1. Scope of This Policy

This Privacy Policy applies to GorBot, the GorBot web dashboard, and the official GorBot CMS website.

This includes, where applicable:

• The GorBot Discord application.
• Discord slash commands and configurable message-command features.
• Character profiles and public character presentation.
• Webhook-based character speech.
• Personal Notes.
• NPC creation and management.
• Shared or global NPC features.
• Conversation memory and adaptive roleplay systems.
• Server Discovery and other opt-in public listings.
• Player Studio features, including Player Galleries, Publications, Character Profile Cards, User Profile Cards, Character Groups, external-media references, public directories, reports, and moderation.
• Community Power features, including Forms & Applications, Suggestions, Giveaways, Honeypot Protection, Verification, Starboards, Sticky Messages, Question of the Day, Counting, Invite Tracking, invite rewards, Bump Reminders, Leveling, Reputation, and reusable Forms for Ticket intake.
• Embeds, reaction roles, custom commands, timed messages, tickets, welcome tools, and automations.
• Moderation, audit, anti-abuse, security, and administrative features.
• Discord OAuth sign-in.
• The GorBot web dashboard.
• Official GorBot legal, support, documentation, plans, navigation, and informational pages published through the GorBot CMS.
• Authorized GorBot CMS administrator and support-team accounts used to maintain those pages.
• Free and Premium plan entitlements.
• Billing and subscription metadata associated with live Discord Server Premium subscriptions.
• Optional third-party artificial-intelligence features.
• Optional game-server, GameBridge, NPC, item, equipment, or other integrations.
• Backups, failover, synchronization, and operational infrastructure used to provide GorBot.

This Policy applies to information processed by GorBot and the Operator. Discord and other third-party services have their own privacy policies and act under their own terms when they independently process information.

Use of GorBot is also governed by the <a href="/cms-page.php?slug=terms-of-service" target="_self">GorBot Terms of Service</a>.

2. Who Operates GorBot

For purposes of this Policy, the “Operator” means the person or legal entity responsible for operating GorBot.

The Operator is based in Utah, United States.

Until a separate business entity is formally identified in an updated version of this Policy, official privacy and legal communications should use the role-based contacts listed in this Policy rather than relying on an individual’s personal contact information.

Official contacts include:

• Privacy & Data Rights: privacy@gorbot.app
• Legal Notices: legal@gorbot.app
• Security Vulnerabilities: security@gorbot.app
• Abuse / Safety: abuse@gorbot.app
• Billing: billing@gorbot.app
• Support: support@gorbot.app
• General Contact: contactus@gorbot.app

3. Information GorBot May Collect

The information GorBot processes depends on which features you use, which features a Server has enabled, and whether you use Discord, the web dashboard, or an integration.

3.1 Discord Account Information

GorBot may receive or store information available through Discord or supplied during Discord OAuth authentication, including:

• Discord user ID.
• Discord username.
• Global display name.
• Discord avatar reference.
• Server nickname.
• Locale or language information where available and relevant.
• Whether the account represents a bot or application.
• Information needed to associate a GorBot account with the correct Discord account.

GorBot does not need your Discord password.

Do not provide your Discord password, account token, recovery code, or other Discord credentials to GorBot staff or through GorBot features.

3.2 Discord Server, Channel, Role, and Permission Information

GorBot may process:

• Discord Guild/Server IDs.
• Server names and icons.
• Channel IDs and channel metadata.
• Thread or forum-post IDs.
• Role IDs and role metadata.
• Discord permission values.
• Server ownership information.
• Membership information needed to determine whether you belong to a Server.
• Information needed to determine whether you may manage a Server or use a protected feature.
• Message IDs and webhook identifiers where needed for tracked messages or roleplay features.

Numeric Discord identifiers are commonly used so information can be associated with the correct user, Server, channel, role, message, profile, NPC, or configuration record.

3.3 Commands, Messages, and Discord Content

GorBot may process message content when it is relevant to an enabled feature.

Examples include:

• Slash-command inputs.
• Message-command text.
• Messages that begin with a configured GorBot prefix.
• Direct mentions or interactions with GorBot.
• Character dialogue.
• NPC dialogue and interactions.
• Messages in configured roleplay or automation contexts.
• Biography, profile, lore, journal, relationship, contract, marketplace, or similar roleplay content.
• Messages involved in moderation, security, ticketing, anti-abuse, or diagnostic workflows.
• Messages needed to maintain configured conversation or NPC memory.
• Content required to execute an automation or scheduled workflow.

GorBot is not designed to permanently store every message in every Discord channel merely because the Bot can technically receive an event.

Message content should be processed only when reasonably relevant to an enabled GorBot function, security requirement, moderation action, or operational need.

3.4 Character and Roleplay Profile Information

Character records may include:

• Character ID and owner Discord ID.
• Character name.
• Biography and descriptive fields.
• Avatar or image references.
• Profile style or template.
• Custom profile fields.
• Gender or pronouns.
• Fictional social role or status.
• Caste, profession, culture, city, homeland, affiliation, or similar setting information.
• Fictional ownership, relationship, or roleplay-status information.
• Speech style and preferred forms of address.
• Lore and background.
• Privacy and visibility selections.
• Active-character selection.
• Creation and modification timestamps.

GorBot supports extensive customizable roleplay profiles. Users should remember that free-text or custom fields can contain whatever information the User chooses to submit.

Do not place private real-world information in fields intended for public roleplay presentation.

3.5 NPC, Memory, Relationship, and Adaptive Roleplay Data

NPC or adaptive-roleplay features may store or derive:

• NPC names and identifiers.
• NPC descriptions and portraits.
• NPC owners or publishers.
• NPC personality settings.
• Mood or disposition.
• Relationship state.
• Forms of address.
• Fictional social roles.
• Gossip, knowledge, memories, or learned associations.
• Recent roleplay topics.
• Character-to-NPC or User-to-NPC relationship information.
• Adaptive-learning state used to maintain continuity.
• Timestamps and metadata associated with updates.

These records are roleplay state. They are not intended to represent factual psychological, medical, employment, credit, insurance, housing, or other real-world assessments of a person.

3.6 Personal Notes

GorBot may allow a User to maintain Personal Notes or similar private-to-account roleplay information.

Personal Notes are intended for roleplay organization and convenience.

They are not designed as:

• A password manager.
• An encrypted personal vault.
• A medical-record system.
• A financial-record system.
• A legal-record repository.
• Storage for government identification information.
• Storage for API keys, tokens, private keys, recovery codes, or credentials.

Personal Notes are restricted in normal application presentation, but they are not represented as end-to-end encrypted from the Operator. Authorized access may occur when reasonably necessary for technical support, security, legal compliance, abuse investigation, recovery, or maintenance.

3.7 Published, Shared, and Cross-Server Content

Some GorBot features allow Users or Server Owners to intentionally publish information outside a single private Server.

This may include:

• Global/shared NPC entries.
• NPC portraits.
• NPC information offered for cloning.
• Server Discovery profiles.
• Server names and descriptions.
• Server invite links.
• Server images or external gallery links.
• Activity or listing-bump information.
• Other content clearly marked as public, shared, discoverable, global, published, or cross-server.

Published Content should be treated as information that other GorBot users may view.

Where a feature allows an NPC or similar object to be cloned, a clone may become an independent record owned or managed by the receiving User or Server. Removing or unpublishing the original may not automatically delete copies that were legitimately created before removal.

3.8 Player Studio, Galleries, Publications, Profile Cards, and External Media

Player Studio may process or store information such as:

• Player Gallery names, descriptions, visibility, layout, tags, cover references, associations, and timestamps.
• Gallery image metadata, including externally hosted URLs, detected/selected provider, normalized URL, title, caption, description, alt text, artist/credit information, tags, content rating, sort order, validation state, and last-check information.
• Publication titles, descriptions, author/display names, co-author information, associated Character, series/volume, release/revision dates, language, genre, categories, tags, page/word counts, format, status, visibility, content rating, cover references, and external publication links.
• Publication-rights confirmation state, agreement version, User identifier, and confirmation timestamp where required.
• Character Profile Card and User Profile Card names, template/design settings, selected profile fields, custom Card fields, Card-specific overrides, layout/design configuration, status, primary-card state, public identifiers, and publish/update timestamps.
• Character Group names, descriptions, membership/organization information, and ownership metadata.
• References to existing User profile imagery, owned Character images, owned Gallery images, GorBot-provided assets, and approved external URLs.
• Media dependency relationships showing that one media reference is used by a Gallery, Publication, Character Card, User Card, or other supported consumer.
• Public-content reports, report reasons, moderation state, affected content identifiers, reporting User identifiers where applicable, and moderator actions.

GorBot normally stores a reference to externally hosted Gallery or Publication media rather than the underlying file itself, unless the resource is an existing Character image already stored through the Character system or another feature explicitly states otherwise.

External-media URLs may be validated, normalized, classified by provider, marked unavailable/blocked, or prevented from being displayed when the provider or resource no longer satisfies current rules.

A public Gallery image or public Profile Card does not make the underlying file owned by GorBot and does not grant unrelated Users permission to reuse it.

3.9 Community Power, Forms, Security, Engagement, and Derived Data

Community Power features may process or store information such as:

• Form/Application definitions, questions, answer options, validation settings, required/blocked roles, manager roles, configured actions, submission status, submission timestamps, User identifiers, submitted answers, reviewer identifiers, review decisions, review notes, and accepted/denied state.
• Suggestion text, board/category, author identifier, anonymity/public-display settings, vote/reaction state, staff responses, status, and timestamps.
• Giveaway configuration, prize text, eligibility requirements, entry identifiers, entry timestamps, winner selection, reroll history, and administrative actions.
• Verification configuration, verification status, assigned/unassigned role state, User identifiers, timestamps, and audit information.
• Honeypot/trap-channel configuration, triggering User/message/channel identifiers, triggering content where needed for the incident, action taken, deletion/timeout/kick/softban/ban result, security-log state, and timestamps.
• Starboard/Featured Message configuration, source message/channel identifiers, reaction counts, destination message identifiers, and update state.
• Sticky Message configuration, channel/message identifiers, repost state, and timestamps.
• Question of the Day schedules, configured questions, posting channel, posted-message identifiers, and schedule state.
• Counting-channel configuration, current count/state, participant identifiers where required for rule enforcement, invalid-attempt state, and reset/history information where retained.
• Invite Tracking information, including invite codes/labels where available, inviter identifiers, joining member identifiers, join/rejoin/fake-attribution classifications, reward-rule results, leaderboard/statistical values, and timestamps.
• Bump/listing-reminder configuration, reminder channel/role identifiers, schedule/cooldown state, and recent reminder activity.
• Leveling information such as XP/score, level, message or voice activity counters where enabled, cooldown/anti-abuse state, role-reward state, booster rules, leaderboard values, and timestamps.
• Reputation values, giving/receiving User identifiers, cooldown/anti-abuse state, and history where retained.
• Reusable Form references used by Ticket panels and the resulting intake-submission relationship.

Some Community Power information is derived from Discord events rather than directly typed by the User. Examples include invite attribution, XP, level, reputation counts, reaction totals, counting state, security classifications, or moderation outcomes. These derived values can be imperfect and are used for community/service features rather than significant real-world eligibility decisions.

3.10 Server Configuration and Automation Data

GorBot may store Server-specific settings such as:

• Command-prefix configuration.
• Enabled or disabled features.
• Role and channel selections.
• Welcome and goodbye settings.
• Reaction-role configuration.
• Embed templates.
• Custom commands.
• Timed-message configuration.
• Ticket-panel configuration, reusable intake-Form references, and inline intake-question settings.
• Forms/Application configuration and review settings.
• Suggestion, Giveaway, Verification, Honeypot, Starboard, Sticky Message, QOTD, Counting, Invite Tracking, Bump Reminder, Leveling, Reputation, and reward-rule configuration.
• Automations, triggers, actions, and conditions.
• Moderation and security settings.
• Bot presentation settings.
• Configuration backups.
• Feature limits and entitlement state.

Some configuration may contain text or identifiers supplied by Server administrators.

3.11 Moderation, Audit, and Security Information

GorBot may process or retain information needed for moderation, reliability, fraud prevention, and security, including:

• Warnings and moderation actions.
• Moderator or administrator actions.
• Role changes or protected administrative actions.
• Dashboard audit events.
• Action target identifiers.
• Success or failure state.
• Login attempts.
• IP addresses associated with login or dashboard-security events.
• Rate-limit events.
• Abuse or security findings.
• Automation execution records.
• Form/Application review actions, suggestion moderation, giveaway administration, verification activity, Honeypot incidents, invite-attribution/reward actions, leveling/reputation adjustments, and related Community Power activity where logging is enabled or operationally necessary.
• Error and diagnostic information.
• Relevant message, user, channel, Guild, role, or case identifiers.
• Security-incident records.
• Subscription or entitlement changes.
• Webhook/provider event identifiers.
• Backup or restoration activity.

Security records may be retained longer than ordinary activity records when reasonably necessary to investigate abuse, fraud, attacks, account compromise, legal claims, or repeated policy violations.

3.12 Web Dashboard and Browser Information

When you use a GorBot website or dashboard, GorBot or its hosting providers may process:

• IP address.
• Request date and time.
• Requested page or route.
• Browser or User-Agent information.
• Session identifier.
• Discord OAuth state.
• CSRF/security tokens.
• Authentication state.
• Selected Server/Guild context.
• Error and diagnostic information.
• Referrer or ordinary web-server request information where provided.
• Feedback information you voluntarily submit.

GorBot uses browser-session technologies necessary for authenticated dashboard operation and security.

GorBot is not designed to use Discord API data to build advertising profiles.

3.13 Discord OAuth Information

The web dashboard may use Discord OAuth to identify you and determine which Servers you belong to or can manage.

Depending on the authorized scopes, GorBot may obtain:

• Your Discord identity.
• Your Discord ID and profile information.
• Your Server/Guild list.
• Server ownership and permission information.
• OAuth access and refresh-token information needed to maintain authorized dashboard functionality.

Sensitive OAuth token values are administrative authentication data and are not intended to be displayed to ordinary users.

GorBot may use encrypted or protected storage for OAuth tokens where needed for the Service.

GorBot should request only OAuth scopes reasonably required for the feature being provided.

3.14 Billing, Subscription, and Entitlement Information

GorBot Server Premium billing is currently offered through Discord subscriptions. GorBot may process limited billing-related metadata needed to associate and administer the subscription entitlement, such as:

• GorBot user/account ID.
• Discord user ID.
• Discord Guild/Server ID receiving Premium.
• Plan or product.
• Price and currency.
• Subscription status.
• Subscription start date.
• Renewal date.
• End or cancellation date.
• Whether cancellation is scheduled for the end of a billing period.
• Payment-provider name.
• Provider customer, order, invoice, checkout, or subscription identifiers.
• Provider event identifiers.
• Refund, dispute, failure, or charge-status metadata.
• Premium entitlement and feature-limit records.

GorBot is not designed to store full payment-card numbers, CVV/security codes, or online-banking credentials.

Those payment details are collected and processed by Discord's applicable payment system rather than by GorBot. GorBot receives or maintains only the subscription, entitlement, and provider metadata reasonably needed to provide and administer Server Premium.

3.15 Support, Contact, and Feedback Information

If you contact GorBot by email, support ticket, feedback form, or another official support channel, GorBot may retain:

• Your email address if you send an email.
• Your Discord ID or username if provided.
• The Server involved.
• The feature or page involved.
• Browser information included in feedback.
• Screenshots or attachments you voluntarily submit through a support method that accepts them. The public GorBot Contact Us form does not currently accept file attachments.
• Error references.
• Your support message.
• Staff notes and resolution information.

Do not send passwords, tokens, full payment-card information, private keys, recovery codes, or other highly sensitive credentials in support requests.

3.16 GameBridge and Other Integrations

Where a GorBot feature is connected to a game server or another authorized integration, GorBot may process identifiers and roleplay information needed to perform that integration.

This may include:

• Game-side character or NPC identifiers.
• Discord-to-game linkage information.
• NPC or roleplay state.
• Commands or events sent through the integration.
• Operational status or error information.

The exact information depends on the integration and whether the feature has been enabled.

4. GorBot CMS Website

The official GorBot Website uses the internal GorBot CMS to publish legal pages, support documentation, public information, plans, navigation, and other GorBot material.

GorBot documentation that was formerly published through a separate Gor Ultima MediaWiki website has been migrated into the internal GorBot CMS. The former Wiki host is not a current GorBot website or publication service.

The GorBot CMS is presently intended to be publicly readable. Public account registration, public posting, public comments, and public editing are not offered as ordinary features. Authorized GorBot CMS administrators and support-team accounts may exist for maintenance and publication.

A visitor does not need to submit a character profile, Discord message, Personal Note, payment method, or other GorBot application content merely to read an ordinary public GorBot CMS page. However, visiting the Website can still cause ordinary website and security information to be processed.

4.1 Ordinary Web Requests

When a visitor requests a GorBot CMS page, GorBot, the web server, hosting provider, security layer, or related infrastructure may process information such as:

• IP address.
• Date and time of the request.
• Requested URL or CMS page.
• HTTP method and response status.
• Browser / User-Agent information.
• Referrer information where supplied by the browser.
• Network, security, error, or diagnostic information.
• Cookies or session identifiers where technically applicable.
• Information needed to detect abuse, attacks, excessive traffic, or malfunction.

This information may appear in ordinary web-server, application, security, or diagnostic logs.

4.2 GorBot Website Sessions and Cookies

The GorBot Website may use cookies or equivalent session mechanisms for authentication, security, CSRF protection, maintaining an authorized session, remembering necessary application state, and operating the web dashboard or CMS.

Ordinary public visitors are not offered public CMS accounts or public editing. Authorized CMS administrators and support-team members may use additional authentication, step-up verification, and session-security functionality.

The Operator does not intend to use GorBot CMS or dashboard session cookies to build cross-site advertising profiles.

If the Website later adds non-essential analytics, advertising, tracking pixels, third-party marketing cookies, or similar technologies, this Privacy Policy and any legally required consent mechanism should be updated before or when those technologies are deployed.

4.3 Authorized CMS Accounts, Revisions, and Audit Logs

GorBot CMS accounts are separate authorized administrative or support-team accounts. They are not ordinary public Discord-member accounts and are not offered through public registration.

Depending on the account and enabled security features, GorBot may store or process:

• Account identifier, username, display name, role, access state, and permitted CMS capabilities.
• A password hash rather than the account’s plaintext password.
• Encrypted TOTP configuration data and hashed recovery codes when two-factor authentication is enabled.
• Session identifiers, authentication state, login time, last-login information, and security re-verification state.
• Login attempts, IP addresses, browser or User-Agent information, security events, and rate-limit events.
• CMS page authorship, draft and publication activity, revision history, restores, menu changes, media changes, redirect changes, and other content-management actions.
• Audit details identifying the actor, action, affected object, timestamp, success or failure state, and associated IP address where recorded.

CMS pages and revisions may identify the authorized account that created, edited, published, restored, archived, or deleted content. These records may be retained as reasonably necessary for access control, security, accountability, support, rollback, debugging, legal compliance, or resolving disputes about administrative activity.

4.4 GorBot CMS Search, Navigation, and Redirect Service

If a visitor uses GorBot Website search, navigation, menus, redirects, or related public-page features, the requested search term, route, page, and resulting request may be processed by GorBot and ordinary server infrastructure to return results, enforce access rules, maintain security, and diagnose problems.

For Administrator-configured Redirect Service links, GorBot stores an aggregate hit count and the time the redirect was last used. Redirect Service records are not intended to store a per-visitor browsing history, IP address, or User-Agent. Ordinary web-server, hosting, security, or diagnostic logs may still contain normal request information as described elsewhere in this Policy.

The Operator does not intend to use ordinary GorBot Website searches, navigation, or Redirect Service usage to construct advertising profiles about visitors.

4.5 Migrated Documentation

GorBot legal, support, documentation, and informational content that is part of the GorBot Service is now maintained through the internal GorBot CMS.

Historical references to a separate Gor Ultima MediaWiki publication service describe an earlier architecture and should not be interpreted as a current GorBot Website, CMS, account system, or publication channel.

4.6 External Links and Embedded Resources

GorBot CMS pages may link to third-party websites, images, videos, documents, or other resources.

When you follow an external link or load a resource hosted by another provider, that third party may independently receive information from your browser and apply its own privacy policy.

The Operator does not control a third party’s independent data practices.

Where practical, the Operator should avoid embedding unnecessary third-party tracking technology into GorBot CMS pages.

Player Studio pages may intentionally display externally hosted images or link to externally hosted publications/resources. When your browser loads an external image or you follow an external publication/resource link, your browser may connect directly to that third-party provider. That provider may receive ordinary request information such as your IP address, browser information, requested resource, referrer information where supplied, cookies already set by that provider, or other data under its own privacy practices.

4.7 No Public CMS Contributions

Because ordinary visitors cannot publicly post or edit GorBot CMS content, GorBot does not presently use the CMS to solicit public encyclopedia contributions, public comments, or public discussion posts.

If public account creation, editing, comments, uploads, forums, or other contribution features are enabled in the future, the Operator should update this Privacy Policy before or when those features become available to describe the additional information collected and the visibility of contributions, account names, IP addresses, revision history, or logs.

5. Information GorBot Does Not Intentionally Seek from Ordinary Users

GorBot is not designed to intentionally collect the following from ordinary Users:

• Discord passwords.
• Discord account tokens.
• Full payment-card numbers.
• Card verification codes.
• Online-banking passwords.
• Social Security numbers.
• Passport or driver-license numbers.
• Government identification numbers.
• Medical or health records.
• Protected health information.
• Biometric identifiers.
• Private cryptographic keys.
• API keys or Bot tokens.
• Authentication recovery codes.
• Precise real-world GPS location.
• Advertising profiles for sale to advertisers or data brokers.

Do not submit this information through GorBot.

If you accidentally submit highly sensitive information, contact privacy@gorbot.app promptly and identify where the information was submitted so the Operator can evaluate appropriate removal.

6. How GorBot Uses Information

GorBot may use information to:

• Authenticate Users.
• Link a dashboard account to a Discord identity.
• Determine Server membership and permissions.
• Operate Discord commands.
• Create and manage character profiles.
• Create and manage NPCs.
• Provide webhook roleplay.
• Maintain roleplay continuity and memory.
• Provide Personal Notes.
• Publish User-directed Server Discovery or shared NPC content.
• Operate Player Galleries, Publications, Character/User Profile Cards, Character Groups, public directories, external-media references, and media-dependency checks.
• Process publication-rights confirmations, public-content reports, and moderation of Player Studio content.
• Operate Forms & Applications, Suggestions, Giveaways, Verification, Honeypot Protection, Starboards, Sticky Messages, QOTD, Counting, Invite Tracking/rewards, Bump Reminders, Leveling, and Reputation.
• Execute automations and scheduled operations.
• Manage embeds, reaction roles, tickets, roles, and Server configuration.
• Perform moderation and security functions.
• Detect abuse, fraud, spam, or attacks.
• Enforce rate limits and permission checks.
• Investigate technical failures.
• Provide customer support.
• Operate Free/Premium feature limits.
• Maintain subscription entitlements.
• Reconcile verified billing events when billing is enabled.
• Maintain backups and disaster recovery.
• Perform failover and distributed processing.
• Improve reliability and fix defects.
• Operate and secure the official GorBot Website and CMS.
• Deliver requested GorBot CMS pages, search results, menus, media, and redirects.
• Authenticate and authorize CMS administrators and support-team accounts.
• Maintain CMS drafts, revisions, authorship, publication history, and administrative audit logs.
• Deliver requested GorBot CMS documentation and informational pages.
• Diagnose Website or CMS errors and maintain security or administrative logs.
• Comply with legal requirements.
• Protect GorBot, Users, Discord, Servers, Website visitors, infrastructure, and third parties.

GorBot does not intentionally use Discord API data for unrelated advertising, data-broker products, or eligibility decisions involving employment, housing, credit, insurance, or similar real-world benefits.

7. Legal and Operational Bases for Processing

Depending on the jurisdiction and the feature involved, GorBot may process information because:

• Processing is necessary to provide a Service or feature requested by the User.
• Processing is necessary to perform or administer the <a href="/cms-page.php?slug=terms-of-service" target="_self">Terms of Service</a>.
• A User or authorized Server administrator has chosen to enable or use a feature.
• The Operator has a legitimate interest in operating, securing, debugging, maintaining, and protecting the Service.
• Processing is needed to prevent fraud, abuse, or security incidents.
• Processing is needed to enforce Server or GorBot rules.
• Processing is needed to maintain records of a paid subscription or transaction.
• Processing is required to comply with law or a valid legal process.
• Consent has been provided where consent is the appropriate or legally required basis.

Where applicable law gives you a right to withdraw consent for optional processing, withdrawal does not invalidate processing lawfully performed before withdrawal and may prevent the affected feature from continuing to operate.

8. Discord API Data

GorBot receives some information through Discord’s APIs.

GorBot intends to use Discord API Data only as reasonably necessary to provide, secure, maintain, or support GorBot functionality permitted by Discord.

GorBot does not intentionally:

• Sell Discord API Data.
• Rent Discord API Data.
• License Discord API Data to data brokers.
• Disclose Discord API Data to advertising networks.
• Use Discord API Data for unrelated targeted advertising.
• Mine or scrape Discord for unrelated datasets.
• Use Discord API Data for employment, housing, insurance, credit, or similar eligibility decisions.
• Use Discord message content obtained through Discord APIs to train GorBot’s own machine-learning or large-language models.

Discord may require GorBot to update or delete Discord API Data when it is no longer necessary for GorBot functionality, when the applicable User requests deletion, when Discord requests deletion, when GorBot stops operating, or when applicable law requires deletion.

GorBot will handle Discord API Data subject to Discord’s applicable developer requirements.

For information about Discord’s own data practices, review:

• <a href="https://discord.com/privacy" target="_self">Discord Privacy Policy</a>
• <a href="https://discord.com/terms" target="_self">Discord Terms of Service</a>

9. Dashboard Sessions, Cookies, and Security Tokens

The GorBot dashboard uses technical session mechanisms needed for authentication and security.

These may include:

• A session cookie.
• Discord OAuth state.
• CSRF tokens.
• Authentication-state values.
• Selected Guild/Server context.
• Short-lived cached authorization or directory information needed to reduce unnecessary repeated requests.

Session cookies are intended to support the Service rather than behavioral advertising.

Where supported by the application and browser, session cookies may use protections such as:

• Secure transport.
• HTTP-only access.
• SameSite restrictions.
• Session regeneration after login.
• Server-side session validation.

Logging out ends the active GorBot dashboard session, although security, audit, OAuth, or account records stored separately from the browser session may remain according to this Policy.

10. Webhook Character Speech

When a User sends character dialogue through a supported roleplay command, GorBot may:

Identify the User’s selected character.

Read the character’s display name and avatar.

Use a Discord webhook.

Post the User-supplied dialogue under the fictional character identity.

Delete the original command message after successful replacement where the feature is configured to do so.

Record operational information needed for security, debugging, or continuity.

The visible webhook identity may differ from the Discord User’s visible account identity.

GorBot still associates the character internally with its owner where needed for ownership, moderation, security, or account management.

Authorized Server administrators or GorBot staff may be able to determine which account controls a character where necessary.

11. Public Profiles, Player Studio, Server Discovery, and Shared Content

Some information becomes public or shared only because a User or Server administrator intentionally enables a publishing feature.

Examples include:

• Public character profiles.
• Character names or avatars used for roleplay speech.
• Shared NPCs.
• Global NPC database entries.
• Server Discovery listings.
• Server descriptions.
• Invite links.
• Public Gallery pages and Gallery image references.
• Public Publications, covers, descriptions, author information, and external publication links.
• Public Character Profile Cards and User Profile Cards.
• Public gallery or image links.
• Public roleplay fields.

Users should review privacy/visibility controls before publishing content.

Public visibility does not automatically grant another User permission to reuse the content. GorBot may enforce ownership and reuse checks separately from viewing permissions.

Do not publish:

• A real-world home address.
• Private phone numbers.
• Private email addresses.
• Financial information.
• Medical information.
• Credentials.
• Information about another person that you are not authorized to publish.

The Operator may remove Published Content that violates law, Discord policy, the <a href="/cms-page.php?slug=terms-of-service" target="_self">Terms of Service</a>, privacy rights, intellectual-property rights, or Service rules.

12. Optional Third-Party Artificial Intelligence

Some GorBot features may optionally connect to a third-party artificial-intelligence provider.

Third-party AI processing should be disabled unless an authorized configuration enables it.

When enabled, information sent for a requested AI-assisted function may include:

• The User’s current message.
• Recent conversation context.
• Character or NPC name.
• Biography or roleplay profile information.
• Personality traits.
• Fictional relationship state.
• Relevant memories.
• Gossip or knowledge.
• Other minimum context reasonably needed to generate the requested response.

GorBot does not use Discord message content obtained through the Discord API to train GorBot’s own machine-learning models.

Third-party AI providers process submitted information under their own terms, privacy policies, security practices, retention rules, and service configurations.

The Operator should use data-minimizing provider configurations where reasonably available and should avoid sending credentials or unnecessary highly sensitive information.

Users should not submit confidential, medical, financial, government-identification, authentication, or other highly sensitive information to AI-enabled roleplay features.

13. Payments and Payment Providers

GorBot Server Premium is currently purchased through Discord subscriptions. Discord provides the current checkout and payment-processing flow. If GorBot later adds another authorized payment provider, that provider's processing would also be subject to its own terms and privacy practices.

The payment provider may independently collect:

• Name.
• Billing email.
• Billing address.
• Payment method details.
• Tax information.
• Fraud-prevention signals.
• Invoice and receipt information.
• Charge, refund, dispute, and subscription information.

GorBot should receive only the information reasonably needed to confirm and administer the purchase, such as provider identifiers, transaction/subscription status, billing-period dates, plan information, and the Discord Server that receives the entitlement.

GorBot does not intentionally store full card numbers or card verification codes.

Billing records may be retained after cancellation where reasonably required for:

• Accounting.
• Tax compliance.
• Fraud prevention.
• Chargebacks or disputes.
• Refund administration.
• Provider reconciliation.
• Legal obligations.
• Establishing or defending legal claims.

Billing questions may be sent to billing@gorbot.app.

14. Storage and Distributed Processing

GorBot uses shared persistent storage and distributed runtime systems to provide reliable service.

Information may be stored or processed using:

• SQL/database storage.
• Application storage.
• Configuration storage.
• Local runtime caches.
• Image or avatar storage/caches.
• Player Studio database records for Galleries, external-media references, Publications, Profile Cards, Character Groups, media dependencies, and reports.
• Community Power state for Forms/Applications, Suggestions, Giveaways, Verification, Honeypots, Starboards, Sticky Messages, QOTD, Counting, Invite Tracking, Bump Reminders, Leveling, Reputation, and Ticket intake references.
• Logs.
• Backups and recovery snapshots.
• Multiple GorBot processing nodes.
• Hosting, infrastructure, or database service providers.
• GorBot CMS page, revision, account, session, media, menu, redirect, and administrative-audit storage.

GorBot’s managed architecture may allow more than one runtime node to process the same authoritative shared Service state so another healthy node can continue operating when one node is unavailable.

A runtime node may therefore temporarily receive or cache information needed to process a command, deliver a Discord interaction, perform a health check, or provide an authorized dashboard request.

Distributed processing does not change the ownership or privacy classification of the underlying User information.

15. Backups and Recovery Copies

GorBot may make backups, snapshots, or configuration copies for:

• Disaster recovery.
• Rollback.
• Service continuity.
• Failed-update recovery.
• Database recovery.
• Security incident response.

Backups are rotated under operational retention schedules.

Deleting information from the active database may not immediately remove every copy from an existing backup.

Where practical, deleted information will disappear from backups as those backups expire or are overwritten in the ordinary retention cycle, unless a backup must be preserved for security, fraud, legal, or recovery reasons.

Backups are not intended to be used to restore a User’s deleted personal information merely to circumvent a valid deletion request.

16. Data Security

GorBot uses technical and administrative safeguards intended to reduce the risk of unauthorized access, disclosure, alteration, or destruction.

Depending on the component, safeguards may include:

• HTTPS/TLS for web traffic.
• Discord OAuth rather than collecting Discord passwords.
• Encrypted or protected storage for OAuth and other sensitive tokens.
• Restricted administrative access.
• Permission and role checks.
• CSRF protections.
• OAuth state validation.
• Secure/HTTP-only session cookies where supported.
• Session regeneration.
• Secret redaction.
• Separation of public and private infrastructure.
• Authenticated service-to-service communication.
• Restricted management interfaces.
• Input and file validation.
• External-media URL validation and provider allowlists.
• Rejection of prohibited URL schemes, embedded credentials, localhost/private-network destinations, and other unsupported external-media targets where applicable.
• Rate limiting.
• Login-attempt monitoring.
• Audit and security logging.
• Backups and rollback.
• Redundant processing and failover.

No Internet service or storage system can guarantee absolute security.

If you discover a potential vulnerability, report it privately to security@gorbot.app and do not publicly disclose credentials, private User information, or exploit details.

17. When Information May Be Shared

GorBot may share or make information available only when reasonably necessary for the Service or another lawful purpose described in this Policy.

Recipients may include:

• Discord — to deliver Discord interactions, messages, webhooks, roles, moderation actions, and other requested Discord functionality.
• Hosting and infrastructure providers — to host the web application, database, files, backups, or runtime services.
• Authorized GorBot processing nodes — to process Discord events and dashboard requests as part of the distributed Service.
• Payment providers — when a User initiates or manages a Premium purchase.
• Artificial-intelligence providers — only when an enabled feature requires third-party AI processing.
• Image, cloud-storage, publication, or content-hosting services — when a User supplies or links externally hosted content. A browser may also connect directly to such providers when displaying an external image or opening a publication/resource link.
• Authorized Server administrators — where their role gives them access to Server-owned configuration, moderation data, or information necessary to administer their Server.
• Professional advisers or service providers — where reasonably necessary for legal, accounting, security, or technical assistance and subject to appropriate duties.
• Law enforcement, courts, regulators, or government authorities — when disclosure is legally required or otherwise permitted for a valid legal or safety purpose.
• A successor operator — if operation of GorBot is lawfully reorganized, transferred, merged, or sold, subject to applicable privacy obligations.

GorBot does not disclose Discord API Data to advertising networks or data brokers.

18. No Sale of Personal Information and No Targeted Advertising Use

GorBot does not intentionally:

• Sell personal information.
• Sell Discord API Data.
• Rent personal information to data brokers.
• Share Discord API Data with advertising networks.
• Build advertising profiles from Discord API Data.
• Use Discord API Data for cross-context behavioral advertising.

If GorBot’s business model changes in a way that materially changes these practices, this Privacy Policy must be updated before that new processing is implemented where required.

Premium subscription fees are payment for GorBot features and capacity; they are not payment for the sale of User data.

The same no-sale principle applies to ordinary GorBot Website and CMS visitor information collected through routine web requests.

19. Data Retention

GorBot retains information only for as long as reasonably needed for the purposes described in this Policy, subject to technical, operational, security, legal, and Discord requirements.

Different categories may have different retention periods.

19.1 Account and OAuth Data

Account-linkage information may be retained while the GorBot account remains active or while needed to provide requested dashboard functions.

OAuth access information may be replaced, expire, be revoked, or be deleted when no longer needed.

Guild/Server-access information may be refreshed when you authenticate with Discord so stale access can be removed.

19.2 Character, NPC, Profile, and Personal Notes Data

Persistent roleplay records may remain stored until:

• The User deletes them using an available feature.
• An authorized Server administrator deletes Server-owned content where permitted.
• The User makes a valid deletion request.
• The Server is removed and applicable cleanup rules delete or archive the data.
• The Operator removes the information under the Terms.
• Retention is no longer necessary for the feature.

Published or cloned content may require separate deletion from each independent record.

19.3 Player Studio, External Media, and Publications

Player Studio records may remain while the User keeps the applicable Gallery, Publication, Character Group, or Profile Card, or while a referenced media item remains in use.

Removing an external-media reference from GorBot does not delete the underlying file from Google Drive, Dropbox, OneDrive, Discord, a personal website, or another third-party provider. The User must separately manage the underlying third-party resource.

A deleted or blocked media reference may remain temporarily in dependency, report, audit, moderation, or backup records where reasonably necessary to prevent broken references, investigate abuse, preserve moderation history, or complete normal backup expiration.

Publication-rights confirmation records may be retained with the Publication and for a reasonable period afterward where needed to document the User's submitted rights representation or respond to a copyright/legal complaint.

19.4 Forms, Applications, and Community Power Data

Form/Application submissions, Suggestions, Giveaway entries/history, Verification state, Honeypot/security incidents, Starboard/Sticky/QOTD/Counting state, Invite Tracking, Bump Reminders, Leveling, Reputation, and related derived/community records may have feature-specific retention or capacity limits.

Free and Premium Servers may have different history/capacity limits. A downgrade may preserve over-limit configuration or history without allowing new creation/use at the prior Premium scale. GorBot does not promise indefinite retention of over-limit, inactive, expired, or superseded Community Power data.

Security or abuse records generated by Honeypot, Verification, invite abuse, spam detection, or similar features may be retained longer than ordinary engagement/history data when reasonably necessary for incident response, repeated-abuse detection, moderation, fraud prevention, or legal claims.

19.5 Audit and Operational Logs

Routine audit and operational records may be automatically trimmed according to configured retention limits.

Current GorBot plan design may provide different audit/history retention or capacity for Free and Premium Servers. The current Plans & Features page describes applicable plan limits:

GorBot Plans & Features

Security, abuse, fraud, legal, or incident records may be retained longer when reasonably necessary even if routine audit records would otherwise expire.

19.6 Login and Security Records

Login-attempt information, IP addresses, authentication failures, and security events may be retained for a reasonable period needed to:

• Detect repeated attacks.
• Enforce rate limits.
• Investigate compromise.
• Prevent abuse.
• Establish or defend legal claims.
• Comply with law.

19.7 Billing Records

Billing and subscription metadata may be retained after a subscription ends when reasonably required for accounting, taxes, fraud prevention, disputes, provider reconciliation, refunds, legal obligations, or claims.

19.8 Support and Feedback

Support requests and feedback may be retained while the request is active and afterward for a reasonable period needed to maintain support history, prevent abuse, diagnose recurring issues, or establish what action was taken.

19.9 Backups

Deleted information may remain temporarily in rotating backups until the applicable backup expires or is overwritten.

19.10 Website and CMS Access, Security, and Administrative Logs

Ordinary GorBot Website and CMS access, error, search, security, and administrative logs may be retained for a reasonable operational period needed to operate the Website, investigate abuse, detect attacks, diagnose failures, maintain administrative accountability, or comply with law.

Authorized CMS account, login, session, authorship, revision, publication, restore, menu, media, redirect, and audit records may be retained for a reasonable operational period needed to manage access, preserve rollback history, investigate misuse, maintain accountability, resolve support or publication disputes, or comply with law.

The Operator may retain specific security or legal records longer when reasonably necessary for an incident, abuse investigation, legal hold, or claim.

20. Removal of GorBot from a Discord Server

Removing GorBot from a Server stops GorBot from receiving new Server events through the ordinary installed-app relationship.

Removal does not necessarily delete all existing information immediately.

Existing records may include:

• Server configuration.
• Character information.
• NPC information.
• Published or shared content.
• Player Galleries, Publications, Profile Cards, external-media references, or other User-owned Player Studio information that is not strictly Server-owned.
• Forms/Application submissions, Suggestions, Giveaway history, invite/level/reputation history, security incidents, or other Community Power records where retention still applies.
• Personal account information.
• Moderation records.
• Audit logs.
• Security records.
• Subscription records.
• Backups.
• Support records.

A Server Owner may contact privacy@gorbot.app about deletion of Server-associated information.

GorBot may automatically delete, archive, anonymize, or restrict information associated with inactive or removed Servers according to operational retention practices.

21. Your Privacy Rights

Depending on where you live and which laws apply, you may have rights concerning personal information about you.

These may include the right to:

• Ask whether GorBot processes information about you.
• Request access to certain information.
• Request correction of inaccurate information.
• Request deletion.
• Request a portable copy of certain information you provided.
• Object to or restrict certain processing where applicable.
• Withdraw consent for optional processing where consent is the basis.
• Opt out of certain sale or targeted-advertising processing where applicable.
• Appeal a denied privacy request where applicable law provides that right.
• File a complaint with an appropriate privacy regulator.

Not every right applies in every jurisdiction or to every category of information.

A request to delete a GorBot external-media reference does not delete the underlying third-party file. Requests involving content hosted by Google Drive, Dropbox, OneDrive, Discord, a personal website, or another provider may also require action through that provider.

GorBot does not currently sell personal information or use Discord API Data for targeted advertising, so an opt-out from those practices ordinarily should not be necessary while this Policy remains accurate.

22. How to Make a Privacy Request

Send privacy requests to:

To help locate the correct records, include only the information reasonably necessary for the request, such as:

• Your Discord user ID.
• Your Discord username.
• The affected Server/Guild ID or Server name.
• The affected character or NPC name/ID if relevant.
• The type of request: access, correction, deletion, portability, objection, or another privacy right.
• Enough detail to identify the information involved.

Do not send a Discord password, Discord token, payment-card number, private key, or recovery code.

The Operator may need to verify that the requester controls the relevant Discord account or is otherwise authorized to make the request before disclosing or deleting information.

Verification may be performed through:

• A logged-in GorBot dashboard session.
• An interaction from the relevant Discord account.
• An official support workflow.
• Other reasonable verification appropriate to the sensitivity of the request.

GorBot will respond within the period required by applicable law. Requests involving Discord API Data will also be handled subject to applicable Discord deletion and retention requirements.

23. Limits on Deletion Requests

A deletion request may not require GorBot to immediately delete every record where retention is lawfully or reasonably necessary for:

• Security.
• Fraud prevention.
• Abuse investigation.
• Moderation records.
• Accounting or tax obligations.
• Payment disputes or chargebacks.
• Compliance with law.
• A valid legal hold.
• Establishing, exercising, or defending legal claims.
• Protecting other Users or the Service.
• Temporary backup retention.
• Preventing a banned or abusive actor from immediately evading enforcement.
• Preserving records that cannot reasonably be separated from another User’s lawful record.
• Preserving publication-rights confirmations, public-content reports, moderation actions, or security incidents for a reasonable period where necessary to document or resolve a dispute.

When information must be retained for one of these reasons, GorBot should limit further use to the reason supporting retention where reasonably possible.

Deletion of a User’s source record may not delete independent content lawfully created by another User, such as an NPC clone, quoted material, moderation record, or Discord message controlled by Discord or another User.

24. Account Closure

A User may stop using GorBot at any time.

Closing or ceasing use of GorBot does not automatically erase every record.

A User seeking deletion should submit a privacy request when deletion is not available directly through a supported feature.

Account closure may result in some information being:

• Deleted.
• Anonymized.
• Disassociated.
• Archived.
• Retained for the limited purposes described in this Policy.

25. Children and Underage Users

GorBot is intended for adult communities and is governed by an adult-use requirement in the <a href="/cms-page.php?slug=terms-of-service" target="_self">Terms of Service</a>.

GorBot is not directed to children.

The Operator does not knowingly intend to collect personal information through GorBot from persons who do not meet the Service’s age requirements.

If the Operator learns that an underage person is using GorBot contrary to the Terms, the Operator may:

• Suspend or terminate access.
• Remove or restrict content.
• Delete information where appropriate and reasonably possible.
• Take other action needed to comply with Discord requirements or law.

A parent or guardian who reasonably believes GorBot has improperly collected information from a child may contact privacy@gorbot.app.

26. International Processing

GorBot is operated from the United States.

Discord, hosting providers, payment providers, AI providers, infrastructure providers, or other service providers may process information in other states or countries.

Those locations may have privacy laws different from the laws where you live.

Where applicable law requires safeguards for an international transfer, the Operator or applicable service provider should use a legally recognized transfer mechanism or other required safeguard.

27. Server Owner and Administrator Responsibilities

Server Owners and administrators who configure GorBot should:

• Use only the Discord permissions needed for desired features.
• Enable only features appropriate for their community.
• Review public/private visibility settings.
• Avoid placing sensitive personal information into roleplay, gossip, memory, automation, moderation, or custom fields.
• Protect access to Server-management functions.
• Limit staff access appropriately.
• Review automations before enabling them.
• Review Forms/Application questions and avoid using community forms to solicit unnecessary highly sensitive personal information.
• Configure Honeypot, Verification, Giveaway, invite-reward, leveling/reputation, and other automated Community Power rules carefully.
• Moderate Player Studio publications, Galleries, Profile Cards, external links, and other public/shared content responsibly where the Server has authority over that content.
• Inform members of Server-specific processing where the Server itself has a legal obligation to do so.
• Use moderation and security records responsibly.
• Respect User privacy rights.
• Remove GorBot if they no longer accept the Service’s data practices.

A Server Owner’s independent collection or use of information outside GorBot is governed by that Server Owner’s own responsibilities and is not automatically controlled by this Policy.

28. Security Incidents and Data Breaches

If the Operator becomes aware of unauthorized access, disclosure, loss, or misuse that may materially affect protected User information, the Operator may take steps such as:

• Investigating the incident.
• Containing unauthorized access.
• Resetting or revoking affected credentials.
• Repairing affected systems.
• Preserving necessary evidence.
• Reviewing logs and backups.
• Notifying affected Users where required by law or reasonably appropriate.
• Notifying Discord where required by Discord’s developer requirements.
• Notifying regulators or authorities where legally required.

Potential vulnerabilities should be reported privately to:

security@gorbot.app

Abuse or safety reports may be sent to:

abuse@gorbot.app

29. Legal Requests and Required Disclosure

The Operator may preserve or disclose information when reasonably believed necessary to:

• Comply with applicable law.
• Respond to valid legal process.
• Protect the rights, property, or safety of GorBot, the Operator, Users, Discord, or others.
• Investigate fraud, abuse, attacks, or violations.
• Establish, exercise, or defend legal claims.

The Operator may challenge, narrow, or reject a request that appears invalid, overbroad, or unlawful where legally permitted.

Legal notices should be sent to:

legal@gorbot.app

30. Automated Systems and Significant Decisions

GorBot may use automated systems for:

• Roleplay responses.
• NPC behavior.
• Spam or abuse detection.
• Security checks.
• Rate limits.
• Feature entitlements.
• Server automations.
• Moderation workflows configured by Server administrators.
• Honeypot and Verification actions.
• Invite attribution and reward calculations.
• Leveling, XP, reputation, counting, reaction, and other community-derived values.
• Giveaway winner selection.
• Form/Application routing or configured actions.

GorBot does not intend to use Discord API Data to make automated decisions about a person’s eligibility for employment, housing, insurance, credit, education admission, government benefits, or similarly significant real-world opportunities.

Server administrators are responsible for reviewing the consequences of moderation or automation rules they configure.

Automated or derived community values can be inaccurate because of Discord events, deleted messages/invites, caching, outages, race conditions, permissions, abuse controls, or other technical limitations. GorBot does not treat those values as authoritative real-world assessments.

31. Business Transfers or Change of Operator

If GorBot is reorganized or transferred to another lawful operator, relevant information may be transferred as part of that transaction where permitted by law.

Any successor receiving personal information would be expected to handle it subject to applicable privacy obligations.

If the transfer materially changes the purposes for which information is processed, this Privacy Policy should be updated and additional notice or consent provided where legally required.

32. Changes to This Privacy Policy

This Policy may be updated when GorBot features, infrastructure, payment systems, laws, Discord requirements, or operating practices change.

The latest version will be posted on this page with an updated revision date.

Material changes may also be announced through:

• GorBot’s website.
• Discord.
• The GorBot dashboard.
• Another appropriate official communication channel.

Where applicable law requires notice or consent before a material new use of personal information, the Operator will follow that requirement.

33. Contact Information

Additional official resources:

• Terms of Service: <a href="/cms-page.php?slug=terms-of-service" target="_self">GorBot Terms of Service</a>
• Support: <a href="/cms-page.php?slug=gorbot-support" target="_self">GorBot Support</a>
• Contact: <a href="/cms-page.php?slug=contact-us" target="_self">Contact Us</a>
• Plans & Features: <a href="/plans-features.php" target="_self">GorBot Plans & Features</a>
• Discord Privacy Policy: <a href="https://discord.com/privacy" target="_self">discord.com/privacy</a>

These role addresses may be implemented as separate mailboxes or aliases/forwarders, but privacy, legal, billing, security, and abuse communications should be monitored and handled according to their purpose.

Users should never email passwords, Discord account tokens, API keys, Bot tokens, database credentials, payment-card security codes, private keys, TOTP secrets, or recovery codes.

34. Player Studio, External Providers, and Browser Connections

Player Studio is designed to distinguish between ownership, hosting, and presentation.

A Player may own the GorBot Gallery record, Publication listing, Character Card, User Card, or Character Group while the underlying image or publication file is hosted by a third party.

When externally hosted media is displayed:

• GorBot may provide the external resource URL to the User's browser.
• The browser may connect directly to the external provider.
• The provider may receive the User's IP address, browser/User-Agent information, requested resource, referrer information where supplied, and cookies or account state already maintained by that provider.
• The external provider's own privacy policy and terms apply to that provider's processing.
• GorBot may store provider name, original/normalized URL, validation state, last-check information, and dependency relationships needed to operate the feature.
• GorBot may block or stop displaying a resource that becomes unsupported, inaccessible, reported, or unsafe.

GorBot does not control a third-party provider merely because a User chose to link or display content hosted there.

Existing Character images may be stored through GorBot's established Character-media pathway and may be reused by the owning User through supported Player Studio features. Reuse permissions are checked separately from public visibility.

35. Forms, Applications, Security Features, and Community-Derived Data

Server Owners may configure Community Power features that collect or derive information about Server members.

Forms & Applications can contain answers supplied by Users. Server Owners and authorized staff who create a Form determine what questions are asked and which staff may review the answers. GorBot provides the technical system but does not require Servers to collect sensitive information.

Users should not submit passwords, authentication tokens, payment-card information, government identification numbers, medical records, or other highly sensitive information through ordinary community Forms.

Security and moderation features such as Honeypot Protection and Verification may generate incident records, role-state records, action results, or security classifications. Those records may be visible to authorized Server staff and may be retained under the security/abuse retention rules in this Policy.

Invite Tracking, XP, levels, Reputation, Counting, reactions, and similar systems can create derived data based on Discord activity. These values are intended for Server/community functionality and may be adjusted, reset, corrected, or deleted according to feature rules and retention limits.

Giveaway entries and winner-selection records may be retained for feature operation, rerolls, dispute resolution, abuse prevention, or Server administration for a reasonable period.

36. Independent Privacy Policy Versioning

This Privacy Policy uses its own document-version series independent from GorBot Portal, NodeApp, Agent, Bootstrap, CMS, database-schema, or other software release numbers.

The initial independent Privacy Policy version was:

1.0.0.0

The current Privacy Policy version is:

1.0.0.2

The Policy may remain at the same version when GorBot software changes do not require a Privacy Policy revision. When this Policy itself changes, the Privacy Policy version may be incremented independently.

The Current GorBot Release Alignment shown near the top of the Policy is informational and identifies the GorBot release whose major data flows were considered during the most recent review. It is not the Privacy Policy version.