership know about a request that affects guild records, but we will act on valid requests ourselves.
• Cost: using your rights is free. We won't treat you differently for using them.

11. International transfers

We are based in [governing law / jurisdiction]. Data is stored in [hosting region — TBD] and processed by the providers in Section 5.1, some of which, including Discord, are in the United States. When personal data from the EEA, UK, or Switzerland goes to a country without an adequacy decision, we rely on recognized safeguards for each provider, such as the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) or Standard Contractual Clauses. You can ask us for details. [COUNSEL REVIEW]

12. Changes to this Policy

We will update the "Last updated" date. For material changes, we will give at least [30] days' notice before they take effect, through a Website notice, a Bot message in the guild's configured channel, or a Discord DM to GMs and payers (ToS Section 20A). Changes apply going forward. If a change would use your data in a materially different way, we will ask for consent where the law requires it.

13. Contact

{{LEGAL_NAME}} Email: {{CONTACT_EMAIL}} Postal address: [postal address — if required] Website: {{DOMAIN}} [EU/UK representative, if required — COUNSEL REVIEW]

Open items (internal — remove before publication)

For counsel

1. Controller/processor split, DPA, household exemption (§2).
2. Lawful bases, especially voice attendance (§4).
3. Whether audit-log anonymization satisfies erasure requests (§7.3).
4. Billing-record retention period (§6).
5. Breach process and state laws (§8).
6. CCPA applicability; Article 27 representative; transfer safeguards (§10–11).
7. Children / minors as payers (§9).

For C.B.

1. Placeholders: {{LEGAL_NAME}}, {{CONTACT_EMAIL}}, [governing law / jurisdiction], [Effective date], [Cloud host], [hosting region], [payment processor].
2. AI-training commitment (§4).
3. Prices; billing records [7] years; server logs [30] days; notice of changes [30] days.
4. Whether to collect real data before production hosting (§8).

For engineering [VERIFY]

1. Retention periods are fixed in the cleanup job. Stored retention_* columns remain in the database and are not what the job reads (§2, §6).
2. Still to build: the cancellation read-only period, after the subscription model (§6). Backup expiry is the host's job, not an app purge.
3. Which identify fields are stored (display name); whether OAuth tokens are stored and how (§3.1).
4. How Inactive status is refreshed for members who never sign in (§3.4).
5. Server log contents and retention; no analytics (§3.6).
6. Soft reserves, wishlists, and loot features: shipped or not (§3.3).
7. Billing integration and the data it actually stores (§3.5).