EchoGuardPrivacy Policy
How EchoGuard processes personal data (GDPR).
1. Who is responsible
EchoGuard (“we”) is operated by NovaHUB. We are the data controller for the processing described below.
Contact for privacy requests Discord: yakuzaa.x (Please state the reason for your request when adding me as a friend.).
2. At a glance
- This website uses no cookies, no analytics and no advertising, and loads nothing from third parties.
- The bot keeps your listening statistics pseudonymised and encrypted. You can stop all collection and erase everything with
/privacy on. - You can download your data with
/exportand delete it with/resetstats. - We never sell your data and never use it for advertising or profiling that affects you.
3. What we process, why and for how long
| Category | Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| Operating the bot | Discord user ID, server (guild) ID, channel IDs, message IDs of the “now playing” message, voice state (who is in the channel, muted/deafened), command inputs | Run commands, join voice, apply DJ role and vote skip | Contract – art. 6(1)(b) | In memory during the session only |
| Playback recovery after a restart | Server and channel IDs, queued tracks and position (encrypted), requester ID | Resume playback after a restart | Legitimate interest – art. 6(1)(f) | 30 minutes at most; deleted when playback ends; never includes users in privacy mode |
| Listening statistics (/stats, /wrapped) | Pseudonymised user ID (HMAC-SHA-256), track and artist names (AES-256-GCM encrypted), play counts, listening time, radio stations and time, monthly totals (UTC), active days, last-activity date | Show you your own statistics and recap | Legitimate interest – art. 6(1)(f); you may object at any time with /privacy on | Until you delete them; accounts inactive for 12 months are deleted; monthly and daily data kept 13 months at most |
| Saved tracks (/save, /mysaves) | Pseudonymised user ID, title, artist, link (encrypted), save date | Keep the list you asked for | Contract – art. 6(1)(b) | Up to 50 per user; until you delete them or 12 months of inactivity |
| Server statistics (/serverstats) | Pseudonymised server ID, number of tracks, total listening time, last-activity date | Aggregate stats for a server | Legitimate interest – art. 6(1)(f) | Deleted when the bot is removed; 12 months of inactivity |
| Settings and limits | Privacy-mode flag, DJ role ID of a server, timestamps for the export (30 days) and report (24 h) limits | Respect your choices, limit abuse | Contract / legitimate interest | Until you change them; limits expire automatically |
| Reports (/report) | What you write, your Discord ID and username, server name and ID, voice-channel context | Handle bugs and abuse | Legitimate interest – art. 6(1)(f) | 12 months, then deleted |
| Security and technical logs | Error messages, server IDs, timestamps | Security and debugging | Legitimate interest – art. 6(1)(f) | 30 days at most, rotated |
| Music requests (/play) | The text or link you type | Find and stream the audio | Contract – art. 6(1)(b) | Not stored by us; a 45-minute in-memory cache holds results without your identity |
Providing data is not a legal or contractual requirement, but without the data in the first row the bot cannot work. Statistics are optional.
4. Pseudonymisation and security
- Your Discord ID and server ID are replaced by a keyed hash (HMAC-SHA-256) before being used as database keys.
- Track and artist names, saved links and playback-recovery data are encrypted (AES-256-GCM).
- The database is only readable by the bot’s system account, deleted rows are overwritten, and input from users is validated and rate-limited.
- In case of a personal data breach likely to create a risk, we notify the CNIL within 72 hours and affected users where required.
5. Recipients and transfers
- Discord Inc. delivers commands and messages and is an independent controller (see Discord’s privacy policy). It is based in the United States and relies on its own transfer safeguards.
- External audio node. Audio is resolved and streamed by a public Lavalink node operated by a third party, the Free Lavalink Project / Serenetia Hosting (
freelavalink.serenetia.com), not by us. It receives your search text or link, track identifiers, the bot’s technical voice-connection data (server ID, voice-channel ID, bot ID, voice session token) and our server’s IP address. It does not receive your Discord user ID, your statistics or your saved tracks. Its operator publishes its own policy at freelavalink.serenetia.com/privacypolicy, which mentions logs of IP addresses, client types and usage; the operator does not state where the node is hosted, so it may be outside the European Economic Area. Do not type personal data into /play. - Music platforms (e.g. YouTube, Spotify, SoundCloud) receive requests from the audio node, not from you.
We do not sell data and do not use advertising or analytics providers.
6. Your rights and how to use them
| Right | How |
|---|---|
| Access and portability (art. 15, 20) | /export gives a JSON file of all data linked to you (once every 30 days). /stats, /mysaves and /wrapped show it in Discord. |
| Erasure (art. 17) | /resetstats deletes your data. Removing the bot deletes server data. |
| Objection and withdrawal (art. 21, 7) | /privacy on deletes your data and stops all collection. /privacy off resumes it. |
| Rectification, restriction, questions (art. 16, 18) | Statistics are generated automatically and cannot be edited; delete them instead. For anything else, contact us. |
Because we only hold pseudonyms, we cannot find your data from a name or an email: use the commands from your Discord account, or prove that you control it if you write to us (art. 11). We answer within one month.
You may lodge a complaint with the CNIL (www.cnil.fr) or your local data protection authority.
7. Children
EchoGuard is not directed at children under 13 and follows Discord’s minimum-age rules. In France, minors under 15 should have a parent’s agreement before using online services; if you are under 15, ask a parent and consider /privacy on.
8. Automated decisions
We take no decision producing legal or similarly significant effects on you. Labels such as the profile shown in /wrapped are for entertainment only.
9. This website
No cookies, local storage, analytics, advertising, social widgets or third-party fonts are used, so no consent banner is needed. Our web host may keep technical logs (such as IP addresses) for security. Links to Discord, Top.gg and other sites are governed by their own policies.
10. Changes
We update this policy when the bot changes. The date above shows the latest version; important changes are announced on the support server.